Which of the following controls would reduce the discovery time for similar in the future?

A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device .

Which of the following controls would reduce the discovery time for similar in the future?
A . Implementing application blacklisting
B . Configuring the mall to quarantine incoming attachment automatically
C . Deploying host-based firewalls and shipping the logs to the SIEM
D . Increasing the cadence for antivirus DAT updates to twice daily

Answer: C