Q: 13
Why is the timeline view useful during investigations?
Options
Discussion
Really clear question, nice. A is right since the timeline helps see each event in order, making it easier to piece together how the attack unfolded. Pretty sure that's what most exam reports say too.
Its D doesn’t sound right since grouping alerts is different from seeing them in order. I think A makes more sense because timeline view is about connecting events step by step. Not 100% sure though, somebody else agree?
Be respectful. No spam.
