An IS auditor reviewing the implementation of an intrusion detection system (IDS) should be MOST concerned
if:

A.
IDS sensors are placed outside of the firewall.

B.
a behavior-based IDS is causing many false alarms.

C.
a signature-based IDS is weak against new types of attacks.

D.
the IDS is used to detect encrypted traffic.

Explanation:
An intrusion detection system (IDS) cannot detect attacks within encrypted traffic, and it would be a concern if
someone was misinformed and thought that the IDS could detect attacks in encrypted traffic. An organization
can place sensors outside of the firewall to detect attacks. These sensors are placed in highly sensitive areas
and on extranets. Causing many false alarms is normal for a behavior-based IDS, and should not be a matter
of concern. Being weak against new types of attacks is also expected from a signature-based IDS, because it
can only recognize attacks that have been previously identified.