問題文
A user reports that a document opened from mail behaved oddly. Which step comes first in investigating this case?
選択肢
- Establish what the user actually observed and when, because the timeline anchors every later query.
- Establish how many copies the mail server delivered and where, because the spread bounds every later task.
- Establish which rule the mail service applied and why, because the policy explains every later block.
- Establish who owns the mailbox in the directory and since when, because the record names every later contact.