Analysts are investigating an after-hours admin login to a utility management console. Which data sources best help reconstruct that access event?
Select an answer to reveal the explanation.
Short Explanation
To reconstruct an after-hours admin hop into the utility console, follow the digital breadcrumbs: VPN and firewall logs. They show when someone connected, from where, and whether auth succeeded. Handbooks and cafeteria receipts will not narrate that login.
Full Explanation
Investigations of remote administrative access rely on relevant log data such as VPN authentication records and firewall connection logs to establish timing, source addresses, and success or failure. Non-security business artifacts like handbooks, marketing metrics, or cafeteria receipts do not reconstruct console access. Selecting appropriate log sources is foundational to Domain 4.9 investigative work.