Overnight, someone unplugged a storage array inside a badge-controlled server room. A contractor is suspected, but the contractor says they never entered the room. Which data sources should the investigator use to confirm or refute the contractor's statement?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a building's guest book plus a security camera: the badge reader says which card opened the door and when, and the footage shows whose hand was holding it. The trap is reaching for network logs, but you can't unplug a cable over the network, so you need physical evidence for a physical act.
Full Explanation
The question is whether a person physically entered a room, so the evidence must come from physical access controls. Badge reader logs are physical access and accounting records: they show which credential opened the server room door and at what time. Surveillance footage covering the same doorway corroborates that record and shows who actually walked in, which matters because a badge can be borrowed, cloned, or tailgated. Together the two sources place a specific person at the door at the time the array went offline. Firewall logs and NetFlow describe network conversations between hosts; they cannot show a person pulling a cable, and an unplugged array produces no flow at all. Domain controller and VPN records are logical authentication data; they show that an account logged on somewhere, not that a body stood in a room, and the contractor could be on site without any VPN session. Vulnerability scan reports and patch dashboards describe weaknesses and patch status, which says nothing about who was present. Exam caveat: physical logs alone are weaker than physical logs plus footage, because a badge record identifies a card, not a person. Operational check: export the door controller's events for the incident window, synchronize timestamps with the camera recorder, and confirm whether the contractor's badge and image both appear.