Which statement best describes IDS signatures?

• A. Signatures enable detection of known threats; without them, detection may fail
• B. Signatures eliminate all false positives
• C. Signatures are used to encrypt traffic
• D. Signatures make IDS immune to tampering

Answer: (A)

Signatures in an IDS are predefined patterns that match known malicious activity. This is what allows the system to recognize and alert on known threats: if the traffic or payload fits one of the signatures, an alert is triggered. Without these patterns, the IDS would lack specific indicators to identify those attacks, so detection of known techniques could fail.

Think of signatures as a catalog of known bad behaviors—the exact payload strings, sequence of bytes, or protocol abuses that have been observed before. They’re essential for fast, accurate detection of those known threats, but they’re not a magic shield against everything. They require regular updates to cover new exploits, and they don’t catch novel, unknown attacks. They can also produce false positives when legitimate activity matches a signature, and they do not provide encryption or tamper-proofing for the IDS itself.