During a corporate insider threat investigation at a tech company in New York, forensic analysts...

The correct answer is B because Windows defines Interactive logon as the type used when a user logs on locally at the computer by entering credentials at the keyboard. Microsoft’s auditing documentation lists Logon Type 2 as Interactive and explains that it is used for local logons at the system console. That matches the question exactly. Network logon refers to remote resource access over the network, Service logon is used by service accounts, and Batch logon is associated with scheduled or batch job execution. CHFI v11 includes types of logon events and event-log analysis, so candidates are expected to identify the proper Windows logon type from the behavior described. In forensic timeline reconstruction, distinguishing interactive logons from network or service activity is important because it helps determine whether a person was physically present at the machine or whether access occurred indirectly. Since the user entered credentials locally with no network involvement, the correct logon type is Interactive. ( learn.microsoft.com )