Multiple Choice Questions. Print the correct answer in the blank following the question.

Which of the following is an advantage of anomaly-based detection?

1. Rules are easy to define

2. The data it produces can be easily analyzed

3. It can detect zero-day or previously unknown attacks

4. Malicious activity that falls within normal usage patterns is detected

5. Rules developed at one site can be shared with many other users