Which one of the following is NOT true?

Question

Options

• AIDS' can generate numerous alerts when not configured correctly
• BFalse positives alerts make it very difficult to find the real attack
• CAutomated responses to alerts must be considered
• DIDS can never be used in a switched environment

• A
  8% (3)
• B
  3% (1)
• C
  14% (5)
• D
  76% (28)

Explanation

Option D is the NOT true statement because IDS systems can operate in switched environments using techniques like port mirroring (SPAN ports) or network taps, which allow the IDS to see traffic that would otherwise only pass between specific switch ports.

Options A, B, and C are all true statements and therefore wrong answers here:

• A is true - a misconfigured IDS produces excessive noise, flooding analysts with irrelevant alerts.
• B is true - false positives are a real operational burden; when legitimate traffic triggers alerts constantly, real attacks get buried and missed.
• C is true - automated responses (like blocking IPs) require careful planning because a misconfigured automated response can block legitimate users or even be weaponized to cause a self-inflicted DoS.

Memory tip: Think of D as the "never say never" trap. Exam questions that use absolute words like never, always, or impossible are often the false statement - IDS evolved specifically to work in modern switched networks, so "can never" is a dead giveaway.

No community discussion yet for this question.