For a microservices architecture, the most effective way to understand data movement between components is through data flow diagrams (DFDs). DFDs clearly show inputs, outputs, processes, and data stores, helping auditors trace data movement across distributed services.
Option A: Correct - DFDs highlight application inputs/outputs.
Option B: Network diagrams show infrastructure but not logical data flows.
Option C: Business requirements document functional needs, not technical flows.
Option D: ER diagrams describe database structures, not process flows.

The first step in such an investigation should be to ensure evidence is preserved. This is critical for maintaining the integrity of the investigation and ensuring that the evidence remains admissible in a legal context. Preserving evidence includes securing transaction logs, system data, and any other relevant information in a forensically sound manner to prevent tampering or loss.

The central goal of DLP is to prevent sensitive data-such as PII, PHI, or intellectual property-from leaving the organization through unauthorized channels. DLP solutions monitor, detect, and block potential data exfiltration via email, endpoints, cloud applications, or removable media. While compliance (D) is often a driver, it is a secondary outcome of implementing DLP. Enhancing performance (A) and recovery automation (B) are not objectives of DLP. ISACA positions DLP as a critical control for confidentiality under DSS05 (Managed Security Services).