2.7 Evaluate False Positive, False Negative, and True Positive Security Cases SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst investigates an alert triggered by a user's workstation beaconing to a known malware command-and-control domain. The analyst reviews the endpoint logs and confirms the domain was contacted, but the traffic was generated by a vulnerability scanner that was mistakenly configured with the user's proxy credentials. How should the analyst classify this security case?

   • ATrue negative — the alert correctly identified that no malicious activity occurred.
   • BFalse negative — the alert should have identified the scanner as the source but did not.
   • CFalse positive — the alert fired, but the activity was benign and caused by a misconfigured scanner.
   • DTrue positive — the alert correctly identified malicious command-and-control traffic.
   Reveal Solution Discussion Select an answer first
2. 7foundation · medium

   A security operations center receives an alert from an endpoint detection and response (EDR) tool. The alert indicates that a workstation executed a PowerShell command that downloaded a file from an external IP address and then ran it. The analyst investigates and finds the file is a known remote access trojan (RAT) that is not present in the local threat intelligence feed but is confirmed malicious by an external sandbox analysis. The workstation's user had no reason to download this file. Which classification best describes this security case?

   • ATrue negative, because the external sandbox confirmed the file was malicious.
   • BTrue positive, because the activity was confirmed malicious and the alert correctly identified it.
   • CFalse positive, because the file was not in the local threat intelligence feed.
   • DFalse negative, because the EDR initially missed the file's malicious nature.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is reviewing a case where a user's machine was compromised by a drive-by download from a compromised website. The web filter did not generate an alert for the website because it was categorized as 'business' and had a high reputation score. The analyst confirms the website was compromised and served malicious JavaScript. How should the analyst classify this case?

   • ATrue positive — the web filter correctly identified the compromised website.
   • BFalse negative — the web filter failed to detect the compromised website.
   • CFalse positive — the web filter incorrectly alerted on the compromised website.
   • DTrue negative — the web filter correctly did not alert on the compromised website.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst investigates an alert that triggered on a user executing a PowerShell command that matched a known obfuscation technique. The analyst reviews the command line and sees it decodes a base64 string that downloads and executes a payload from a suspicious domain. Further analysis confirms the payload is a known remote access trojan (RAT). How should the analyst classify this case?

   • AFalse negative — the alert fired but missed the actual payload.
   • BTrue positive — the alert correctly identified actual malicious activity.
   • CFalse positive — the alert fired on a legitimate administrative script.
   • DTrue negative — the alert correctly identified that no malicious activity occurred.
   Reveal Solution Discussion Select an answer first
6. 10foundation · medium

   A security operations analyst is reviewing a case generated by an intrusion detection system. The alert fired on network traffic that matches a known exploit signature, but after investigation, the analyst determines the traffic was a benign penetration test conducted by the organization's own security team. Which security case classification best describes this alert?

   • AFalse positive, because the alert was triggered but the activity was not malicious.
   • BTrue positive, because the traffic matched a known exploit signature.
   • CTrue negative, because the system correctly did not alert on authorized activity.
   • DFalse negative, because the detection system failed to identify the penetration test as authorized.
   Reveal Solution Discussion Select an answer first