A security team is implementing continuous monitoring and must choose between agent-based and agentless endpoint data collection. Which statement accurately describes the trade-off?

Agent-based collection provides richer real-time endpoint telemetry while agentless approaches may miss process-level activity but are easier to deploy uniformly. Agents capture detailed process creation, file system changes, registry modifications, and network connections in real time. Agentless approaches using WMI queries or log scraping have less visibility into ephemeral events and process-level detail. The claim that agentless collection provides deeper visibility is wrong because it is generally less detailed. The claim that agent-based solutions always require significantly more bandwidth is wrong because agents typically send pre-processed telemetry rather than raw data, and bandwidth depends on implementation. The claim that agentless monitoring is preferred for sensitive systems because agents increase attack surface unacceptably is wrong because their security value generally outweighs that added surface.