After confirming a DLP alert is a false positive, what should the analyst do in the alert workflow?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Close the loop: mark the alert appropriately so metrics and SOC queues stay honest.
Full explanation below image
Full Explanation
Correct Answer — B
DLP alert lifecycle includes disposition status. Stale active alerts cause fatigue. Deleting Purview or granting Global Admin is wrong.
Exam tip: FP DLP alert → investigate and resolve status.