GSEC · Question #195
When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as.
The correct answer is B. False positive. In IDS terminology, a false positive occurs when the system generates an alarm despite no actual threat or anomaly being present.
Question
When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as.
Options
- AFalse negative
- BFalse positive
- CTrue positive
- DTrue negative
How the community answered
(58 responses)- A7% (4)
- B79% (46)
- C10% (6)
- D3% (2)
Why each option
In IDS terminology, a false positive occurs when the system generates an alarm despite no actual threat or anomaly being present.
A false negative is the opposite scenario - a real threat or anomaly is present, but the IDS fails to detect it and generates no alarm.
A false positive is defined as an incorrect alert fired by the IDS when the traffic or behavior being analyzed is actually benign - the system incorrectly classifies normal activity as malicious, wasting analyst time and eroding trust in the detection system.
A true positive means an anomaly is genuinely present and the IDS correctly fires an alarm, which is the desired detection outcome.
A true negative means no anomaly is present and the IDS correctly generates no alarm, representing accurate normal-traffic classification.
Concept tested: IDS detection accuracy - false positive classification
Source: https://csrc.nist.gov/glossary/term/false_positive
Topics
Community Discussion
No community discussion yet for this question.