Connecting authentication and file-access evidence
A fictional device provides these records:
| Time | Event |
|---|---|
| 09:10 | Account analyst7 successfully logged in |
| 09:12 | Account analyst7 opened a restricted report |
Which conclusion best reflects both records and their limits?
A
The report was opened before the recorded login.
B
A successful login proves that every subsequent action was authorized.
C
The account authenticated and then accessed the report; additional evidence is needed to establish who controlled it and whether the activity was authorized.
D
The records prove that the employee assigned that account personally stole the report.
Question Leaderboard
Not enough data yet to show leaderboard.