Which anomaly detection policy should you use?

You need to receive a security alert when a user attempts to sign in from a location that was nevsr used by the other users in your organization to sign in.
Which anomaly detection policy should you use?
A. Impossible travel
B. Activity from anonymous IP addresses
C. Activity from infrequent country
D. Malware detection