Senior management has expressed concern that the organization's intrusion prevention system (IPS) may repeatedly disrupt business operations. Which of the following BEST indicates that the…

The correct answer is A. Decreasing false positives. Disruptions from an IPS are most commonly caused by false positives blocking legitimate traffic. Tuning the IPS to decrease false positives reduces unnecessary business interruptions while maintaining effective prevention.

Submitted by yuki_2020· Apr 18, 2026Information Security Risk Management

Question

Senior management has expressed concern that the organization's intrusion prevention system (IPS) may repeatedly disrupt business operations. Which of the following BEST indicates that the information security manager has tuned the system to address this concern?

Options

ADecreasing false positives
BIncreasing false positives
CIncreasing false negatives
DDecreasing false negatives

How the community answered

(33 responses)

A
91% (30)
B
3% (1)
D
6% (2)

Explanation

Disruptions from an IPS are most commonly caused by false positives blocking legitimate traffic. Tuning the IPS to decrease false positives reduces unnecessary business interruptions while maintaining effective prevention.

Topics

#Intrusion Prevention System (IPS)#False Positives#System Tuning#Operational Impact

Community Discussion

No community discussion yet for this question.

Full CISM Practice