A partner's legitimate account is used from an unusual location to download far more records than its normal baseline. Which detection strategy is most relevant?

1. Behavior-based anomaly detection
2. Checking only whether the password was correct
3. Signature matching for a specific malware file only
4. Verifying only that the account is not expired