Which statement about IDSs is supported by the material?

• A. They tend to issue many false negatives
• B. They never generate false positives
• C. They always drop all traffic
• D. They ignore all suspicious activity

Answer: (A)

IDSs monitor traffic and raise alerts when something looks suspicious, but they are not inline blockers by default. Detection relies on known patterns or unusual behavior, and the threat landscape keeps changing. As a result, some real attacks can go undetected, especially if they are new, use evasive techniques, or traffic is encrypted, leading to false negatives. This imperfect detection—missed threats—is a realistic trait of IDSs, which is why this statement fits the material.

The other ideas don’t align with how IDSs operate: they don’t drop all traffic (that’s what an inline security system like an intrusion prevention system would do), and while they should alert on suspicious activity, they don’t ignore it; and detection systems can produce false positives as well, so it isn’t accurate to claim they never err on that side.