CompTIA Cloud Essentials CLO-002 – Question067

An incident response team requires documentation for an email phishing campaign against a company's email server. Which of the following is the BEST resource to use to start the investigation?

A.
Audit and system logs
B. Change management procedures
C. Departmental policies
D. Standard operating procedures

Correct Answer: A