An IDS in a production environment generates an alert for an inbound connection matching an exploit signature for a service that is not running on the target host. After verification, this is classified as a false positive. What tuning action reduces similar false positives for this specific rule?

B is correct because suppressing the rule for the specific destination host/port where the targeted service is absent eliminates the false positive without removing the detection for hosts where the service does run. A is wrong because deleting the rule removes valid detection capability for all other hosts where the service exists. C is wrong because lowering priority does not eliminate the false positive; it just buries it in the queue, wasting analyst time. D is wrong because moving the sensor changes coverage, not the rule's applicability.