A team enables WAF in detection mode to observe false positives. What should it expect for requests matching a managed attack rule?

1. Every matching request is blocked exactly as in prevention mode
2. The WAF converts each request into an NSG rule
3. Matching activity is logged without the prevention-mode block behavior
4. Matching logs are automatically disabled