Investigation confirms credential stuffing against the utilities payment portal that the city did not authorize. Which disposition should the analyst assign?
Select an answer to reveal the explanation.
Short Explanation
They stuffed credentials at the utilities portal and the city did not ask for that test. That is True Positive - Suspicious Activity. 'Portals get stuffed' is not an authorized exception, and you are past Undetermined once it is confirmed.
Full Explanation
Investigation that confirms unauthorized credential stuffing against the utilities payment portal is True Positive - Suspicious Activity: the finding correctly identifies malicious or suspicious activity the city did not authorize. Civic finance portals are frequent stuffing targets, and confirmed unauthorized attempts deserve that disposition and follow-on containment. Benign Positive - Suspicious But Expected fails by concept because routine portal noise or authorized scanning does not make confirmed unauthorized stuffing an approved behavior the city expects. False Positive - Inaccurate Data fails by concept when portal logs correctly identify the activity; a portal log can absolutely underlie a notable when mapped and correlated properly. Undetermined fails by concept once analysis has confirmed malicious activity—the disposition should reflect that confirmation rather than remain an open guess. Exam caveat: SPLK-5001 uses True Positive - Suspicious Activity for confirmed unauthorized suspicious or malicious findings on civic services. Operational check: document stuffing evidence on the utilities portal, assign True Positive - Suspicious Activity, contain with blocks, rate limits, or resets per policy, and tune detections if coverage arrived late.