4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A malware sample evaded the network intrusion detection system and infected a server. The intrusion detection system generated no alert during the infection. The malware later exfiltrated sensitive data. How should the analyst classify the intrusion detection system's behavior?

   • ATrue positive
   • BFalse positive
   • CTrue negative
   • DFalse negative
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why might a high volume of benign events be a concern for a security operations team?

   • AThey must be blocked to maintain security.
   • BThey can overwhelm monitoring systems and distract analysts from real threats.
   • CThey cause direct damage to systems and data.
   • DThey indicate that the network is compromised.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst discovers that an intrusion detection system has been missing a specific type of attack for months. The attack uses a technique that the intrusion detection system does not have a signature for. The analyst has identified the gap and must decide how to address it. The organization has a limited budget for security tools. Which action would be most effective?

   • AAccept the risk because the attack is rare
   • BIncrease the sensitivity of the intrusion detection system to catch the attack
   • CCreate custom signatures for the missing attack technique
   • DReplace the intrusion detection system with a new one that has more signatures
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a primary operational impact of a high volume of false positives on a security operations team?

   • AReduced need for security monitoring tools.
   • BImproved detection accuracy because more alerts are generated.
   • CAlert fatigue, where analysts become desensitized and may miss real threats.
   • DIncreased network bandwidth consumption due to alert traffic.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of benign activity?

   • AAn attacker attempting to brute-force a user's password.
   • BA user accessing a corporate web application during normal business hours.
   • CA user downloading a known malware sample from the internet.
   • DA user sending sensitive data to an external server without authorization.
   Reveal Solution Discussion Select an answer first