Correlation Policy Rules Allow You to Construct Criteria for Alerting

Correlation policy rules allow you to construct criteria for alerting on very specific conditions. Which option is an example of such a rule?

A) testing password strength when accessing an application
B) limiting general user access to administrative file shares
C) enforcing two-factor authentication for access to critical servers
D) issuing an alert if a noncompliant operating system is detected or if a host operating system changes to a noncompliant operating system when it was previously profiled as a compliant one