6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a primary impact of a high volume of false positive alerts on a security operations team?

   • AImproved detection of real threats
   • BImmediate containment of malware infections
   • CReduced need for security monitoring
   • DAlert fatigue, causing analysts to overlook real threats
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A security team is reviewing its detection capabilities and finds that the current intrusion detection system (IDS) does not monitor traffic on the company's virtual private network (VPN) connections. An attacker exploited this gap and accessed sensitive data without triggering any alerts. What type of alert issue does this represent?

   • AFalse negative alert
   • BTrue negative alert
   • CTrue positive alert
   • DFalse positive alert
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst notices that a detection rule is generating alerts for a legitimate software update process that downloads files from a known vendor domain. The rule was originally designed to detect malware downloads from suspicious domains. What is the most likely cause of these false positives?

   • AThe rule's signature is outdated and no longer matches current malware.
   • BThe software update process is actually malicious.
   • CThe rule is misconfigured to flag all downloads from external domains.
   • DThe analyst is misinterpreting the alerts.
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A security team discovers that a data breach occurred three months ago, but the intrusion detection system (IDS) never alerted. The attacker used a known exploit that the IDS signature database did not cover. Which type of alert issue does this represent?

   • AFalse positive alert
   • BTrue negative alert
   • CTrue positive alert
   • DFalse negative alert
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security administrator is configuring a new detection rule for a critical server. The rule is intended to detect a specific attack pattern, but the administrator is concerned about generating too many false positives. The administrator has two options: (1) set a high threshold that only triggers on multiple occurrences, or (2) set a low threshold that triggers on a single occurrence. Which approach best balances the trade-off between false positives and false negatives?

   • ASet a low threshold to catch all attacks, accepting that many false positives will be generated.
   • BSet a moderate threshold and regularly review and tune the rule based on real-world traffic.
   • CSet the threshold to zero to disable the rule and avoid any alerts.
   • DSet a high threshold to minimize false positives, accepting that some attacks may be missed.
   Reveal Solution Discussion Select an answer first