A security analyst is studying IDS and IPS. Which statement about Anomaly-based detection is correct?

Correct Answer: B

looks for deviations from normal behavior that may indicate attacks

This is correct because Anomaly-based detection looks for deviations from normal behavior that may indicate attacks.