A detection rule is defined to trigger an alert if: 500MB in an hour OR 200MB in 10 minutes.
Nopal Securities technical mcq question, verified with a worked answer. Free to practise - no sign-up.
A detection rule is defined to trigger an alert if: >500MB in an hour OR >200MB in 10 minutes.
A user downloads 100MB every 2 minutes for 12 minutes continuously. Will the alert trigger?
Show answer & explanation
Answer: C. Yes, because total exceeds both conditions.
In 10 minutes, the user downloads 5 * 100MB = 500MB (> 200MB in 10 mins). Over 12 minutes, total is 6 * 100MB = 600MB (> 500MB in an hour). Both conditions are triggered.
Step-by-step Derivation:
Step 1: In 10 minutes, downloads = 5 * 100MB = 500MB, triggering the >200MB threshold.
Step 2: Total in 12 minutes = 600MB, triggering the >500MB threshold.
Step 3: Hence the alert triggers.