6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing alerts from a network intrusion detection system (NIDS) and notices that it is flagging a large number of connections to a well-known content delivery network (CDN) as malicious. The analyst verifies that the CDN is used by many legitimate websites. What is the most likely cause of these false positives?

   • AThe NIDS rule is flagging all connections to IP addresses that are also used by malicious actors.
   • BThe NIDS signatures are outdated and missing new attack patterns.
   • CThe CDN is actually malicious.
   • DThe analyst is misinterpreting the alerts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common cause of false positive alerts?

   • AA misconfigured rule that is too broad and matches normal traffic
   • BAn attacker using a known exploit that is not covered by detection rules
   • CAn attacker using encryption to hide malicious traffic
   • DA lack of updated threat intelligence
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is reviewing alerts from a web application firewall (WAF) and notices that it is flagging SQL injection attempts on a search box that only accepts numeric input. The analyst verifies that the traffic is legitimate. What is the most likely cause of these false positives?

   • AThe search box is actually vulnerable to SQL injection.
   • BThe WAF signature is outdated and missing new attack patterns.
   • CThe WAF rule is too broad and matches on patterns that resemble SQL injection.
   • DThe analyst is misreading the WAF logs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that the intrusion prevention system (IPS) is generating a high volume of alerts for a benign internal application that uses a non-standard port. The alerts are consuming significant time as the analyst manually verifies each one. What is the most effective first step to reduce the noise while maintaining visibility into real threats?

   • AIgnore the alerts and focus on other security tasks.
   • BCreate a rule that suppresses alerts for the specific application's traffic pattern.
   • CIncrease the alert threshold for all IPS rules.
   • DDisable the IPS rule that is generating the alerts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An attacker uses a technique that is not covered by any of the organization's detection rules. What is the most likely outcome?

   • AA false negative alert
   • BA false positive alert
   • CA true negative alert
   • DA true positive alert
   Reveal Solution Discussion Select an answer first