Which step should be taken at this stage?

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze.

Which step should be taken at this stage?
A . Determine the assets to which the attacker has access
B . Identify assets the attacker handled or acquired
C . Change access controls to high risk assets in the enterprise
D . Identify movement of the attacker in the enterprise

View Answer

Answer: D