A security administrator suspects that an employee has altered some fields within a noSQL database. Which of the following should the security administrator do to
confirm the suspicion and identify the employee?

A.
Review the video of the employee’s workstation.

B.
Review the database access log files.no

C.
Capture a system image of the entire server.

D.
Generate file hashes of the database to compare to the last version.