A security team is implementing continuous monitoring and must choose between agent-based and agentless endpoint data collection. Which statement accurately describes the trade-off?

D is correct because agents capture detailed process creation, file system changes, registry modifications, and network connections in real time. Agentless approaches using WMI queries or log scraping have less visibility into ephemeral events and process-level detail. A is wrong because agentless collection is generally less detailed than agent-based. C is wrong because agents typically send pre-processed telemetry rather than raw data, and bandwidth differences depend heavily on implementation. B is wrong because while agents add some attack surface, their security value generally outweighs this consideration.