A security administrator suspects that data on a server has been exhilarated as a result of un- authorized remote access. Which of the following would assist the administrator in con-firming the…

Network Access Control (NAC) enforces access policies to prevent unauthorized devices from connecting to the network but does not provide forensic evidence or alerts to confirm whether data exfiltration has already occurred.

Data Loss Prevention (DLP) solutions monitor and alert on sensitive data transfers, providing direct evidence of data exfiltration by identifying unauthorized outbound data flows, destinations, and the type of data transmitted - directly confirming whether data left the environment.

Log analysis of server logs, authentication logs, and network logs provides a chronological audit trail of remote access sessions, user activity, commands executed, and data transfers, allowing the administrator to reconstruct the timeline and confirm unauthorized access and exfiltration.

File Integrity Monitoring (FIM) detects unauthorized changes or modifications to files on a host, which could indicate tampering, but does not provide evidence that data was transmitted externally or confirm exfiltration.

Host firewall rules define what traffic is allowed or blocked on a system but are a preventive control, not a detective one - reviewing rules alone does not confirm whether data was exfiltrated or provide evidence of unauthorized remote access activity.