A municipal data center in Phoenix, Arizona, deploys a network intrusion detection system to monitor...

The correct answer is B. True Positive.

A true positive occurs when a security control correctly identifies malicious or unauthorized activity as malicious. In this scenario, the red team exploit was real within the authorized test scope, the IDS generated an alert, and log correlation confirmed that the alert matched the exploit traffic.

CEH-aligned IDS material explains that a false positive occurs when an IDS alerts on traffic as malicious when it is not, while a false negative occurs when the IDS fails to alert even though an intrusion attempt occurred . By contrast, this case is neither false positive nor false negative because the alert was accurate and corresponded to actual exploit activity.

Option A. False Negative is incorrect because the IDS did not miss the attack.

Option C. False Positive is incorrect because the alert was not triggered by benign traffic.

Option D. True Negative is incorrect because a true negative means no attack occurred and no alert was generated.

Therefore, the best answer is B. True Positive.