Câu 24: CS0-002: CompTIA CySA+ Certification Exam (CS0-002)

During a review of SIEM alerts, a security analyst discovers the SIEM is receiving many alerts per day from the file-integrity monitoring tool about files from a newly deployed application that should not change. Which of the following steps should the analyst complete FIRST to respond to the issue?

1. A. Warn the incident response team that the server can be compromised.
2. B. Open a ticket informing the development team about the alerts.
3. C. Check if temporary files are being monitored. — đáp án hiện tại
4. D. Dismiss the alert, as the new application is still being adapted to the environment.