Splunk Observability Cloud Certified Metrics User — Question 61

An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines that the reason no alerts were generated is because the detection searches were configured to run against Windows data only and excluding any Linux data.
This is an example of what?

Answer options

• A. A True Positive.
• B. A True Negative.
• C. A False Negative.
• D. A False Positive.

Correct answer: C

Explanation

This scenario exemplifies a False Negative because the system failed to detect an actual incident due to misconfigured detection parameters. A True Positive would indicate correct identification of an attack, while a True Negative would suggest the absence of an attack, and a False Positive would mean an alert was incorrectly triggered for a non-incident.