Which Cisco IPS feature is most likely to respond to a zero-day attack?

A.
reputation filtering

B.
botnet filtering

C.
anomaly detection

D.
meta-engine

E.
de-obfuscation

F.
threat detection

Explanation:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/anomaly_detector/v5.0/ configuration/guide/Intro.html#wp1046115