Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?

What the interviewer wants to hear

• False positive: alert on benign activity
• False negative: real attack with no alert
• False negatives are usually more dangerous
• Too many false positives cause alert fatigue and missed real alerts
• Balance through tuning, context and testing detections

Model answer

A false positive is an alert that fires on harmless activity, like a backup job flagged as data exfiltration. A false negative is a real attack that produces no alert at all. False negatives are usually worse because nobody knows to respond, and the attacker keeps going. But false positives are not harmless either. If analysts see hundreds of noisy alerts a day, they suffer alert fatigue and may close a real one by mistake. So the goal is balance. I would tune noisy rules with specific exclusions instead of disabling them, add context like asset criticality to prioritise, and regularly test detections with simulated attacks to find false negatives. Tracking the true positive rate per rule helps decide where to spend tuning effort.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?