6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which scenario is most likely to result in a false positive alert?

   • AA new malware variant that is not yet in the signature database
   • BA user accessing a known malicious IP address
   • CAn attacker using a polymorphic virus that changes its signature
   • DAn administrator running a network scan that matches an intrusion detection signature
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is evaluating two detection solutions. Solution A has a very low false positive rate but is known to miss some sophisticated attacks. Solution B has a higher false positive rate but catches more attacks. The organization has a small security team and limited resources. Which solution is more appropriate, and why?

   • ASolution A, because false negatives are less dangerous than false positives.
   • BSolution B, because the team can simply ignore false positives.
   • CSolution A, because fewer false positives reduce alert fatigue and allow the team to focus on real threats.
   • DSolution B, because catching more attacks is always better regardless of false positives.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) is experiencing a high rate of false positive alerts from a newly deployed detection rule. Analysts are spending most of their shift investigating these alerts, leaving little time for other tasks. What is the most likely long-term consequence if this issue is not addressed?

   • AThe security team will have more time to focus on threat hunting.
   • BThe false positives will eventually stop on their own.
   • CAnalysts will become desensitized and may miss genuine security incidents.
   • DThe detection rule will automatically adjust its threshold over time.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is tuning an intrusion detection system (IDS) for a high-security environment. They must decide whether to prioritize reducing false positives or false negatives. The team has a dedicated 24/7 SOC with ample staffing. Which approach is more appropriate, and why?

   • APrioritize both equally, because false positives and false negatives have the same impact.
   • BDisable all detection rules to avoid any alerts.
   • CPrioritize reducing false positives, because alert fatigue is always the biggest risk.
   • DPrioritize reducing false negatives, because missing a real attack is more damaging than investigating extra alerts.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC supervisor notices that analysts are beginning to ignore alerts from a specific detection rule because it frequently generates false positives. The supervisor is concerned that a real security incident might be missed. What is the best course of action to address this situation?

   • AInvestigate the root cause of the false positives and tune the rule accordingly.
   • BIncrease the severity of the alerts to force analysts to pay attention.
   • CAssign a dedicated analyst to manually review all alerts from that rule.
   • DDisable the rule to stop the false positives.
   Reveal Solution Discussion Select an answer first