Exam CS0-002 topic 1 question 291 discussion

D. Change requests. Change requests will help the analyst determine if the addition of the user with root-level privileges was authorized or not. If there was no record of an authorized change request, it is highly likely that the event constitutes a security incident. Patching logs, threat feeds, backup logs, and data classification matrix are unlikely to provide relevant information for this specific scenario.

If there isn't a change request for the new user added with those privileges, then it's enough to be suspicious. D is the answer.

D. Change requests is the best data source to help the analyst determine whether the unexpected addition of a user with root-level privileges on the endpoint constitutes an incident. The change requests would contain information about who made the change, when it was made, and why it was made, which would help the analyst to determine if the event was authorized or not.