6.4 Explain the Concepts of False Positive Alerts and False Negative Alerts CYBERSECURITY-APPRENTICE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is deciding whether to invest in a new endpoint detection and response (EDR) solution. The current antivirus has a low false positive rate but has missed several recent attacks. The EDR solution is known to generate more false positives but can detect advanced threats. The company has a small security team. What is the most important trade-off to consider?

   • AThe cost of the EDR is the only factor that matters.
   • BThe current antivirus's low false positive rate is sufficient, so no change is needed.
   • CThe increased false positives from the EDR may overwhelm the small team, leading to alert fatigue.
   • DThe EDR's higher detection rate guarantees no future attacks will be missed.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a consequence of false positive alerts?

   • AWasted analyst time investigating benign activity
   • BUndetected data exfiltration
   • CImproved security posture
   • DIncreased confidence in the detection system
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common cause of false negative alerts?

   • AAn outdated signature database that does not include new malware
   • BA rule that is too broad and matches normal traffic
   • CBenign activity that resembles an attack
   • DA misconfigured rule that generates too many alerts
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a direct consequence of a false negative alert?

   • AWasted time investigating benign activity
   • BUndetected breach and potential data loss
   • CImproved security posture
   • DIncreased alert fatigue
   Reveal Solution Discussion Select an answer first
6. 30application · easy

   A security team discovers that a new malware variant is using a technique that the current antivirus software does not detect. The malware has been running on several machines for weeks without any alerts. What is the most likely cause of this false negative?

   • AThe malware is only active during certain hours.
   • BThe malware is not actually malicious.
   • CThe antivirus signatures are not updated to include the new malware variant.
   • DThe antivirus software is generating too many false positives.
   Reveal Solution Discussion Select an answer first