Detection relies on:

• A. Reactive measures after a breach.
• B. Continuous monitoring and anomaly detection.
• C. Periodic random checks only.
• D. Off-site rumor tracking.

Answer: (B)

Detecting security incidents relies on continuous monitoring and anomaly detection. Constant visibility means collecting data from endpoints, networks, cloud services, and logs in real time, so threats can be spotted as they unfold rather than after the fact. Anomaly detection uses baselines of normal behavior to flag deviations that may indicate abuse, misconfigurations, or breaches. This combination provides timely alerts, faster containment, and reduced dwell time, which is far more effective than waiting for a breach to occur or relying on sporadic checks or rumors. Reactive measures after a breach come too late, periodic random checks miss many events, and off-site rumor tracking is unreliable and unverified.