A security analyst must identify which principal changed an OCI resource through the control plane. Which evidence should be examined first?

1. Relevant OCI Audit events
2. Only the application's final HTTP response body
3. The total number of available compute shapes
4. Only the object's current display name