Following a cyberattack at a financial institution in Chicago, Illinois, investigators are overwhelmed by repeated...

The correct answer is A because the step described is log and event reduction before correlation, which focuses on decreasing noise by filtering, compressing, or removing duplicate information. In the CHFI v11 blueprint, event correlation and event deconfliction are specifically listed under image and evidence examination, and that includes preparing data so analysts can identify meaningful patterns without being distracted by repetitive or irrelevant entries. Option B refers more to centralization or aggregation of logs, which can be useful, but it does not directly describe the action of reducing repeated entries. Option C concerns secure transmission and integrity protections during collection, which is unrelated to the analytical problem described. Option D points to normalization, where logs from different systems are transformed into a common structure, but the question is focused on reducing alert duplication and noise. From a forensic operations perspective, this preprocessing step improves the quality of later correlation by trimming the data to what matters most. That is why the best answer is the choice describing filtering, compression, and deletion of repeated entries.