Which statement is incorrect about Cisco IPS 6.0 Sensor Anomaly Detection?

A.
It is used to identify worms which spread by scanning the network.

B.
In the Anomaly Detection histograms, the number of source IP addresses is either learned or
configured by the user.

C.
In the Anomaly Detection histograms, the number of destination IP addresses is predefined.

D.
It sub-divides the network into two zones.