Exam 312-49 topic 1 question 57 discussion

Among the given options, anomaly detection systems typically produce the most false alarms. This is because anomaly detection systems work by identifying deviations from a baseline of normal behavior, which can be highly variable and unpredictable due to the diverse activities of users and networks. While both network-based IDS (NIDS) and host-based IDS (HIDS) can employ anomaly detection methods, it is the specific approach of anomaly detection itself that tends to generate a higher rate of false positives compared to signature-based detection methods, which rely on known patterns of malicious behavior.

out-of-the-ordinary behavior does not mean that it's 100% malicious. So the most false alarm will be happened on the anomaly detection IDS

B is correct. The answer is in the question. users + network. anomaly detection is not a type of IDS

According to http://techgenix.com/ids-part2-classification-methods-techniques/ the answer should be C

I believe “anomaly detection” is a feature not a type of ids. And in question (users and networks) are mentioned. So imho answer should be B

Answer shd be C. anomaly detection

Answer is B + C