What is the effect of a false positive in an intrusion detection system?

• A. It triggers an alert when no threat exists
• B. It reduces the number of false positives
• C. It improves detection accuracy
• D. It eliminates incident response

Answer: (A)

A false positive is when the intrusion detection system raises an alert for activity that is actually safe. The effect is that an alert is triggered even though there is no real threat, which can waste time and resources as staff chase down harmless activity. This can lead to alert fatigue, where important warnings may be overlooked because there are too many non-threatening alerts.

The other statements don’t fit because a false positive does not reduce the number of false positives (that would be a better outcome, not what a false positive does). It does not improve detection accuracy (false positives harm accuracy by mislabeling legitimate activity as malicious). And it does not eliminate incident response; in fact, it often triggers unnecessary responses to benign events.