問題文
The team wants to report the share of findings that turned out not to be a real problem. Which record on the finding supports this, and what has to be true operationally for the number to be meaningful?
選択肢
- The number of contributing intermediate findings, because a finding built from a single contribution is more likely to be a false alarm than one built from many in one window.
- The classification recorded when the finding is closed, which requires that analysts consistently set it rather than closing findings without choosing a value.
- The urgency assigned at creation, because findings that turn out to be benign are the ones that were assigned a low urgency, so counting low urgency findings gives the share directly for the period that the report covers.
- The status at the time of the report, because findings that were closed without being promoted to an investigation are by definition the ones that were not real problems, which the status records.