Security Triage Error Detection & Correction

1. A junior analyst assigns a 'false positive' label to an alert for a user accessing sensitive files outside normal business hours, because 'the user account is legitimate.' What correction is needed?

Legitimate accounts can be compromised; investigate anomalous access patterns regardless

Legitimate accounts cannot trigger security alerts

After-hours file access is always authorized

User legitimacy eliminates need for behavior analysis

2. A junior analyst marks a 'suspicious network connection to known malicious IP' as 'false positive' because 'the connection was blocked.' What is the error in this conclusion?

Blocked connections still indicate compromise attempt or malware; investigate the source endpoint

Blocked connections eliminate all security risk

Only successful connections require investigation

Connection blocking removes the need for incident response

3. A junior analyst dismisses an alert for 'suspicious scheduled task creation' because 'scheduled tasks are a normal administrative function.' What correction is needed?

Investigate task name, trigger, and action; malware commonly uses scheduled tasks for persistence

Scheduled tasks are always safe

Normal administrative use prevents malicious use

Scheduled task alerts are inherently false positives

4. A junior analyst receives an alert for 'process injection detected' but closes it because 'the injection target process is low-risk.' What flaw exists in this reasoning?

Process injection is dangerous regardless of target; investigate injector and payload

Low-risk processes cannot be injection targets

Injection severity depends entirely on the target process

Process injection alerts should always be ignored

5. A junior analyst marks a 'PowerShell script execution' alert as 'routine' because 'PowerShell is used by legitimate IT staff.' What correction should be made?

Verify script source, parameters, and purpose; PowerShell is commonly abused in attacks

Legitimate staff use eliminates all risk

PowerShell execution is always benign

Script legitimacy depends solely on who runs it

6. A junior analyst ignores multiple alerts for the same user account because 'they all arrived within a short time window and might be correlated.' What error exists?

Correlation can indicate coordinated attack; investigate patterns and root cause rather than dismiss

Multiple alerts for one user should always be ignored

Time-clustered alerts are always false positives

Correlated alerts are never indicative of real incidents

7. A junior analyst categorizes a 'Mimikatz process execution' alert as 'medium priority' because 'the tool is known and documented.' What correction is required?

Escalate to critical; Mimikatz is used for credential dumping; investigate context and source immediately

Known tools are always low-risk

Documented tools cannot be used maliciously

Process execution severity depends on tool documentation status

8. A junior analyst receives an alert for 'ARP spoofing detected' but closes it because 'the alert came from a test environment.' What is the flaw in this triage decision?

Alerts should be investigated in any environment; validate the source and escalate if legitimate

Test environments do not require security investigation

ARP spoofing alerts are always false positives

Environmental context overrides the need for incident response

9. A junior analyst notes that a suspicious process 'wmiexec.exe' appeared briefly and closed, then marks it 'informational' because 'it's not running now.' What correction applies?

Investigate process execution history; brief execution is typical of post-exploitation activity

Processes that have terminated pose no security risk

Process names are less important than runtime duration

Only active processes require incident response

10. A junior analyst dismisses a registry modification alert for 'HKLM\System\Run' because 'it was initiated by an admin.' What error occurs in this assessment?

Admin privileges do not prevent malicious modifications; investigate the source and purpose

Admin-initiated changes are always safe

Registry Run keys cannot be exploited

Only non-admin registry changes require investigation

11. A junior analyst marks a phishing email with embedded malware as 'low priority' because the sender domain appears legitimate. What is the primary error in this triage decision?

Overlooking payload analysis; legitimacy of sender domain does not reduce malware risk

Phishing emails should never be marked as low priority

The analyst failed to check the email's SPF record first

Domain legitimacy automatically reduces incident severity

12. A junior analyst reports a port scan from an external IP as 'low priority' because 'only ports above 10000 were scanned.' What is the logical flaw?

Port scan intent matters more than range; reconnaissance activity warrants escalation

Scans targeting high-numbered ports are always benign

Port scans are only dangerous if they target ports 1–1024

External scans are routine and should be ignored

13. A junior analyst closes an alert for 'certificate validation failed' on a critical API endpoint, reasoning that 'SSL errors happen all the time.' What error exists here?

Cert validation failures on critical endpoints indicate MITM risk or misconfiguration; investigate

SSL errors are always benign

API endpoints do not require certificate validation

Frequent cert errors justify ignoring isolated incidents

14. A junior analyst marks a Windows event log entry 'EventID 4625 (failed login)' appearing 50 times in 10 minutes as 'routine activity.' How should this be corrected?

Escalate to high severity; this frequency suggests brute-force or credential stuffing attack

EventID 4625 is informational and should be ignored

50 failed logins over 10 minutes is normal for busy networks

Only escalate if EventID exceeds 1000 occurrences

15. A junior analyst ignores a spike in outbound traffic from a workstation to an unknown IP because 'the user is working late.' What correction applies?

Investigate regardless of timing; unusual outbound traffic suggests lateral movement or data exfil

Users working late may legitimately generate unusual traffic

Outbound traffic is always lower priority than inbound

Verify the user's schedule, then close the alert if confirmed

16. A junior analyst categorizes data exfiltration of 50 MB as 'low severity' because the database contains 500 GB total. What is the flaw in this reasoning?

Data sensitivity and compliance impact matter more than volume; classify based on data type

Only exfiltration above 10% of database size is serious

50 MB is always a low-severity incident

Volume is the only metric that determines severity

17. A junior analyst notes that a DNS query for 'malicious-c2-domain.ru' is 'blocked by firewall, so no incident.' What error exists in this conclusion?

Blocked queries still indicate compromise attempt; investigate the source endpoint

DNS queries cannot be malicious if blocked

Only successful connections require investigation

The firewall's block action removes all need for incident response

18. A junior analyst reports that 200 failed SSH login attempts against a server is 'normal background noise.' How should you correct this assessment?

Investigate the source IPs and implement rate-limiting; this volume warrants escalation

Agree; SSH brute-force attempts are expected daily

Lower the alert threshold to reduce false positives

Archive the logs without further action

19. A junior analyst dismisses an alert for unsigned executable running from %TEMP% because the file size is small (12 KB). What is the error in reasoning?

File size is irrelevant; unsigned executables in temp folders are high-risk regardless of size

Small files cannot contain malware

The analyst should have checked the file extension instead

Unsigned files are only concerning if they exceed 1 MB

20. A junior analyst classifies an internal user account with failed login attempts from 15 different countries in one hour as 'medium severity.' What correction should you make?

Escalate to critical; this indicates credential compromise or brute-force attack

Downgrade to low; geolocation data is unreliable

Keep medium; failed attempts are blocked automatically

Reclassify as informational; the user may be traveling

Security Expert Correcting a Junior Analysts Triage Error Quiz