Which signal most strongly justifies declaring an incident rather than treating it as a single alert?

• A. Single unusual login event
• B. Correlated alerts across multiple sources
• C. Routine vulnerability scan result
• D. Known malware signature detected on one host

Answer: (B)

The key idea is that an incident is declared when there’s evidence of an ongoing compromise or a broader threat affecting multiple parts of the environment, not just a single event. When alerts from multiple sources line up in time and context—showing a pattern of activity that suggests a coordinated or widespread issue—the certainty rises that something real and significant is happening. This cross-source correlation signals attacker movement, lateral spread, or repeated attempts that could impact operations, so it warrants activating incident response procedures, containment, and eradication efforts.

A single unusual login on its own could be legitimate or noise and doesn’t prove a broader problem. A routine vulnerability scan result is expected and often not indicative of active compromise. A known malware signature on one host might indicate a local infection, but by itself it doesn’t prove the threat is propagating or affecting other systems. When everything aligns across multiple sources, that’s the strongest justification to declare an incident rather than treat it as a lone alert.