At a manufacturer, a signature matches an industrial vendor's licensed remote-support tool, and the change ticket authorized that tool for this window. The activity occurred and policy allows it. Which classification fits?
Select an answer to reveal the explanation.
Short Explanation
A licensed plumber on the work order is not a burglar who picked the lock. The signature matched a remote-support tool your change ticket allowed in this window, so the activity is benign. A silent sensor, an empty period, and a hostile exploit describe other outcomes.
Full Explanation
The exam uses benign for activity that really happened and that policy allows. Benign activity: the licensed remote-support tool ran inside the authorized change window, so the match is allowed work, fits a signature that saw the real tool during a ticketed window. A false negative, with the sensor silent while an attack on the plant host completed, requires silence during an attack, and here the signature matched. A true negative, a period with nothing notable to inspect and no alert expected, requires a quiet clean window, and a support session did occur. A successful exploit, treating the authorized remote-support session as hostile code execution, would mean unauthorized execution, and the license plus the change ticket make this session allowed. The signature did its job by seeing the tool; the classification then asks whether that seen activity was permitted. Exam caveat: benign means the activity occurred and it is permitted; a match on an allowed tool in a ticketed window is not proof of compromise. Operational check: compare the process, the vendor account, and the change-window times before the alert is closed.