4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's intrusion detection system did not generate any alerts during a period when an attacker exfiltrated customer data via encrypted HTTPS traffic. The IDS was not configured to inspect encrypted traffic. Which classification best describes the outcome?

   • ATrue positive, because the attack was real
   • BFalse negative, because the IDS failed to alert on actual malicious activity
   • CFalse positive, because the IDS missed the attack
   • DTrue negative, because no alert was generated
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a consequence of frequent false positives in a SOC?

   • AWasted resources spent investigating non-threats.
   • BDecreased need for tuning detection rules.
   • CImproved response times because analysts are more alert.
   • DIncreased confidence in the monitoring system.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst receives an alert that a workstation is communicating with a known command-and-control server. The analyst investigates and confirms that the workstation is infected with malware and is actively receiving instructions. How should the analyst classify this alert?

   • AFalse positive, because the alert caused unnecessary investigation
   • BTrue negative, because the analyst confirmed the activity
   • CFalse negative, because the malware was already present
   • DTrue positive, because the alert correctly identified malicious activity
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security operations center is experiencing a high rate of false positives from a new intrusion detection system. Analysts are spending most of their time investigating benign alerts, and there is concern that real alerts are being ignored. The team has limited resources and cannot add more analysts. Which approach would best address the situation?

   • AIgnore all alerts for a week to see which ones are false positives
   • BIncrease the sensitivity of the intrusion detection system to catch more threats
   • CTune the intrusion detection system to reduce false positives while maintaining detection of known threats
   • DDisable the intrusion detection system until the false positive rate is acceptable
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How does a true negative contribute to the effectiveness of a security monitoring program?

   • AIt builds trust in the monitoring system because benign activity does not trigger unnecessary alerts.
   • BIt allows the security team to ignore all alerts.
   • CIt increases the number of alerts that need to be investigated.
   • DIt directly prevents malicious activity from occurring.
   Reveal Solution Discussion Select an answer first