Which statement accurately reflects reporting of unexpected activity?

Which statement accurately reflects reporting of unexpected activity?

• A. Most unexpected activity isn't espionage, you should only report things that are obviously indicators of espionage.
• B. Most unexpected activity could indicate espionage and should be reported.
• C. Only confirmed cases should be reported.
• D. Reporting is optional.

Answer: (B)

The key idea is that reporting of unusual or unexpected activity is essential because espionage signals are often subtle and not easily proven at first glance. In threat awareness, small or ambiguous observations can be early indicators when they’re collected, shared, and analyzed together. By reporting these suspicions, you enable security teams to triage, correlate with other data, and uncover patterns that wouldn’t be visible from a single observation. This proactive approach improves detection and reduces risk, even if the individual activity isn’t obviously malicious on its own. That’s why the statement that most unexpected activity could indicate espionage and should be reported is the best choice. It reflects the reality that not all signs will be clear or confirmed immediately, but reporting them helps build a fuller picture and speeds up investigation. The other ideas don’t fit because they set thresholds too high or treat reporting as optional. Waiting for obvious indicators delays detection, and requiring confirmation before reporting misses opportunities to identify evolving threats. Making reporting optional undermines the purpose of threat awareness, which is to gather signals and enable timely response.

The key idea is that reporting of unusual or unexpected activity is essential because espionage signals are often subtle and not easily proven at first glance. In threat awareness, small or ambiguous observations can be early indicators when they’re collected, shared, and analyzed together. By reporting these suspicions, you enable security teams to triage, correlate with other data, and uncover patterns that wouldn’t be visible from a single observation. This proactive approach improves detection and reduces risk, even if the individual activity isn’t obviously malicious on its own.

That’s why the statement that most unexpected activity could indicate espionage and should be reported is the best choice. It reflects the reality that not all signs will be clear or confirmed immediately, but reporting them helps build a fuller picture and speeds up investigation.

The other ideas don’t fit because they set thresholds too high or treat reporting as optional. Waiting for obvious indicators delays detection, and requiring confirmation before reporting misses opportunities to identify evolving threats. Making reporting optional undermines the purpose of threat awareness, which is to gather signals and enable timely response.