Which data is the most useful to determine if a network attack was occurring from inbound Internet t

Which data is the most useful to determine if a network attack was occurring from inbound Internet
traffic?

A.
syslogs from all core switches

B.
NetfFow data from border firewall(s)

C.
VPN connection logs

D.
DNS request logs

E.
Apache server logs