問題文
A team has capacity to extend runtime collection to only some of the uncovered workloads this quarter. Which basis for choosing is soundest?
選択肢
- Start with the newest workloads, because recently created resources are the ones most likely to have been created by an attacker and the ones where runtime observation will pay off soonest in the current quarter.
- Start with the workloads that have produced the fewest detections so far, because they are the ones the team knows least about and the ones where new information is most likely to be found.
- Start with the workloads whose surrounding context makes them the most consequential, such as those reachable from outside, holding sensitive data, or carrying broad permissions.
- Start with the accounts that currently show the largest number of uncovered machines, so that the coverage percentage rises the fastest.