A county SOC sees two port-scan notables after the same night: one source is the city's authorized vulnerability scanner during the published window, and the other is an unknown external host. How should the analyst disposition them?
Select an answer to reveal the explanation.
Short Explanation
Think fire inspector versus burglar jiggling the same doors. The city's own scanner is supposed to knock; an unknown host doing the same thing is not. The analytic was right both times—the disposition follows authorization, not the port-scan label.
Full Explanation
Authorized vulnerability scanning and unknown external scanning can match the same port-scan analytic yet deserve different dispositions. For the city's published scanner window, Benign Positive - Suspicious But Expected records that the detection was right and the activity was approved; for the unknown external host, True Positive - Suspicious Activity records unauthorized suspicious activity. Labeling both True Positive fails by concept because it treats authorized civic scanning as an incident and floods response the same as an outsider. Labeling both False Positive - Incorrect Analytic Logic fails by concept because port-scan detections that correctly match scan behavior are not broken merely because a scanner exists. Calling the unknown host Benign Positive while calling the city scanner False Positive - Inaccurate Data fails by concept because it inverts expectedness and invents a data-quality defect where authorization is the real distinction. Exam caveat: SPLK-5001 expects disposition to separate authorized expected matches from unauthorized true positives on the same analytic. Operational check: verify the scanner inventory and window, assign Benign Positive for in-window city scans, assign True Positive for unknown scanners, and contain or block the external source while keeping the analytic enabled.