2.7 Evaluate False Positive, False Negative, and True Positive Security Cases SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–13

1. 11foundation · easy

   A security analyst receives an alert for a user logging in from an unusual geographic location. Investigation reveals the user is on a business trip and the login is legitimate. How should this security case be classified?

   • AInconclusive
   • BFalse positive
   • CFalse negative
   • DTrue positive
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is reviewing an alert that fired when a user accessed a website categorized as 'hacking' by the web filter. The user explains they are a penetration tester who was performing an authorized assessment of an internal application and needed to access a public exploit database. The analyst confirms the user's role and the authorized assessment scope. How should the analyst classify this case?

   • ATrue negative — the alert correctly identified that no malicious activity occurred.
   • BFalse positive — the alert fired on authorized, legitimate activity.
   • CFalse negative — the alert missed the authorized penetration testing activity.
   • DTrue positive — the alert correctly identified unauthorized hacking activity.
   Reveal Solution Discussion Select an answer first
3. 13foundation · easy

   What is a typical consequence of a false negative security case?

   • AThe security tool is tuned to reduce alerts, but this increases the risk of missing future threats.
   • BThe security team is alerted to malicious activity and can respond quickly.
   • CMalicious activity goes undetected, potentially allowing the threat to persist and cause damage.
   • DThe security team spends time investigating an alert that turns out to be benign.
   Reveal Solution Discussion Select an answer first