Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

Anomaly-based IDS typically produces more false positives than signature-based IDS because legitimate but unusual activity can trigger alerts.

Anomaly-based IDS builds a profile of normal network or system behavior and flags statistical deviations. Because it does not rely on pre-defined attack signatures, it can detect zero-day and previously unknown attacks that a signature-based system would miss entirely.

Requiring vendor updates for new threat signatures is a characteristic of signature-based IDS, not anomaly-based IDS.

Inability to handle encrypted traffic is a limitation shared by both anomaly-based and signature-based IDS and is not a distinguishing characteristic of either.