Which two statements best explain why domain shadowing is difficult to detect? (Choose two.)

[answerhappygod]

Which two statements best explain why domain shadowing is difficult to detect? (Choose two.)

A. The created subdomains are numerous, short lived, and random, with no discernible patterns.
B. The attacker gains admin access to a legitimate domain, and uses that legitimate domain to register many shady subdomains.
C. The attacker rapidly rotates a single domain to a large list of IP addresses, to avoid detection.
D. The exploit kit landing page subdomains are usually active for a long time and branched into using both third-level and fourth-level domains (for example,