2.7 Evaluate False Positive, False Negative, and True Positive Security Cases SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is reviewing a case where a user's machine was compromised by a phishing email. The email gateway did not generate an alert for the email because the sender domain had a high reputation score. The analyst confirms the email contained a malicious attachment that executed and installed a backdoor. How should the analyst classify this case?

   • AFalse positive — the email gateway incorrectly alerted on the phishing email.
   • BTrue negative — the email gateway correctly did not alert on the phishing email.
   • CFalse negative — the email gateway failed to detect the malicious phishing email.
   • DTrue positive — the email gateway correctly identified the phishing email.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center (SOC) analyst reviews a case where an endpoint protection platform did not generate any alert for a process that later was confirmed to be a novel ransomware variant. The ransomware encrypted files on the host, and the analyst confirmed the sample was not in any threat intelligence feed at the time of execution. How should the analyst classify this security case?

   • ATrue positive — the endpoint protection platform correctly identified the ransomware.
   • BFalse positive — the endpoint protection platform incorrectly alerted on the ransomware.
   • CTrue negative — the endpoint protection platform correctly did not alert on the ransomware.
   • DFalse negative — the endpoint protection platform failed to detect the ransomware, which was actual malicious activity.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario best illustrates a false negative security case?

   • AA security tool fails to detect a new strain of ransomware that encrypts files on a host.
   • BA security tool generates an alert for a user accessing a malicious domain, but the user is a threat actor.
   • CA security tool generates an alert for a legitimate software installer that is later confirmed to be safe.
   • DA security tool generates an alert for a known malware sample that is later confirmed to be malicious.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing a case where a user's machine was infected with malware that was delivered via a USB drive. The endpoint protection platform did not generate any alert because the malware was a new, unknown variant. The analyst confirms the malware was present and executed on the machine. How should the analyst classify this case?

   • ATrue negative — the endpoint protection platform correctly did not alert on the malware.
   • BTrue positive — the endpoint protection platform correctly identified the malware.
   • CFalse negative — the endpoint protection platform failed to detect the unknown malware.
   • DFalse positive — the endpoint protection platform incorrectly alerted on the malware.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security analyst investigates an alert for a suspicious PowerShell command. The investigation reveals that the command was executed by a threat actor and resulted in data exfiltration. How should this security case be classified?

   • AFalse negative
   • BInconclusive
   • CTrue positive
   • DFalse positive
   Reveal Solution Discussion Select an answer first