nerdexam
Cisco

200-201 · Question #383

What is the impact of false negative alerts when compared to true negative alerts?

The correct answer is A. A false negative is someone trying to hack into the system and no alert is raised, and a true. A false negative occurs when a legitimate attack goes undetected without an alert, posing a significant security risk, whereas a true negative correctly identifies harmless activity as non-malicious and raises no alert.

Submitted by renata2k· Mar 6, 2026Security Monitoring

Question

What is the impact of false negative alerts when compared to true negative alerts?

Options

  • AA false negative is someone trying to hack into the system and no alert is raised, and a true
  • BA true negative is an alert for an exploit attempt when no attack was detected, and a false
  • CA true negative is a legitimate attack that triggers a brute force alert, and a false negative is when
  • DA false negative is an event that alerts for injection attack when no attack is happening, and a true

How the community answered

(29 responses)
  • A
    93% (27)
  • B
    3% (1)
  • C
    3% (1)

Why each option

A false negative occurs when a legitimate attack goes undetected without an alert, posing a significant security risk, whereas a true negative correctly identifies harmless activity as non-malicious and raises no alert.

AA false negative is someone trying to hack into the system and no alert is raised, and a trueCorrect

In cybersecurity, a false negative is a critical failure where an actual malicious event, like an attempted hack, occurs but the security system fails to detect it and raise an alert, leaving the organization vulnerable. Conversely, a true negative correctly identifies a legitimate, non-malicious event as safe and does not generate an alert, indicating the system is functioning as intended by not flagging benign activity.

BA true negative is an alert for an exploit attempt when no attack was detected, and a false

This statement incorrectly defines a true negative as an alert for an exploit when no attack was detected (which is a false positive) and then the rest of the sentence is cut off.

CA true negative is a legitimate attack that triggers a brute force alert, and a false negative is when

A true negative is an absence of an alert for legitimate, non-malicious activity, not an alert for a legitimate attack (which would be a true positive).

DA false negative is an event that alerts for injection attack when no attack is happening, and a true

A false negative is when an attack happens but no alert is raised, while this statement describes a false positive (alert for attack when none is happening).

Concept tested: False negative vs. true negative in security alerts

Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-threat-intelligence/terminology-glossary?view=o365-worldwide

Topics

#False negatives#True negatives#Alert analysis

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice