200-201 Network Intrusion Analysis Practice Question
A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:
⚠ Common exam trap
The 200-201 exam often tests the distinction between false positive and true positive — the trap is confusing 'an alert fired' with 'the alert was correct,' leading candidates to pick true positive when the activity is confirmed benign.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
False positive
A false positive is an alert that fires for benign activity — the detection correctly identified a signature match, but the file was confirmed benign, so the alert is a false positive. In this scenario, the malware signature matched an outbound file transfer, but investigation confirmed the file is legitimate software, making it a false positive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
False positive
Why this is correct
A false positive occurs when detection logic flags activity that is actually benign, so a confirmed benign file triggering a known-malware signature matches this classification. The alert fired correctly per the signature, but the underlying file is harmless, distinguishing it from a true positive.
- ✗
True positive
Why it's wrong here
A true positive requires the alert to correctly identify actual malicious activity; the file is confirmed benign, so the alert was wrong. It is tempting because a signature did match and an alert did fire, but correctness of the verdict is what true positive demands.
- ✗
False negative
Why it's wrong here
A false negative means malicious activity occurred but no alert fired; here an alert did fire on a benign file, which is a false positive. It is tempting because the benign verdict feels like a detection failure, but the alert's existence rules this out.
- ✗
True negative
Why it's wrong here
A true negative means no alert fired and no malicious activity existed; here an alert did fire, so the benign verdict makes it a false positive. It is tempting because the file genuinely is benign, which matches the 'negative' half, but the alert's presence contradicts it.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.