Question 532 of 1,013
Handling IDS Alerts: Verify Scanner Schedule and Source IP
An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?
Quick Answer
The answer is to mark the alert as a likely false positive after verifying the scanner schedule and source IP. This is correct because the IDS alert for a SQL injection attack matches the known, authorized behavior of the company’s vulnerability scanner, which routinely sends malicious-looking payloads to test web application defenses. Correlating the source IP and timestamp with the scanner’s schedule confirms the traffic is legitimate, turning what appears to be an attack into a false positive from the vulnerability scanner. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish between malicious traffic and authorized security testing, a common trap where analysts might escalate a harmless alert. The key is to always check asset inventories and change management records before reacting. Memory tip: “Scan before you panic” — always verify the scanner’s schedule and IP before treating an alert as an incident.
⚠ Common exam trap
Many candidates assume any SQL injection pattern in IDS logs is malicious, overlooking the possibility that the traffic originates from an authorized internal security tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mark the alert as a likely false positive after verifying the scanner schedule and source IP.
The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Treat the alert as a confirmed breach and begin password resets for all portal users.
Why it's wrong here
The source and request pattern indicate authorized testing, not evidence of an actual breach.
- ✓
Mark the alert as a likely false positive after verifying the scanner schedule and source IP.
Why this is correct
Authorized scanners often resemble attacks, so confirming the source and schedule is the right validation step.
- ✗
Block the scanner IP permanently to prevent future alerts from the same host.
Why it's wrong here
Blocking an approved scanner can break vulnerability management and does not solve the validation problem.
- ✗
Quarantine the reporting server because IDS alerts always indicate active exploitation.
Why it's wrong here
IDS alerts require context; many are benign tests, misconfigurations, or known maintenance activities.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IDS generates an alert for possible SQL injection against an internal reporting portal at 02:00. The web logs show the source IP belongs to the company's approved vulnerability scanner, the request path matches the scheduled test window, and the WAF blocked the request. What is the most appropriate analyst conclusion?
medium- A.Treat it as a confirmed intrusion and immediately take the portal offline.
- ✓ B.Close it as expected activity after validating the scanner schedule and source IP.
- C.Classify it as malware because the blocked payload proves the scanner is infected.
- D.Disable the WAF rule so the scanner can complete without generating more alerts.
Why B: The alert matches expected, authorized activity: the source IP belongs to the approved vulnerability scanner, the request occurred during the scheduled test window, and the WAF blocked the malicious payload. This is a classic false positive triggered by legitimate security testing, not an actual intrusion. The analyst should validate the scanner schedule and source IP, then close the alert as expected activity.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.