In IDS evaluation, what does a false positive indicate?

The IDS correctly identified an attack

The IDS correctly identified benign activity as benign

The IDS failed to detect an actual attack

The IDS flagged benign activity as malicious

A penetration tester is testing a NIDS's ability to detect a known exploit. The tester uses a tool to automatically generate multiple variations of the exploit, including different encodings and payload structures. The NIDS detects some variations but misses others. What is the most effective way to improve the NIDS's detection rate for these variations?

Increase the NIDS's logging level to capture more details

Switch to a host-based IDS on the target server

Deploy additional NIDS sensors at different network points

Enable the NIDS's protocol decoding and normalization features

Certified Tester Security Tester

Domain 5Objective 5

Intrusion Detection CT-SEC Practice Questions (Page 2)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

8concepts

Questions 6–10

6foundation · easy
In IDS evaluation, what does a false positive indicate?
Select an answer first
7application · medium
A company needs an IDS that can analyze network traffic at high speed (10 Gbps) and is known for its multi-threading capabilities. They are considering open-source options. Which tool is the most appropriate for this requirement?
Select an answer first
8application · medium
An organization is experiencing a new type of attack that does not match any known signatures. They need to detect this attack and similar unknown threats. Which IDS approach is most suitable?
Select an answer first
9foundation · easy
Which tool is primarily a host-based intrusion detection system (HIDS) that provides file integrity checking and log monitoring?
Select an answer first
10expert · hard
A penetration tester is testing a NIDS's ability to detect a known exploit. The tester uses a tool to automatically generate multiple variations of the exploit, including different encodings and payload structures. The NIDS detects some variations but misses others. What is the most effective way to improve the NIDS's detection rate for these variations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Intrusion Detection CT-SEC Practice Questions (Page 2)

Questions 6–10

In IDS evaluation, what does a false positive indicate?

A company needs an IDS that can analyze network traffic at high speed (10 Gbps) and is known for its multi-threading capabilities. They are considering open-source options. Which tool is the most appropriate for this requirement?

An organization is experiencing a new type of attack that does not match any known signatures. They need to detect this attack and similar unknown threats. Which IDS approach is most suitable?

Which tool is primarily a host-based intrusion detection system (HIDS) that provides file integrity checking and log monitoring?

Keep studying — Testing Security Mechanisms