Knowledge CheckPass mark 80%+60 XP

Module 4 Knowledge Check — Detection Validation & Tuning

Pass mark 80%1 / 3

A rule keyed on a specific file hash has zero false positives all year. What does that most likely indicate?

A.A perfect, high-recall detection.B.A false-negative problem: a hash changes every rebuild, so the technique slips past.C.The rule is too noisy.D.Nothing is wrong.