A security analyst has identified a potential incident involving unauthorized access to an organization's database. What aspect of the incident should the analyst focus on when determining the scope of the incident?
a. The type of access gained unselected
b. The location of the database unselected
c. The time when the access occurred unselected
d. The identity of the attacker