An IDS alert indicates an actual intrusion involving privilege escalation and file changes. What is this alert considered?

An IDS alert indicates an actual intrusion involving privilege escalation and file changes. What is this alert considered?

• A. False positive
• B. False negative
• C. True negative
• D. True positive

Answer: (D)

An IDS alert that matches a real security incident is a true positive. Here, there is an actual intrusion and signs like privilege escalation and file changes, so the alert correctly indicates malicious activity rather than a mistaken signal. A true positive means the system did its job by detecting a real threat and generating an alert for responders to investigate. For context, false positives are alerts when nothing harmful occurred, false negatives are missed detections when an intrusion happened, and true negatives are no intrusion with no alert. The scenario described clearly fits the real-threat detection case, supported by indicators such as privilege escalation and file modifications, which are typical signs of compromise.

An IDS alert that matches a real security incident is a true positive. Here, there is an actual intrusion and signs like privilege escalation and file changes, so the alert correctly indicates malicious activity rather than a mistaken signal. A true positive means the system did its job by detecting a real threat and generating an alert for responders to investigate.

For context, false positives are alerts when nothing harmful occurred, false negatives are missed detections when an intrusion happened, and true negatives are no intrusion with no alert. The scenario described clearly fits the real-threat detection case, supported by indicators such as privilege escalation and file modifications, which are typical signs of compromise.