Which of the following is the BEST resource to use to start the investigation?

exams CLO-002 CLO-002 exam 0 Comments

An incident response team requires documentation for an email phishing campaign against a company’s email server.

Which of the following is the BEST resource to use to start the investigation?
A . Audit and system logs
B . Change management procedures
C . Departmental policies
D . Standard operating procedures

Answer: A