A control-plane change appears just before application errors begin. What should the analyst conclude initially?

1. Treat the timing as a hypothesis and correlate configuration and runtime evidence.
2. The earlier event is automatically the sole cause.
3. Delete unrelated logs before establishing the incident scope.
4. Audit records make application traces unnecessary in every incident.