Signature-based monitoring can be described as which of the following?

A. attempts to answer the question: "will this do something harmful if allowed to execute?"
B. compiles a baseline of normal activities and looks for statistical anomalies
C. examines network traffic, activity, and transactions, and looks for well-known patterns
D. continuously analyzes the behavior of processes and alerts the user if abnormal actions are detected

Answer: C