ISC2 Certified in Cybersecurity (CC)Access Controls ConceptsHard
A critical server room's access log shows an entry at 2:30 AM indicating 'Door Forced Open' followed immediately by 'Motion Detected Inside Room'. The security team reviews surveillance footage but finds no physical evidence of forced entry and no individuals captured on camera entering the room. This discrepancy suggests a potential issue with the physical security system's integration or configuration. What is the most likely cause of this discrepancy?
- AA false positive generated by a misconfigured sensor.
- BAn insider attack where logs were manipulated.
- CA system error causing corrupted log entries.
- DA sophisticated physical intrusion that bypassed detection.
Show answer & explanationAnswer & explanation
Correct answer: A. A false positive generated by a misconfigured sensor.
The scenario describes an alarm ('Door Forced Open', 'Motion Detected') without corresponding physical evidence or video footage. This is a classic indicator of a false positive, often caused by misconfigured sensors (e.g., a motion sensor set too sensitively, or a door sensor that is loose), leading to alerts without an actual event.
Why the other options are wrong
- B. Log manipulation is possible but typically aims to *hide* an event, not generate false alarms that are then uncorroborated by other evidence.
- C. System errors leading to corrupted log entries are possible, but 'Door Forced Open' and 'Motion Detected' are specific, sequential events suggesting sensor input rather than random corruption.
- D. While possible, the lack of *any* physical evidence or video makes a bypass less likely than a sensor issue for a 'forced open' alarm.
False Positive (Security)
An alert or indication from a security system that reports a legitimate activity or benign condition as malicious or anomalous.
- Can lead to alert fatigue and wasted resources.
- Often caused by poor calibration or misconfiguration of sensors.
- Requires investigation to distinguish from true threats.
Memory trick: Logs conflict, look for false facts.