Which statement best describes detection in security operations?

• A. Monitoring is ongoing observation of systems for anomalies
• B. Alerting is notifying when a detection criterion is met
• C. Analysis is the process of examining data
• D. Detection is identifying suspicious activity from data collected by monitoring

Answer: (D)

Detection is identifying suspicious activity from data collected by monitoring. Monitoring gathers logs, network traffic, and system events. Detection applies rules, patterns, and analytics to that data to spot indicators of compromise or anomalies. This step is about recognition; alerting is what happens when a detection criterion is met, and analysis is the deeper examination that follows to understand the incident.