Which statement is incorrect about Cisco IPS 6.0 Sensor Anomaly Detection?

Which statement is incorrect about Cisco IPS 6.0 Sensor Anomaly Detection?

A.
It is used to identify worms which spread by scanning the network.

B.
In the Anomaly Detection histograms, the number of source IP addresses is either learned or configured by the user.

C.
In the Anomaly Detection histograms, the number of destination IP addresses is predefined.

D.
It sub-divides the network into two zones.