フリー問題

問題文

Tightening the criteria for what counts as a reportable security issue cut false positives from 40% to 8%. It also cut the number of true findings by 15%. Is this a good outcome?

選択肢

1. It depends on whether the criteria can be tuned to recover the lost findings without raising false positives.
2. No, since any loss of true findings in a security context is unacceptable.
3. Yes, since a 32-point reduction in false positives far outweighs a 15% loss of findings.
4. It depends on the severity of what was lost: losing low-severity findings is acceptable, losing exploitable ones is not.