At an agency, forensics shows an attacker forwarded an executive mailbox for a month, and no security alert fired during that period. Which detection label fits that outcome?
Select an answer to reveal the explanation.
Short Explanation
A silent smoke detector during a real fire is a miss, not a peaceful night and not a false bell. You had an attacker forwarding the mailbox for a month and no alert at all. The trap is calling that a clean period, an allowed change, or an alert that never rang.
Full Explanation
A false negative, the forwarding attack continued with no alert from the monitoring is the label. The forwarding was an attack, it ran for a month, and monitoring produced no alert, so detection missed activity that was really there. A miss stays invisible in the alert queue and shows up only when another source, here the forensic review, finds the rule. A true negative, a quiet stretch where no attack occurred and no alert was expected would require both a quiet queue and a clean environment. The month of unauthorized forwarding means the quiet queue was not a clean stretch. Benign activity, a mailbox change the agency already permits for that executive would fit an authorized mailbox change. Forensics attributes the forward to an attacker, so the change was not an allowed one. A false positive, an alert that fired although the mailbox forwarding was harmless requires an alert that was raised in error. This period produced no alert, so there is no false alarm to reclassify. Exam caveat: a false negative does not appear as a row you can close in the alert console; you discover it from a second source such as a mailbox audit. Operational check: compare the time the forwarding rule appeared with the alert history for that executive account and confirm the month-long gap had no matching detection.