hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst is reviewing logs and sees an…
A security analyst is reviewing logs and sees an alert for a known malware signature on an endpoint. Upon investigation, the file is identified as a false positive. What should the analyst do next?
⚠ Common exam trap
Test-takers frequently confuse 'false positive' with 'true positive' and choose to quarantine or escalate, failing to recognize that the correct response is to tune the detection rule to eliminate noise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an exception in the detection rule.
Creating an exception in the detection rule is the correct next step because the file has been confirmed as a false positive. This action prevents the security tool from generating future alerts for the same benign file, reducing noise and allowing the analyst to focus on genuine threats. It is a standard whitelisting practice in endpoint detection and response (EDR) or antivirus systems to maintain operational efficiency without compromising security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an exception in the detection rule.
Why this is correct
An exception reduces noise and improves detection fidelity for actual threats.
- ✗
Quarantine the endpoint anyway.
Why it's wrong here
Quarantine is not warranted for a false positive and would impact user productivity.
- ✗
Escalate to management.
Why it's wrong here
Escalation is unnecessary for a false positive; the analyst can handle it.
- ✗
Delete the alert from the SIEM.
Why it's wrong here
Deleting only removes the log; it does not prevent recurrence.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.