6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is it important to tune detection systems to balance false positives and false negatives?

   • ATo minimize the risk of missing real threats while avoiding excessive false alarms
   • BTo increase the number of alerts generated
   • CTo ensure that no false positives ever occur
   • DTo eliminate all alerts and reduce noise
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address. Upon investigation, the analyst determines that the IP address is actually a legitimate cloud service used by the company. What type of alert is this?

   • AFalse positive alert
   • BTrue negative alert
   • CFalse negative alert
   • DTrue positive alert
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is considering whether to deploy a new detection tool that uses behavioral analysis to identify anomalies. The tool is known to generate a moderate number of false positives but can detect previously unknown threats. The team is concerned about the impact on their limited staff. What is the most important factor to consider when deciding whether to deploy this tool?

   • AThe vendor's reputation in the security industry.
   • BThe team's ability to manage and investigate the expected volume of false positives.
   • CThe tool's ability to integrate with existing security infrastructure.
   • DThe cost of the tool compared to other security investments.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating an alert that flagged a user's attempt to access a file share as a potential data exfiltration. The analyst determines that the user was legitimately accessing a shared project folder. What is the most likely cause of this false positive?

   • AThe analyst misread the alert details.
   • BThe detection rule was configured to flag any large file transfer, regardless of destination.
   • CThe file share contained sensitive data.
   • DThe user's account was compromised.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security team discovers that a malware infection has been present on a workstation for several weeks, but no alerts were generated. Which term best describes this situation?

   • AFalse negative
   • BTrue negative
   • CTrue positive
   • DFalse positive
   Reveal Solution Discussion Select an answer first