4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is evaluating two detection rules. Rule A generates many alerts, but most are false positives. Rule B generates few alerts, but it missed a known attack last week. Which rule poses the greater risk to the organization's security posture?

   • ARule B, because a false negative allows real attacks to go undetected
   • BBoth are equally risky because they both reduce efficiency
   • CNeither is risky because the team reviews all alerts
   • DRule A, because false positives waste analyst time
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is reviewing a series of events. Event 1: A user visits a known phishing site but does not enter any credentials. Event 2: An attacker successfully exfiltrates data via DNS tunneling, but no alert fires. Event 3: An alert fires on a user downloading a legitimate PDF from a trusted vendor. Which events have security impact?

   • AAll three events
   • BEvent 2 and Event 3
   • CEvent 1 and Event 2
   • DEvent 2 only
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center analyst reviews the past 24 hours of alerts. The intrusion detection system did not generate any alerts, and a review of network logs confirms no malicious activity occurred during that period. How should the analyst classify the intrusion detection system's behavior?

   • AFalse negative
   • BFalse positive
   • CTrue positive
   • DTrue negative
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which scenario represents a false negative?

   • AAn IDS alerts on a known malware signature, and the file is confirmed as malware.
   • BAn IDS does not alert on normal network traffic.
   • CAn IDS alerts on a legitimate application that behaves like malware.
   • DA malware infection goes undetected because the IDS does not have a signature for it.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center manager is evaluating the impact of two types of monitoring errors: false positives and false negatives. Which statement accurately compares their impact?

   • ANeither has significant impact if the monitoring system is properly tuned
   • BBoth have equal impact because they both reduce analyst efficiency
   • CFalse negatives have a greater security impact because they allow breaches to go undetected
   • DFalse positives have a greater security impact because they waste resources
   Reveal Solution Discussion Select an answer first