A network administrator was testing an IPS device by releasing multiple packets into the network. The administrator examined the log and noticed that a group of alarms were generated by the IPS that identified normal user traffic. Which term describes this group of alarms?

a) true negative

b) true positive

c) false positive

d) false negative

c) false positive

Explanation:

An event signaling to produce an alarm when no attack has taken place. False positives are mislabeled security alerts, indicating there is a threat when in actuality, there isn't. By default, most security teams are conditioned to ignore false positives, In the event of a false positive an IPS will actively stop the normal activity which is likely to negatively impact business functions.

C. False positive.

Explanation:

Penetration testing or pen test is a mechanism used by organisation to test or check for vulnerabilities attackers could exploit in their private network. This process is vital for strengthen the security policies of an organisation's network.

There are several types of penetration testing that can be used, they are blind testing, black box testing, white box testing, internal and external testing etc. Several packets and protocols are tested to ensure a secure network. when a test is done, an alarm is given to notify the tester of the current status. The false positive alarm is seen when a normal user traffic is detected but gives off false negative when the case is reverse.