CAS-003 Question #908: Real Exam Question with Answer & Explanation

An organization's email filler is an ineffective control and as a result employees have been constantly receiving phishing emails. As part of a security incident investigation a security analyst identifies the following: 1. An employee was working remotely when the security alert was triggered 2. An employee visited a number of uncategorized internet sites 3. A doc file was downloaded 4. A number of files were uploaded to an unknown collaboration site Which of the following controls would provide the security analyst with more data to identify the root cause of the issue and protect the organization's information during future incidents?