A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?

### Why this is right The personal laptop is an endpoint, meaning a device used to connect to a system. The scenario specifically identifies access control and endpoint protection as important for securing remote work, while suspicious activity alerts make logging and monitoring relevant to the investigation. ### The concept Access control governs who can use a system and under what conditions. Endpoint security concerns the devices that connect to organizational resources. Remote work can extend access beyond office-managed equipment, so an unprotected personal device may create a weakness. Alerts and logs can help identify unusual activity and support investigation, but the exercise does not state that the alert alone proves a breach. ### The other options - **B. Client billing procedures only**: Billing procedures matter to payment handling, but the new fact concerns device security and system access. - **C. Physical office access only**: Physical access controls concern entry to locations and do not address the laptop's security. - **D. The firm's choice of business objectives**: Business objectives guide strategy, but they do not directly address suspicious access from an endpoint. ### Terms - **Endpoint security**: Measures that protect devices, such as computers, that connect to organizational systems. - **Access control**: Rules and measures governing who can use a system or information. ### Remember When a remote device is involved, assess both the device and the access it has to organizational systems.