The other answers are not correct because:
You are always looking for the "best" answer. While each of the answers listed here could be considered correct in that each of them require input from the security staff, the best answer is for that input to happen at all phases of the project.
Reference:
Official ISC2 Guide page: 556
All in One Third Edition page: 832 - 833

Explanation/Reference:
Explanation:
Anomaly Detection IDS learns about the normal activities and events on your system by watching and tracking what it sees. Once it has accumulated enough data about normal activity, it can detect abnormal and possibly malicious activities or events. There is a small risk that some non-harmful activity is classified as anomaly by mistake - false positives can occur.
Incorrect Answers:
A: A Pattern Matching IDS uses a signature database and attempts to match all monitored events to its contents. Only activities present in the database will be detected. There will be no false positives.
C: Host-based intrusion detection is not an IDS analysis method. It is a classification on information source.
A host - based IDS watches for questionable activity on a single computer system, especially by watching audit trails, event logs, and application logs.
D: Network-based intrusion detection is not an IDS analysis method. It is a classification on information course. Here the source is a network segment.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 56

Section: Software Development Security