A legal hold is a process by which an organization instructs its employees or other relevant parties to preserve specific data for potential litigation. A legal hold is triggered when litigation is reasonably anticipated, such as when law enforcement officials inform an organization that an investigation has begun. The first step the organization should take is to initiate a legal hold to ensure that relevant evidence is not deleted, destroyed, or altered. A legal hold also demonstrates the organization's good faith and compliance with its duty to preserve evidence.

Reviewing video from IP cameras within the facility would be the most likely process to expose an attacker who has compromised an air-gapped system. Since air-gapped systems are isolated from external networks, an attacker would need physical access to the system or use some covert channel to communicate with it. Video surveillance could reveal any unauthorized or suspicious activity within the facility that could be related to the attack. Verified Reference:
https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf
https://en.wikipedia.org/wiki/Air-Gap_Malware
https://www.techtarget.com/searchsecurity/essentialguide/How-air-gap-attacks-challenge-the-notion-of-secure-networks

Step by Step Explanation:
* A: Randomizing the keypad reduces the risk of shoulder-surfing attacks by eliminating predictable patterns.
* C: Randomization increases the cognitive load on users, making it harder to input numbers quickly.
* D: Additional computational power is minimal and not typically a trade-off.
* E and F: Remembering access numbers or weak passwords are unrelated to keypad randomization.
Reference: CASP+ Exam Objectives 3.4 - Evaluate usability and security trade-offs in design.