4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst investigates an alert that triggered when a user executed a known ransomware binary downloaded from a malicious URL. The analyst confirms the file hash matches a known ransomware signature and the user's files were encrypted. How should the analyst classify this alert?

   • AFalse negative
   • BTrue negative
   • CFalse positive
   • DTrue positive
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst notices that a large number of alerts are triggered by routine software updates that are pushed to workstations every night. The updates are legitimate and expected. What is the primary concern regarding these benign events?

   • AThey improve detection accuracy
   • BThey indicate a security compromise
   • CThey cause data loss
   • DThey reduce monitoring efficiency by consuming analyst time and resources
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary benefit of a true positive in a security monitoring system?

   • AIt enables the security team to respond to actual threats promptly.
   • BIt ensures that no malicious activity occurs on the network.
   • CIt eliminates the need for manual analysis of alerts.
   • DIt reduces the number of alerts generated by the system.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which outcome is a direct result of a false negative in a security monitoring system?

   • AThe security team gains confidence in the monitoring system.
   • BThe monitoring system generates an alert for a benign event.
   • CThe security team spends time investigating a non-threat.
   • DAn attacker remains undetected and continues to exfiltrate sensitive data.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations center team notices that analysts are ignoring a large number of alerts because many are false positives. Which operational impact is most directly associated with this situation?

   • AAlert fatigue and wasted resources
   • BIncreased security posture because analysts are more selective
   • CImproved detection accuracy because false positives are filtered out
   • DReduced false negatives because analysts focus on fewer alerts
   Reveal Solution Discussion Select an answer first