ECCouncil Exam Questions

How should the administrator classify this situation?

A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The
alert was generated because a large number of packets were coming into the network over ports 20 and 21.
During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this
situation?

A.
True negatives

B.
False negatives

C.
True positives

D.
False positives