Which step could give you valuable context about the incident?

Refer to the scenario.

A hospital has an AOS10 architecture that is managed by Aruba Central. The customer has deployed a pair of Aruba 9000 Series gateways with Security licenses at each clinic. The gateways implement IDS/IPS in IDS mode.

The Security Dashboard shows these several recent events with the same signature, as shown below:

Which step could give you valuable context about the incident?
A . View firewall sessions on the APs and record the threat sources’ type and OS.
B. View the user-table on APs and record the threat sources’ 802.11 settings.
C. View the RAPIDS Security Dashboard and see if the threat sources are listed as rogues.
D. Find the Central client profile for the threat sources and note their category and family.

Answer: D