6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC manager is reviewing the team's alert handling process and notices that analysts are spending an average of 30 minutes on each alert, most of which are false positives. The manager wants to improve efficiency. What is the most effective strategy?

   • AImplement a triage process that categorizes alerts based on severity and known false positive patterns.
   • BIncrease the number of analysts on the team.
   • CDisable all alerts that have a high false positive rate.
   • DRequire analysts to document every false positive in detail.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the trade-off between false positives and false negatives in security monitoring?

   • AReducing false positives always increases false negatives, and vice versa
   • BFalse positives are more important to eliminate than false negatives
   • CFalse positives and false negatives are unrelated and can be optimized independently
   • DFalse negatives are more important to eliminate than false positives
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security analyst receives an alert that flags a user's download of a legitimate software installer as malware. Which term best describes this alert?

   • ATrue negative
   • BTrue positive
   • CFalse positive
   • DFalse negative
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement accurately defines a false positive alert?

   • AAn alert that fails to fire when actual malicious activity is present
   • BAn alert that fires when no actual malicious activity is present
   • CAn alert that correctly identifies benign activity
   • DAn alert that correctly identifies malicious activity
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which scenario illustrates the impact of a false negative?

   • AAn analyst spends hours investigating a false alarm
   • BA security tool correctly identifies and blocks a known malware
   • CA legitimate user is locked out due to too many failed login attempts
   • DA security team misses a critical vulnerability exploitation because no alert was generated
   Reveal Solution Discussion Select an answer first