Which term describes a condition when an intrusion detection system fails to react to an actual attack event?

• A. True Negative
• B. False Negative
• C. Intrusion prevention systems (IPS)
• D. Firewall

Answer: (B)

Failing to react to an actual attack is a false negative—the system misses a real incident and does not raise an alert or take protective action. It’s a miss where malicious activity is present but the IDS treats it as normal. This is dangerous because the attack can continue unchallenged. In contrast, a true negative is when there is no attack and the system correctly stays quiet. An intrusion prevention system is a related control that can block or prevent attacks, and a firewall filters traffic; neither describes the specific situation of a missed detection by an IDS.