A server records a successful login by an authorized employee during normal working hours. Based on the course distinction, what is this most clearly?

### Why this is right A login is observable activity, so it is a security event. Nothing in the scenario shows harm, unauthorized access, or a credible threat that requires incident handling. ### The concept Security monitoring produces many events, including routine logins, blocked connections, and configuration changes. An incident is an event or combination of events that actually or potentially threatens information or systems and therefore needs investigation or response. Analysts assess context, not just the presence of an event. A normal login from an expected account and device may remain routine; a login followed by unusual access to sensitive files could justify escalation. ### The other options - **B. A confirmed data breach**: A breach requires evidence of unauthorized access or disclosure, which is absent here. - **C. An eradication action**: Eradication removes a threat or its cause after an incident has been identified. - **D. A recovery validation**: Recovery validation checks that restored systems and data are safe and functional. ### Terms - **Security event**: Observable activity involving a computer, network, account, application, or data. - **Incident**: An event or set of events that causes or may cause harmful security impact. ### Remember An event is an observation; an incident is an observation that merits response because of actual or potential harm.