mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst notices that an IDS is…
A security analyst notices that an IDS is generating a high number of false positives for legitimate encrypted traffic. Which tuning method should the analyst use to reduce false positives without reducing detection capability?
⚠ Common exam trap
CompTIA often tests the misconception that disabling signatures or increasing thresholds is an acceptable tuning method, but the trap here is that those actions reduce detection capability, whereas whitelisting trusted sources is the only option that maintains full detection for untrusted traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whitelist the source IP addresses of known, trusted servers.
Whitelisting the source IP addresses of known, trusted servers reduces false positives by instructing the IDS to ignore alerts for encrypted traffic from those specific hosts. This approach preserves detection capability because the IDS continues to apply all signatures to traffic from other, potentially malicious sources. It is a targeted tuning method that does not disable detection mechanisms or alter sensitivity thresholds, which could otherwise miss real threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Whitelist the source IP addresses of known, trusted servers.
Why this is correct
Whitelisting specific source IP addresses for known, trusted servers is an effective method to reduce false positives without compromising detection capabilities. By instructing the IDS to ignore or suppress alerts for traffic originating from these verified legitimate sources, the analyst can significantly decrease the volume of benign alerts. This action helps to improve the signal-to-noise ratio, allowing security personnel to focus on genuinely suspicious activities rather than expected operational traffic.
- ✗
Disable the signatures that trigger for encrypted traffic.
Why it's wrong here
Disabling signatures that trigger for encrypted traffic is a dangerous overreaction to false positives, as it creates a significant security blind spot. While it would reduce alerts, it simultaneously eliminates the IDS'ss ability to detect actual threats, such as malware command-and-control or data exfiltration, hidden within that encrypted communication. This approach severely compromises the organization's detection capabilities and overall security posture, leaving it vulnerable to sophisticated attacks.
- ✗
Increase the sensitivity threshold for the encrypted traffic signatures.
Why it's wrong here
Increasing the sensitivity threshold for encrypted traffic signatures would exacerbate the problem of high false positives, not alleviate it. A higher sensitivity means the IDS would be even more prone to triggering alerts based on minor deviations or common encrypted traffic patterns, leading to an overwhelming number of irrelevant notifications. This action would further degrade the effectiveness of the IDS by burying legitimate alerts under a flood of noise, making it harder to identify real threats.
- ✗
Enable full packet capture and analyze the encrypted traffic manually.
Why it's wrong here
Enabling full packet capture and manually analyzing encrypted traffic is a reactive forensic step, not an efficient method for tuning an IDS to reduce false positives. While valuable for in-depth investigation after an alert, it does not prevent the IDS from generating excessive alerts in the first place. This approach is highly resource-intensive, impractical for continuous monitoring, and fails to address the underlying issue of an improperly tuned detection system.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.