200-201 Question 250
Single answerYou are a Security Analyst in a SOC. During routine analysis, the Intrusion Detection System (IDS) flags network traffic from a known and trusted internal server communicating with an external database over an approved port. Upon further inspection, you confirm that the traffic is legitimate and poses no risk. Which term best describes this scenario?
- A
True Positive
- B
False Positive
- C
True Negative
- D
False Negative
Show answer and explanation
Correct answer: C
Explanation
In cybersecurity, a True Negative refers to a scenario where legitimate activity is correctly identified as non-malicious. Although the IDS flagged the traffic initially, the analyst's confirmation of the traffic as legitimate aligns with the definition of a True Negative, as there was no actual threat.
- A. Incorrect.
A True Positive occurs when a security alert correctly identifies malicious activity. In this scenario, the flagged traffic is legitimate, not malicious, so this option is incorrect.
- B. Incorrect.
A False Positive occurs when a system incorrectly labels legitimate activity as malicious. However, in this case, the traffic was flagged but later confirmed as legitimate, which does not align with the definition of a True Negative.
- C. Correct.
A True Negative occurs when a system correctly identifies legitimate traffic as non-malicious. In this scenario, the IDS flagged the traffic incorrectly, but the analyst confirmed it was legitimate, making this the correct term for describing the confirmed state of the traffic.
- D. Incorrect.
A False Negative occurs when a system fails to detect malicious activity. Since this scenario involves legitimate traffic incorrectly flagged, this is not applicable.