An analyst examines Zeek's x509.log and finds a certificate with an unusually short validity period of 24 hours issued by 'Let's Encrypt.' The certificate is for a domain registered 2 days ago. Why is this combination suspicious?

B is correct because attackers use disposable, short-lived certificates from free CAs on newly registered domains to create C2 infrastructure that rotates before reputation systems can blacklist it; the combination of new domain plus short certificate validity is a strong threat indicator. A is wrong because Let's Encrypt is a legitimate, browser-trusted CA; free does not mean untrusted. C is wrong because 24-hour validity only causes warnings after expiration, not before; the concern here is the attack pattern, not browser behavior. D is wrong because Zeek parses standard X.509 certificates regardless of issuing CA.