Exam CFR-310 topic 1 question 47 discussion

B. Review the security log on a domain controller. Explanation: The security log on a domain controller contains detailed records of authentication events and changes to user accounts and group memberships. Why the other answers are less suitable: A. Review the system log on the affected workstation: The system log focuses on system events (e.g., hardware and software issues), not user account changes or group memberships. C. Review the system log on a domain controller: Similar to the system log on the workstation, this log tracks system-level events and would not provide useful details about account changes. D. Review the security log on the affected workstation: While this may provide some local information, administrative accounts and changes in group memberships are typically controlled and logged at the domain controller level in a Windows Active Directory environment.