Câu 3: NSE7_SOC_AR-7.6: Fortinet NSE 7 - Security Operations 7.6 Architect

A partner organization recently had sensitive data exfiltrated by a well-known adversary group. You are tasked with threat hunting to see your organization is also affected. Which action must you take first?

1. A. Use threat intelligence to enrich the IP addresses of all destinations.
2. B. Review the tactics, techniques, and procedures of the adversary. — đáp án hiện tại
3. C. Use a packet analyzer to capture and review all traffic flows on critical devices.
4. D. Review historical logs to establish a baseline for normal bandwidth usage.