Exam 200-201 topic 1 question 147 discussion

A false negative occurs when the security system (usually a WAF) fails to identify a threat. It produces a “negative” outcome (meaning that no threat has been observed), even though a threat exists. This is the opposite of a false positive alarm, where a system mistakenly identifies legitimate traffic as being hostile. I would answer - false negative

False Positive - Incorrectly classified as positive True Positive - Correctly classified as positive False Negative - Incorrectly classified as Negative True Negative - Correctly classified as Negative

True = Attack False = No Attack Positive = Alert Negative = No Alert Sooo the answer is A -> There's an attack, but no alert.

should be B

The answer is B. false negative.

False Positive - Incorrectly classified as positive True Positive - Correctly classified as positive False Negative - Incorrectly classified as Negative True Negative - Correctly classified as Negative In this case, the legitimate alert was "incorrectly classified as negative".

False Negative

The correct answer is C. false positive. When an analyst discovers that a legitimate security alert has been dismissed, it indicates a false positive. A false positive occurs when a security system or tool generates an alert or indicates a security incident that is not actually malicious or threatening. In this case, the dismissed alert was mistakenly considered as a non-threatening event, leading to the legitimate security alert being ignored or overlooked.

false negative =no alarm with a true attack.

A True Positive generated the Alert. The alert was dismissed

a false negative occurs when a system fails to identify a threat producing a negative outcome even though a threat exists... the system didn't fail to identify a threat. a false positive occurs when a system mistakenly identifies legitimate traffic as being hostile... the system didn't mistakenly identify legitimate traffic as being hostile, it's a legitimate security alert. a true negative security alert refers to a situation where an alert has not been generated when a specific activity has occured (i.e. a threat)... the system didn't fail to generate an alert. it was dismissed. a true positive security alert refers to a legitimate attack that triggers an alarm.. a legitimate alert was generated... and the only 'thing' (signature) that could cause this, would be a true positive. an analyst discovers that a LEGITIMATE security alert (true positive) has been dismissed... someone dismissed a legitimate alert... imo, A, B and C are incorrect. I'm going with D.

Put the question this way, there is a legit attack/threat but the system did not see it as a threat. Answer is B, false negative.

negative means: there is no alert. false negative means: the "no alert" is false > a legitimate security alert has been dismissed therefore the correct answer is B

The correct answer is B. A false negative occurs when a security alert is missed or dismissed, allowing malicious traffic to go unnoticed. In this case, the analyst discovered that a legitimate security alert was dismissed, indicating that a threat was present but was not detected by the system. Therefore, the impact on network traffic was a false negative.

I think it D: An analyst discovers that a legitimate security alert (True Positive) has been dismissed (whatever the reason, human fail for example)

I agree it's B

Real true then is the opposite negative. Not true is then negative! Answer is B False Negative.