An IS auditor reviewing the implementation of an intrusion detection system (IDS) should be
MOST concerned if:

A.
IDS sensors are placed outside of the firewall.

B.
a behavior-based IDS is causing many false alarms.

C.
a signature-based IDS is weak against new types of attacks.

D.
the IDS is used to detect encrypted traffic.

Explanation:

An intrusion detection system (IDS) cannot detect attacks within encrypted traffic, and it would be
a concern if someone was misinformed and thought that the IDS could detect attacks in encrypted
traffic. An organization can place sensors outside of the firewall to detect attacks. These sensors
are placed in highly sensitive areas and on extranets. Causing many false alarms is normal for a
behavior-based IDS, and should not be a matter of concern. Being weak against new types of
attacks is also expected from a signature-based IDS, because it can only recognize attacks that
have been previously identified.