4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network monitoring system is configured to detect known malware signatures. Over the past week, it has not generated any alerts. A review of logs confirms that no malware signatures were present in the traffic during that period. How should the security team classify this outcome?

   • AFalse negative, because the system should have detected something
   • BFalse positive, because the system was too quiet
   • CTrue positive, because the system is working correctly
   • DTrue negative, because no malicious activity occurred and no alert was generated
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center has a mature monitoring system that generates accurate alerts. Analysts have high confidence in the alerts because true positives are consistently confirmed and true negatives are common. What is the primary benefit of this situation?

   • AThe organization can ignore all alerts and focus on other tasks
   • BThe security operations center can reduce its staffing
   • CThe monitoring system is trusted, enabling effective response
   • DThe organization will never experience a security breach
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the most significant security impact of a false negative?

   • AAnalysts waste time investigating benign alerts.
   • BThe organization becomes overly reliant on automated detection.
   • CMalicious activity goes undetected, potentially leading to a breach and data loss.
   • DThe monitoring system generates too many alerts.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is deciding how to allocate its security budget. The SOC manager proposes investing in a new threat-hunting team to find attacks that evade current detection. The CISO instead wants to invest in tuning existing detection rules to reduce false positives. Both agree that the current alert volume is unsustainable. Which investment is more likely to address the root cause of the problem?

   • ARule tuning, because reducing false positives directly reduces alert volume and alert fatigue
   • BNeither, because the problem is a lack of analyst training
   • CBoth are equally effective because they both reduce alert volume
   • DThreat hunting, because it finds attacks that evade detection, which is the root cause of false negatives
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team discovers that an attacker used a legitimate remote administration tool to move laterally across the network for three weeks. The tool is commonly used by IT staff, and the detection rules were configured to ignore it to reduce false positives. The attacker's activity was never alerted. What is the most significant lesson from this incident?

   • AFalse positives are more dangerous than false negatives
   • BTuning rules to reduce false positives can create dangerous false negatives
   • CThe detection rules were too aggressive
   • DRemote administration tools are always malicious
   Reveal Solution Discussion Select an answer first