200-201 Question 248
Single answerYou are a SOC analyst monitoring a network for potential threats. During an investigation, an intrusion detection system (IDS) raises an alert for malicious activity involving a known malware signature. Upon further analysis, you confirm that this alert corresponds to an actual malware infection in the network. How would you categorize this alert?
- A
True positive
- B
False positive
- C
True negative
- D
False negative
Show answer and explanation
Correct answer: A
Explanation
In this scenario, the alert raised by the IDS correctly identified a real malware infection in the network. This is an example of a 'true positive,' where the detection system accurately flags a threat. Understanding true positives is essential for SOC analysts to assess the accuracy and reliability of their detection systems.
- A. Correct.
A 'true positive' occurs when an alert is raised, and the detected activity is confirmed to be a real threat. In this case, the alert correctly identified a malware infection.
- B. Incorrect.
A 'false positive' occurs when an alert is raised, but the activity is not a real threat. This is not the case here because the detected malware was confirmed as real.
- C. Incorrect.
A 'true negative' occurs when no alert is raised, and no malicious activity is present. This is not applicable since an alert was raised and confirmed as accurate.
- D. Incorrect.
A 'false negative' occurs when no alert is raised, but malicious activity is present. This does not apply because the alert was raised and confirmed.