An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM - 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be…

Question

Options

• AA True Negative.
• BA True Positive.
• CA False Negative.
• DA False Positive.

• A
  80% (24)
• B
  3% (1)
• C
  10% (3)
• D
  7% (2)

Explanation

Option A is correct because a True Negative means a condition was absent and the system correctly produced no alert. Since the IDS signature is known to be correct and no alerts fired, the most logical interpretation is that no logins occurred during the 6 PM–6 AM window - the system accurately stayed silent when there was nothing to detect.

Why the distractors are wrong:

• B (True Positive) requires both a real event and an alert - but there were no alerts here.
• C (False Negative) would apply if logins did occur but the IDS missed them; that contradicts the premise that the signature is correct and functioning.
• D (False Positive) means an alert fired when no real event occurred - again, no alert happened here.

Memory tip: Think of the two words separately - True/False = was the system right or wrong? Positive/Negative = did it alert or not? A True Negative is "correctly quiet": nothing happened, nothing was reported. If the system is right and silent, it's always a True Negative.

No community discussion yet for this question.