CS0-003 Question 140

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  True negative would mean there was no attack at all, but the stem explicitly says "an attack"....so C is correct. The threshold being set to 10 is the cause of the false negative, not a reason to reclassify it. Poorly worded question though. :D

• Chose B1

  The alert logic worked as intended, so by absolute definition it must be a true negative. A false positive is when the rule misfires on its logic. A false negative would be the rule not firing at all with 10 failed logins. And obviously it cannot be a true positive. It can only be B) a true negative.

• Chose C1

  A false negative occurs when malicious activity happens but the security control fails to detect or alert on it.