Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

Anomaly-based IDS typically produces more false positives than signature-based IDS because legitimate but unusual behavior can trigger alerts that deviate from the baseline.

Anomaly-based IDS compares current network or system behavior against a learned baseline of normal activity. Because it detects statistical deviations rather than matching known attack patterns, it can identify novel or zero-day attacks that no signature exists for yet. This is the primary conceptual advantage over signature-based systems.

Requiring vendor updates for new threats is a characteristic of signature-based IDS, which must receive updated signature databases to detect newly discovered attack patterns.

Inability to deal with encrypted traffic is a general limitation shared by many IDS types and is not a defining conceptual characteristic that distinguishes anomaly-based from signature-based detection.