An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines…

Question

Options

• AA True Positive.
• BA True Negative.
• CA False Negative.
• DA False Positive.

• A
  10% (4)
• B
  3% (1)
• C
  83% (33)
• D
  5% (2)

Explanation

C is correct because a False Negative occurs when a real malicious event takes place but the detection system fails to generate an alert - the attacker successfully executed a brute-force attack, yet no alert fired because the Linux systems were excluded from the detection scope. The system essentially said "nothing happened" when something very much did.

Why the distractors are wrong:

• A (True Positive): Requires both a real attack and a triggered alert - there was a real attack, but no alert was generated, so it cannot be a True Positive.
• B (True Negative): Means no attack occurred and no alert fired - there was a real attack here, so "True" doesn't apply.
• D (False Positive): Means an alert fires when no real threat exists - the opposite problem; here the threat was real and the alert was absent.

Memory tip: Match the two parts - False = the outcome was wrong, Negative = the system said "no threat." A False Negative is when the system is wrongly quiet about a real threat. Think: "the bad thing happened, but the alarm didn't go off" - like a smoke detector with dead batteries.

No community discussion yet for this question.