A security analyst, Ann, states that she believes Internet facing file transfer servers are being attacked. Which of the following is evidence that would aid Ann in making a case to management that action needs to be taken to safeguard these servers?
A . Provide a report of all the IP addresses that are connecting to the systems and their locations
B . Establish alerts at a certain threshold to notify the analyst of high activity
C . Provide a report showing the file transfer logs of the servers
D . Compare the current activity to the baseline of normal activity
Answer: D