A SOC analyst using an LLM-powered copilot receives a triage summary that references 'CVE-2024-99999 (CVSS 9.8) affecting the organization's Apache version.' No such CVE exists. What quality control process should the SOC have in place to catch this?

• A.LLM copilot outputs are trustworthy if they cite specific CVE numbers, since LLMs cannot fabricate numeric identifiers, since anomaly detectors need no baseline tuning
• B.The analyst should cross-reference with internal vulnerability scanners only; external CVE databases may be outdated, because LLM triage assistants cannot hallucinate IOCs
• C.CVE hallucinations are rare and do not require a systematic QA control
• D.All CVE identifiers mentioned in LLM copilot outputs must be verified against the NVD or MITRE CVE database before being included in incident tickets or escalations