フリー問題

問題文

During the investigation of an account compromise, why is the sign-in history of that account examined before its mailbox rules?

選択肢

1. Because the history shows whether the account was properly enrolled by the tenant, which decides whether the rest of the data is available.
2. Because the history shows whether the account was ever audited by the reviewer, which decides whether the rest of the log is trusted.
3. Because the history shows whether the account was newly created by an administrator, which decides whether the rest of the team is involved.
4. Because the history shows whether the account was actually used by someone else, which decides whether the rest of the work is needed at all.