According to company policy, all accounts with administrator privileges should have suffix _ja. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator’s group. Which of the following actions should the security administrator take?
B. Review the security log on a domain controller. Explanation: The security log on a domain controller contains detailed records of authentication events and changes to user accounts and group memberships. Why the other answers are less suitable: A. Review the system log on the affected workstation: The system log focuses on system events (e.g., hardware and software issues), not user account changes or group memberships. C. Review the system log on a domain controller: Similar to the system log on the workstation, this log tracks system-level events and would not provide useful details about account changes. D. Review the security log on the affected workstation: While this may provide some local information, administrative accounts and changes in group memberships are typically controlled and logged at the domain controller level in a Windows Active Directory environment.