Handling IDS Alerts: Verify Scanner Schedule and Source IP
An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?
Quick Answer
The answer is to mark the alert as a likely false positive after verifying the scanner schedule and source IP. This is correct because the IDS alert for a SQL injection attack matches the known, authorized behavior of the company’s vulnerability scanner, which routinely sends malicious-looking payloads to test web application defenses. Correlating the source IP and timestamp with the scanner’s schedule confirms the traffic is legitimate, turning what appears to be an attack into a false positive from the vulnerability scanner. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish between malicious traffic and authorized security testing, a common trap where analysts might escalate a harmless alert. The key is to always check asset inventories and change management records before reacting. Memory tip: “Scan before you panic” — always verify the scanner’s schedule and IP before treating an alert as an incident.
⚠ Common exam trap
Many candidates assume any SQL injection pattern in IDS logs is malicious, overlooking the possibility that the traffic originates from an authorized internal security tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mark the alert as a likely false positive after verifying the scanner schedule and source IP.
The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Treat the alert as a confirmed breach and begin password resets for all portal users.
Why it's wrong here
Resetting every portal user's password treats benign scanner traffic as a breach, causing mass disruption without evidence of compromise. It is tempting because credential rotation is a standard containment action after confirmed account compromise, and would be correct if the logs showed genuine exfiltration or unauthorised authentication.
- ✓
Mark the alert as a likely false positive after verifying the scanner schedule and source IP.
Why this is correct
The source IP and request pattern match the vulnerability scanner's authorised schedule, confirming benign activity rather than a real SQL injection attempt, so closing the alert as a likely false positive is proportionate and avoids unnecessary escalation.
- ✗
Block the scanner IP permanently to prevent future alerts from the same host.
Why it's wrong here
Permanently blocking the scanner IP halts scheduled vulnerability scanning and generates false negatives across every future assessment. It is tempting because blocking a source address is the usual response to malicious traffic, and would be correct if the host were an unauthorised attacker rather than the company's own scanning infrastructure.
- ✗
Quarantine the reporting server because IDS alerts always indicate active exploitation.
Why it's wrong here
Quarantining the reporting server disrupts a production system when the traffic is authorised scanner activity, not exploitation. It is tempting because isolation is the standard containment step for a genuine confirmed compromise, and would be correct if the source were an unknown external host actively exploiting the portal.
Go deeper
Related to this question
Learn chapter
SOC Tool Stack Overview
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,030-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?
medium- A.Treat it as a confirmed intrusion and immediately take the portal offline.
- ✓ B.Close it as expected activity after validating the scanner schedule and source IP.
- C.Classify it as malware because the blocked payload proves the scanner is infected.
- D.Disable the WAF rule so the scanner can complete without generating more alerts.
Why B: The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.