A UNIX server recently had restricted directories deleted as the result of an insider threat. The root account was used to delete the directories while logged on at the
server console. There are five administrators that know the root password. Which of the following could BEST identify the administrator that removed the restricted
directories?

A.
DHCP logs

B.
CCTV review

C.
DNS logs

D.
Network traffic