200-201 Question 249
Single answerA cybersecurity analyst is monitoring network traffic using a Security Information and Event Management (SIEM) system. The system flags a packet as malicious, but the analyst verifies that it is normal traffic from a trusted application. Which term best describes the outcome if the system had not flagged this benign traffic as malicious?
- A
True Positive
- B
False Positive
- C
True Negative
- D
False Negative
Show answer and explanation
Correct answer: C
Explanation
A True Negative occurs when a security system correctly identifies benign activity as non-malicious. In the given scenario, the packet was verified as normal traffic, and the question asks what term applies if the system had not flagged it as malicious, which aligns with the definition of a True Negative.
- A. Incorrect.
True Positive refers to a correct detection of malicious activity, which is not the case here since the traffic was benign.
- B. Incorrect.
False Positive occurs when benign activity is incorrectly flagged as malicious, but the scenario describes what happens if this incorrect flagging did not occur.
- C. Correct.
True Negative correctly identifies benign activity as non-malicious, which matches the described scenario where the system did not flag normal traffic as malicious.
- D. Incorrect.
False Negative occurs when malicious activity is incorrectly identified as benign, which is not relevant to the described situation.