(ISC)2 Certified in Cybersecurity Practice Exam

What kind of error indicates an intrusion detection system correctly identifies intrusions?

1. False positive

2. True negative

3. True positive

4. False negative

The correct answer is: True positive

When discussing the effectiveness of an intrusion detection system (IDS), it's important to understand the terms used to describe the outcomes of its alerts. A true positive indicates that the IDS has correctly identified an intrusion that was indeed occurring. This means the system was successful in detecting malicious activity as it happened, which is crucial for immediate response and mitigation. In cybersecurity, true positives are vital because they confirm the system's ability to protect the network by timely identifying and reporting threats. This capability allows security teams to respond swiftly to actual incidents, minimizing potential harm to the organization's digital assets. On the other hand, while false positives occur when the system incorrectly flags benign activity as an intrusion, true negatives signify that non-intrusive behaviors are correctly identified as not posing a threat. False negatives represent a failure of the system to detect an actual intrusion when one is present, which can leave the environment vulnerable to attacks. Thus, true positives are a critical measure of the effectiveness of an IDS, validating its role in enhancing security.