Câu 31: 312-39V2: Certified SOC Analyst (CSA) v2

An attacker attempts to gain unauthorized access to a secure network by repeatedly guessing login credentials. The SIEM is configured to generate an alert after detecting 10 consecutive failed login attempts within a short timeframe. However, the attacker successfully logs in on the 9th attempt, just before the threshold is reached, bypassing the alert mechanism. Security teams only become aware of the incident after detecting suspicious activity post-login, highlighting a gap in the SIEM’s detection rules. What type of alert classification does this represent?

1. A. True Positive
2. B. False Positive
3. C. False Negative — đáp án hiện tại
4. D. True Negative