An administrator needs to determine who changed a directory role assignment. Which log category is the most direct starting point?

1. Directory audit logs
2. Only application response-time metrics
3. Only VM boot screenshots
4. Only DNS query logs