Which combination represents typical 'suspicious activity' indicators worth documenting?

Explanation

Suspicious-activity recognition is pattern-based, contextual, and probabilistic — never definitive on any single observation. Indicators include surveillance behavior (photographing entrances, cameras, security stations), repeated approach-and-retreat near sensitive points, unusual interest in operational details, atypical tool possession (bolt cutters in a department store), attempts to defeat access controls, and target-glancing combined with concealing an object. None justifies detention alone, but patterns trigger heightened observation and documentation. Normal shopping, tourists, and seasonal behavior (a, b, d) are not suspicious. The discipline avoids profiling and focuses on conduct.