Câu 11: CA1-005: CompTIA SecurityX

A security analyst wants to use lessons learned from a prior incident response to reduce dwell time in the future. The analyst is using the following data points: Which of the following would the analyst most likely recommend?

1. A. Adjusting the SIEM to alert on attempts to visit phishing sites — đáp án hiện tại
2. B. Allowing TRACE method traffic to enable better log correlation
3. C. Enabling alerting on all suspicious administrator behavior
4. D. Utilizing allow lists on the WAF for all users using GET methods