問題文
Which analytic technique answers whether two alerts describe the same underlying activity rather than adding context to each one?
選択肢
- Clustering on shared attributes, because it decides which alerts belong to one group before anything is looked up.
- Sampling by a chosen ratio, because it decides which alerts enter one look before anything is counted.
- Scoring against a fixed table, because it decides which alerts carry one weight before anything is encrypted.
- Enriching with outside repositories, because it decides which alerts deserve one look before any grouping.