Based on the image of a validated false positive alert below, which action is recommended for resolution?

Question

Exhibit

Options

• ACreate an alert exclusion for OUTLOOK.EXE
• BDisable an action to the CGO Process DWWIN.EXE
• CCreate an exception for the CGO DWWIN.EXE for ROP Mitigation Module
• DCreate an exception for OUTLOOK.EXE for ROP Mitigation Module

• A
  5% (2)
• B
  16% (6)
• C
  8% (3)
• D
  70% (26)

Explanation

Option D is correct because when a false positive has been validated, the appropriate remediation is a targeted exception - one that ties the specific trusted process (OUTLOOK.EXE, the parent process that triggered the alert) to the exact detection module that misfired (ROP Mitigation). This surgical approach resolves the false positive without opening broader security gaps.

Why the distractors are wrong:

• A is too broad - an alert exclusion suppresses all alerts for OUTLOOK.EXE regardless of module, which could mask real future threats.
• B is wrong process, wrong action type - DWWIN.EXE is the child/called process (CGO), not the one that triggered the ROP detection; also "disabling an action" is not the same as creating a proper exception.
• C targets the wrong process - applying the ROP Mitigation exception to DWWIN.EXE (the child) rather than OUTLOOK.EXE (the triggering parent) won't resolve the alert.

Memory tip: Think "validated false positive = fix the exact thing that broke." Match the triggering process (OUTLOOK.EXE) to the specific module (ROP Mitigation) - never exclude broadly, and never target the child process when the parent caused the alert.

No community discussion yet for this question.