What term describes when an intrusion detection system correctly classifies normal activity as acceptable?

• A. False Negative
• B. True Negative
• C. Bastion Host
• D. Demilitarized Zone (DMZ)

Answer: (B)

When an intrusion detection system processes activity, its results fall into true positives, false positives, true negatives, or false negatives. The scenario described—normal, non-threatening activity being labeled as acceptable—is a true negative. It means the system correctly recognizes that there is no threat and does not raise an alarm.

This differs from a false negative, where malicious activity goes undetected and is wrongly classified as normal, which is a missed detection. It also differs from a false positive, where normal activity is incorrectly flagged as malicious, causing an unnecessary alert. Bastion Host and DMZ are network design concepts and not about how the IDS classifies activity.