An IS auditor reviewing the implementation of an intrusion detection system (IDS) should be MOST concerned if:

A.
IDS sensors are placed outside of the firewall.

B.
a behavior-based IDS is causing many false alarms.

C.
a signature-based IDS is weak against new types of attacks.

D.
the IDS is used to detect encrypted traffic.

Explanation:
An intrusion detection system (IDS) cannot detect attacks within encrypted traffic, and it would be a concern if someone was misinformed and thought that the IDS could detect attacks in encrypted traffic. An organization can place sensors outside of the firewall to detect attacks. These sensors are placed in highly sensitive areas and on extranets. Causing many false alarms is normal for a behavior-based IDS, and should not be a matter of concern. Being weak against new types of attacks is also expected from a signature-based IDS, because it can only recognize attacks that have been previously identified.