"C" is correct

---> Separation of duties is an administrative control dictating that a single individual should not perform all critical- or privileged-level duties. Additionally, important duties must be separated or divided among several individuals within the organization.

--> The principle of least privilege states that all users should be granted only the level of privilege they need to do their jobs, and no more.

"C" is correct

Here are the steps of the Kill Chain Model.

The example are in the context of the question

1) Reconnaissance - identified vulnerabilities

2) Weaponization - prepare (in lab) the weapon, for example a file with malware code.

3) Delivery - transmit the file (e-mail, website, etc)

4) Exploitation - trigger the weapon (execute the code), exploiting the vulnerability

5) Installation - the weapon installs a backdoor (server)

6) Command and control (C2 or CnC) - connection to the treat actor

7) Actions on objectives - do the job (stealing information, for example)

Answer is C.

Host-based antivirus protection is also known as agent-based. Agent-based antivirus runs on every protected machine. Agentless antivirus protection performs scans on hosts from a centralized system. Agentless systems have become popular for virtualized environments in which multiple OS instances are running on a host simultaneously. Agent-based antivirus running in each virtualized system can be a serious drain on system resources. Agentless antivirus for virtual hosts involves the use of a special security virtual appliance that performs optimized scanning tasks on the virtual hosts.

"Decision-making" comes up in NIST 800-600r2 in the Containment section, as well as the term "appropriate strategy" similar to "appropriate course of action" as written in the question.

"Organizations should create separate containment strategies for each major incident type, with criteria documented clearly to facilitate ---decision-making----. Criteria for determining the appropriate strategy include...."

Information security's primary focus is the balanced protection of the confidentiality, integrity, and availability of data (also known as the CIA triad) while maintaining a focus on efficient policy implementation, all without hampering organization productivity.

(source: https://en.wikipedia.org/wiki/Information_security)

So D is correct

A and D are not right because both detections have nothing to do with idenity.

C is incorrect as statistical detection would concern with the likelihood so B is the correct answer.

Reconnaissance: Intruder selects target, researches it, and attempts to identify vulnerabilities in the target network.

Weaponization: Intruder creates remote access malware weapon, such as a virus or worm, tailored to one or more vulnerabilities.

Delivery: Intruder transmits weapon to target (e.g., via e-mail attachments, websites or USB drives)

Exploitation: Malware weapon's program code triggers, which takes action on target network to exploit vulnerability.

Installation: Malware weapon installs access point (e.g., "backdoor") usable by intruder.

Command and Control: Malware enables intruder to have "hands on the keyboard" persistent access to target network.

Actions on Objective: Intruder takes action to achieve their goals, such as data exfiltration, data destruction, or encryption for ransom.

(Source: https://en.wikipedia.org/wiki/Kill_chain#Attack_phases_and_countermeasures)

Nothing has be executed yet only delivered, so answer D is correct

See also: https://cyberhoot.com/cybrary/data-normalization/

By using data normalization duplicate data is removed and the overal memory/storage impact is reduced. This will make the data actionable. It's debatable if it really helps with the integrity of the data, but you could argue by removing the duplicates the data can be matched better with timestamps from other data sources in a forensic investigation.

So answer B is correct

"C" is correct.

Traditional firewalls typically provide security event logs that are mostly based on the 5-tuple.

A TCP session is a sequence of sockets with the same IP addresses, ports and protocol.