200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  False negative

  Why it's wrong here

  A false negative means malicious activity occurred but the IDS failed to alert; here the signature did fire on the XSS payload, so detection happened. It is tempting because the payload looks like a textbook attack, yet the question asks how to classify the alert that was generated, not whether other attacks were missed.

• ✗

  False positive

  Why it's wrong here

  The signature correctly matched genuine XSS payload characters in the URI, so the alert reflects real malicious input rather than benign traffic triggering a loose pattern. Calling it a false positive is tempting when a signature is keyword-based and noisy, and would be right had the parameters contained harmless text such as a documentation example.

• ✗

  True negative

  Why it's wrong here

  A true negative means the IDS stayed silent on benign traffic; here the IDS raised an alert on actual XSS content, so no negative classification applies. It is tempting because the payload was blocked or harmless in effect, but detection classification concerns whether the alert matched reality, not whether exploitation succeeded.

• ✓

  True positive

  Why this is correct

  The signature correctly matched genuine XSS payload characters in the URI, and inspection confirms an actual attack attempt rather than benign traffic. A true positive means the IDS alerted on real malicious activity, satisfying the stem's requirement for accurate classification of the confirmed script injection.