What is a core limitation of Network Intrusion Detection Systems?

Question

Options

• AIDS cannot detect threats in encrypted data.
• BIDS has a significant negative impact on bandwidth.
• CIDS could block legitimate traffic and cause false positives.
• DIDS needs tuning after it is installed in the infrastructure.

• A
  91% (21)
• B
  4% (1)
• C
  4% (1)

Explanation

Network IDS operates by inspecting packet contents and traffic patterns, but modern encrypted protocols (TLS/HTTPS) make payload inspection impossible - the IDS sees only ciphertext, rendering signature-based and anomaly detection largely blind to threats hidden within encrypted tunnels.

Why the distractors are wrong:

• B - IDS is a passive monitoring system (it mirrors traffic); it does not sit inline and therefore has negligible bandwidth impact. Confusing IDS with IPS (Intrusion Prevention System) is a common trap.
• C - Blocking legitimate traffic and causing false positives describes an IPS, not an IDS. An IDS only detects and alerts; it has no authority to block traffic.
• D - While tuning is a real operational task, it is not a core limitation - it is a deployment consideration. The question asks for a fundamental architectural constraint, which encryption blindness represents.

Memory tip: Think of IDS as a security camera that can only see through glass - the moment someone draws the curtains (encrypts the traffic), the camera is useless. "Encrypted = Invisible to IDS" is the key phrase to lock in.

No community discussion yet for this question.