A SOC analyst using an LLM-powered copilot receives a triage summary that references 'CVE-2024-99999 (CVSS 9.8) affecting the organization's Apache version.' No such CVE exists. What quality control process should the SOC have in place to catch this?

• A.The analyst should cross-reference with internal vulnerability scanners only; external CVE databases may be outdated
• B.LLM copilot outputs are trustworthy if they cite specific CVE numbers, since LLMs cannot fabricate numeric identifiers
• C.All CVE identifiers mentioned in LLM copilot outputs must be verified against the NVD or MITRE CVE database before being included in incident tickets or escalations
• D.CVE hallucinations are rare and do not require a systematic QA control