A hotel SOC compares four outcomes from the same week: an attack with no alert, an alert that wasted an hour, a quiet night with no intrusion, and an approved support tool. Which outcome is the one in which the attacker had impact?
Select an answer to reveal the explanation.
Short Explanation
The thief who never trips the alarm is the one who leaves with your goods. Attacker impact sits with the false negative, the case where the attack continued and no alert fired. A wasted hour, a clean quiet night, and an approved support tool do not describe that loss.
Full Explanation
Attacker impact means the attack proceeded against the hotel, not merely that analysts spent time. A false negative, in the case where the attack continued and no sensor raised an alert, is the outcome with that impact, because the intrusion ran without a detection. A false positive that consumed an analyst hour on hotel activity that was not an attack costs analyst time and is not an attacker success. A true negative: a quiet period with no alert and no intrusion on the guest network, is a clean window with no attacker effect. A benign remote-support tool running under an approved change, with no attacker on the network, is allowed activity and not an intrusion. Impact in this comparison is what the attacker achieved, not how long the SOC spent on a noisy alert. A clean night and an approved tool leave no attacker outcome to measure. Exam caveat: analyst time lost to a false positive is an operational cost, and it is not the same as impact from an attack that went unseen. Operational check: for any silent window, compare host and network evidence before calling it clean, so a false negative is not mistaken for a true negative.