During a semester exam on IDS and IPS, which answer should be selected for Anomaly-based detection?

A. is used only for cable testing B. matches only exact known signatures C. looks for deviations from normal behavior that may indicate attacks D. means deleting all logs