Which statements about the role of end users in detecting information security incidents are correct?

Question $1$Answer

a$.$

Most end users may have significant experience with the routine operation of the business systems and applications that they use, but they really cannot produce useful precursor or indicator information regarding possible information security incidents.

b$.$

Most end users and their first$-$level supervisors have the best, most current insight as to the normal business rhythm and flow, and therefore normal loads on the systems and their throughput. They will most likely see anything abnormal quickly as a result.

c$.$

Users think that they know a lot about business normal, but we need to rely more heavily on well$-$instrumented intrusion detection systems, access control, and other monitoring capabilities.

d$.$

Since most APT kill chains use low and slow attack methods to reconnoiter and gain access, by the time users see things behaving abnormally, it$$s too late.