IDSs tend to issue many false negatives.

• A. True
• B. False
• C. Both
• D. Neither

Answer: (B)

Intrusion detection systems are evaluated by how they balance missing real threats (false negatives) and triggering alerts on benign activity (false positives). In practice, false positives tend to be the bigger, more visible problem, especially with signature-based systems or aggressive tuning that aims to catch known attacks. Attackers can sometimes exploit gaps or use novel methods to slip past detections, which can lead to misses, but this doesn’t mean IDSs routinely produce many false negatives. With up-to-date signatures and well-designed anomaly detection, false negatives are kept in check, though not eliminated. Therefore the statement that IDSs tend to issue many false negatives isn’t generally accurate.