Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?

The correct answer is A. Trusted and untrusted networks. Knowing the boundary between trusted and untrusted networks is foundational to IDS tuning because it determines where sensors are placed, what traffic is monitored, and what constitutes a suspicious crossing of trust boundaries - without this context, the IDS cannot distinguish…

IS Management Controls and Auditing Management

Question

Options

ATrusted and untrusted networks
BType of authentication
CStorage encryption
DLog retention

How the community answered

(38 responses)

A
82% (31)
B
5% (2)
C
11% (4)
D
3% (1)

Explanation

Knowing the boundary between trusted and untrusted networks is foundational to IDS tuning because it determines where sensors are placed, what traffic is monitored, and what constitutes a suspicious crossing of trust boundaries - without this context, the IDS cannot distinguish normal from anomalous behavior. Authentication type (B) is a policy concern, not a tuning parameter for the IDS itself. Storage encryption (C) protects data at rest but has no bearing on how the IDS inspects or filters traffic. Log retention (D) is an operational/compliance consideration that comes after detection, not a factor in how accurately the IDS identifies threats.

Memory tip: Think of the IDS as a border guard - it can only do its job if it knows where the border is. Trusted vs. untrusted = defining the border.

Topics

#Intrusion Detection System#Network Segmentation#IDS Tuning#False Positives

Community Discussion

No community discussion yet for this question.

Full 712-50 Practice