Câu 15: Certified Platform Identity and Access Management Architect

Northern Trail Outfitters (NTO) believes a specific user account may have been compromised. NTO inactivated the user account and needs to perform a forensic analysis and identify signals that could indicate a breach has occurred. What should NTO’s first step be in gathering signals that could indicate account compromise?

1. A. Download the Identity Provider Event Log and evaluate the details of activities performed by the user.
2. B. Download the Login History and evaluate the details of logins performed by the user. — đáp án hiện tại
3. C. Download the Setup Audit Trail and review all recent activities performed by the user.
4. D. Review the User record and evaluate the login and transaction history.