An external forensics investigator has been hired to investigate a data breach at a large enterprise with numerous assets. It is known that the breach started in the perimeter network and moved to the sensitive information, generating multiple logs as the attacker traversed through the network. Which of the following will best assist with this investigation?

A. Perform a vulnerability scan to identify the weak spots.

B. Use a packet analyzer to investigate the NetFlow traffic.

C. Check the SIEM to review the correlated logs.

D. Require access to the routers to view current sessions.





 

Correct Answer: C

This question is in SY0-601 exam
For getting CompTIA Security+ certificate