Which of the following statements is FALSE with respect to Intrusion Detection Systems?

This statement is FALSE because standard IDS engines perform deep packet inspection on plaintext data; when traffic is encrypted via TLS/SSL, the IDS cannot read the payload to match signatures or identify malicious content without an out-of-band decryption mechanism. This is a well-known architectural limitation that attackers exploit by tunneling malicious payloads over HTTPS or other encrypted protocols.

This is TRUE - network-based IDS examines data contents in context of the protocol stack, which is a core function of both signature-based and anomaly-based detection.

This is TRUE - IDS platforms support custom rules and signatures that match specific byte sequences, strings, or patterns within packet payloads.

This is TRUE - signature-based IDS depends on a continuously updated signature database to detect newly discovered exploits, malware, and attack patterns.