4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which security event would be classified as having 'impact'?

   • AA user logs in to a system from a new device, but the login is legitimate.
   • BAn IDS generates an alert for a port scan that is later determined to be from a vulnerability scanner.
   • CA user mistypes a URL and receives a 404 error.
   • DAn attacker successfully exfiltrates customer data from a database.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst discovers that an intrusion detection system missed a series of malicious commands executed on a server. The commands were part of a known attack pattern, but the intrusion detection system did not have a signature for it. The server was later used to launch attacks on other systems. What is the most significant security impact of this false negative?

   • AThe breach went undetected, allowing further compromise
   • BThe intrusion detection system will be more trusted by analysts
   • CThe analyst will have more time to investigate other alerts
   • DThe intrusion detection system will generate more false positives
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security tool is configured to detect only known malware signatures. An attacker uses a custom, previously unseen malware variant that evades detection. The malware runs for weeks, stealing credentials. What is the most significant security impact of this outcome?

   • AIncreased alert volume for analysts
   • BReduced need for endpoint protection
   • CUndetected breach and potential data loss
   • DImproved detection of future variants
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An attacker successfully exploited a vulnerability in a web application and stole a database of customer records. The security team discovers the breach during a routine audit, but the intrusion detection system never alerted. Which classification and impact best describe this event?

   • AFalse negative with security impact, because the breach went undetected and data was lost
   • BTrue negative with no impact, because the IDS was silent
   • CFalse positive with operational impact, because the IDS missed the attack
   • DTrue positive with security impact, because the breach was discovered
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A user routinely accesses a cloud-based HR portal to submit timesheets. This activity is expected and does not violate any policy. The security team reviews the logs and sees this traffic. How should the team classify this activity?

   • ATrue negative, because no alert was generated
   • BFalse positive, because the activity is normal
   • CImpact, because it consumes network resources
   • DBenign, because the activity is normal and non-malicious
   Reveal Solution Discussion Select an answer first