A security analyst reviews the firewall and observes the large number of frequent events. The analyst starts the packet capture with the Wireshark and identifies that TCP port reuse was detected…

The correct answer is A. false positive. A false positive occurs when a security system incorrectly detects benign activity as a threat. In this case, the firewall incorrectly classified TCP port reuse as a TCP split-handshake attack, even though it was not a real threat. This misclassification led to unnecessary…

Submitted by rachelw· Mar 6, 2026Security Monitoring

Question

A security analyst reviews the firewall and observes the large number of frequent events. The analyst starts the packet capture with the Wireshark and identifies that TCP port reuse was detected incorrectly as a TCP split-handshake attack by the firewall. How must an impact from this event be categorized?

Options

Afalse positive
Btrue positive
Ctrue negative
Dfalse negative

How the community answered

(48 responses)

A
73% (35)
B
15% (7)
C
4% (2)
D
8% (4)

Explanation

A false positive occurs when a security system incorrectly detects benign activity as a threat. In this case, the firewall incorrectly classified TCP port reuse as a TCP split-handshake attack, even though it was not a real threat. This misclassification led to unnecessary alerts, requiring manual investigation by the security analyst. - A true positive would mean an actual attack was correctly detected. - A true negative would mean no attack occurred, and no alert was triggered. - A false negative would mean an attack occurred but was not detected.

Topics

#false positive#security monitoring#incident response#firewall logs

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice