4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst reviews an alert that triggered on a workstation because a user downloaded a legitimate PDF from a trusted vendor website. The file was scanned by the endpoint protection and found clean. The analyst confirms the activity is normal business use. How should the analyst classify this alert?

   • AFalse negative
   • BFalse positive
   • CTrue positive
   • DTrue negative
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which alert type has a negative impact on security posture because it allows malicious activity to go undetected?

   • AFalse positive
   • BTrue negative
   • CTrue positive
   • DFalse negative
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst reviews an alert triggered by a user downloading a large file from a public file-sharing site. The user's activity is part of an approved marketing campaign, and the file is a legitimate promotional video. The alert fired because the site's domain is on a threat intelligence list. How should the analyst classify this alert?

   • ATrue negative, because no malicious activity occurred
   • BFalse negative, because the alert should have detected a real threat
   • CFalse positive, because the activity is benign but was flagged as malicious
   • DTrue positive, because the alert matched a threat intelligence indicator
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A user routinely accesses a file-sharing website to upload large project files. This activity generates a high volume of network traffic that the intrusion detection system flags as suspicious. Investigation confirms the traffic is legitimate business use. What is the primary impact of this activity on the security operations center?

   • AIt causes a security breach because the traffic is flagged as suspicious
   • BIt improves the security posture by testing the intrusion detection system
   • CIt has no direct security impact but may reduce monitoring efficiency
   • DIt indicates a false negative because the activity is normal
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security operations center receives hundreds of alerts each day, but after investigation, most are caused by legitimate administrative tools that resemble malware behavior. Analysts are becoming desensitized and sometimes ignore alerts. What is the primary operational impact of this situation?

   • AReduced need for security monitoring
   • BImproved detection accuracy over time
   • CAlert fatigue, which can cause analysts to miss genuine threats
   • DIncreased network bandwidth consumption
   Reveal Solution Discussion Select an answer first