which two options should be collected to help remediate the problem?

After an attack has occurred, which two options should be collected to help remediate the problem?
(Choose two.)

A.
packet captures

B.
NAT translation table

C.
syslogs from affected devices

D.
connection table information

E.
NetFlow data