Northern Trail Outfitters (NTO) believes a specific user account may have been compromised.

When an account may be compromised, the first Salesforce-native source to review is Login History. It shows authentication attempts, source IP addresses, login status, browser and platform information, and the methods used to access the org. That makes it the most direct starting point for identifying suspicious access patterns or confirming when and how a user session was established. Setup Audit Trail tracks administrative configuration changes, not end-user sign-in behavior, and the user record itself doesn’t provide the same detailed authentication trail. In a forensic workflow, the early question is usually “did someone log in, from where, and by what method?” Login History is the fastest place to answer that inside Salesforce. This is why option B is the best answer in Salesforce terms.