An IDS alert shows a random user has administrative privileges, some files are missing, and other files appear. Which alert type is this?

An IDS alert shows a random user has administrative privileges, some files are missing, and other files appear. Which alert type is this?

• A. False positive
• B. False negative
• C. Audit alert
• D. True positive

Answer: (D)

Interpreting IDS outcomes: when the alert matches real compromise, it’s a true positive. In this scenario, a random user suddenly has administrative privileges and files are missing or appearing, which are classic signs of a real intrusion and privilege escalation. The IDS correctly flags this activity, so the alert is a true positive. A false positive would be the system alerting on benign activity as malicious, a false negative would miss an actual intrusion, and an audit alert isn’t the typical label for a live security breach.

Interpreting IDS outcomes: when the alert matches real compromise, it’s a true positive. In this scenario, a random user suddenly has administrative privileges and files are missing or appearing, which are classic signs of a real intrusion and privilege escalation. The IDS correctly flags this activity, so the alert is a true positive. A false positive would be the system alerting on benign activity as malicious, a false negative would miss an actual intrusion, and an audit alert isn’t the typical label for a live security breach.