問題文
A search returns the least common user agent strings on a web site. One of them appears twice in a month. A colleague concludes that this is an attack. What is the correct assessment of that conclusion?
選択肢
- Being uncommon is a reason to look, not a finding in itself, because rare values often come from unusual but legitimate activity.
- The conclusion is unfounded, because the least common values are computed from a sample rather than from all events.
- The conclusion is sound, because twice a month cannot be routine activity on a public web site.
- It is sound provided the value does not also appear in the top results, because a value can only be classified once.