200-201 Question 243
Single answerYou are a Security Analyst reviewing alerts in your organization's Security Information and Event Management (SIEM) system. You notice an alert for 'unauthorized access' triggered by an employee attempting to access a file server. Upon investigation, you confirm that the employee has the appropriate permissions and was performing a legitimate task. What does this scenario best represent?
- A
A false positive alert
- B
A false negative alert
- C
A legitimate security threat
- D
A misconfigured SIEM rule
Show answer and explanation
Correct answer: A
Explanation
This scenario illustrates a false positive, where the system incorrectly flags legitimate activity as a security threat. False positives can consume valuable time for security teams, and understanding them is critical for optimizing security operations and reducing alert fatigue.
- A. Correct.
This is the correct answer. A false positive occurs when a security system generates an alert for benign activity, such as legitimate access that is incorrectly flagged as unauthorized.
- B. Incorrect.
This is incorrect. A false negative occurs when a legitimate threat is not detected by the system, which is not the case here since the system triggered an alert.
- C. Incorrect.
This is incorrect. A legitimate security threat would involve actual unauthorized access or malicious activity, which is not present in this scenario.
- D. Incorrect.
This is incorrect. While misconfigured SIEM rules can lead to false positives, the scenario provided does not explicitly confirm a misconfiguration, and the focus of the question is on identifying the type of alert.