NO$\mathrm{.}187$ When reviewing the functionality of an intrusion detection system $($IDS$),$ the IS auditor should be MOST concerned if:$($A$).$ legitimate packets blocked by the system have increased$($B$).$ actual attacks have not been identified$($C$).$ detected events have increased false $($D$).$ positives have been reporte