フリー問題

問題文

A SOC is designing risk accumulation rules. Which conditions increase selectivity without simply raising the score threshold? (Select two.)

選択肢

1. Requiring that the object's asset priority be high, so only important assets qualify, which focuses the SOC's limited investigation capacity on the machines whose compromise would matter most to the business.
2. Requiring that the contributing entries span more than one distinct tactic, so a single repeated behavior does not qualify.
3. Requiring that the accumulation occur within a shorter window, because a shorter window means the behaviors are more closely related in time and so more likely to belong to the same campaign than entries spread across several weeks.
4. Requiring that at least one contributing entry come from a detection with a high confirmed rate.
5. Requiring that the contributing entries come from more than one data source, so an artifact of one source's behavior does not qualify.