An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Treat the alert as a confirmed breach and begin password resets for all portal users.

The source and request pattern indicate authorized testing, not evidence of an actual breach.

Block the scanner IP permanently to prevent future alerts from the same host.

Blocking an approved scanner can break vulnerability management and does not solve the validation problem.

Quarantine the reporting server because IDS alerts always indicate active exploitation.

IDS alerts require context; many are benign tests, misconfigurations, or known maintenance activities.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Mark the alert as a likely false positive after verifying the scanner schedule and source IP. — The analyst should verify that the traffic came from an approved vulnerability scanner and that the scan was scheduled. Internal security tools often generate attack-like patterns by design, so the key task is distinguishing authorized testing from genuine exploitation. Once the source, timing, and scan profile match an approved activity, the alert can be classified as a likely false positive and documented accordingly. Why others are wrong: Treating it as a breach or quarantining the server is too aggressive without corroborating evidence. Permanently blocking the scanner would interfere with recurring security testing and still would not confirm whether the alert was valid. The safest operational choice is to validate the scanner context first.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.