(ISC)2 Certified in Cybersecurity Practice Exam

What type of error occurs when an intrusion detection system erroneously signals an alert without actual intrusion?

1. True positive

2. False negative

3. True negative

4. False positive

The correct answer is: False positive

The situation described pertains to a false positive, which occurs when an intrusion detection system (IDS) mistakenly identifies normal behavior as malicious activity, triggering an alert despite there being no actual intrusion. In cybersecurity, this can lead to unnecessary investigations and can distract from genuine security threats. In this context, a false positive is significant because it reflects the system's inability to accurately distinguish between benign and malicious traffic or behavior. A reliable IDS should minimize these occurrences to ensure that security teams can focus on true threats and not be overwhelmed by erroneous alerts. Since the other options represent different scenarios—where true positives identify actual intrusions correctly, false negatives indicate missed intrusions, and true negatives confirm normal behavior without alerts—they help to contrast the concept of false positives and further illustrate the importance of precision in intrusion detection.