Question

A security analyst is building a server profile for a newly deployed application server so that future deviations can be detected. The analyst has already documented the server's listening ports and its set of critical running processes. To complete a thorough server profile per common profiling guidance, which additional element should the analyst document?

Accepted Answer

The service accounts and user accounts that normally interact with the server

Answer

The total throughput baseline observed across the network segment

Answer

The address space of all subnets used across the enterprise

Answer

The typical session duration of user connections traversing the perimeter firewall