The best source for technical information needed in a network investigation is:

• A. Subject matter experts
• B. System manuals
• C. Vendor documents
• D. Public databases

Answer: (A)

Contextual, up-to-date technical knowledge from people who work with the network daily is essential in a network investigation. Subject matter experts bring hands-on experience with the exact devices, configurations, and protocols involved, enabling them to interpret logs and traffic accurately, reproduce issues, and advise on appropriate evidence collection and containment. They can account for customizations, mixed vendor environments, and unique firmware or config quirks that standard manuals don’t capture. System manuals tend to be generic and may be outdated; vendor documents are often product-focused and biased toward a single product; public databases can be incomplete or not reflect the organization’s specific setup. Therefore, tapping into subject matter experts provides the most reliable, actionable technical information for a network investigation.