Detailed Explanation:Access control lists (ACLs) allow administrators to fine-tune file permissions by specifying which users or groups have access to a file and defining the level of access. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Access Control Mechanisms".

When the government bans a vendor, the legal concern is sanctions-laws that restrict purchasing, using, or importing products from certain companies or countries. The general counsel's job is to ensure the organization is not violating federal restrictions, export controls, trade compliance laws, or sanctions lists such as OFAC or government procurement bans.
Security+ SY0-701 notes that legal and regulatory compliance is a critical part of risk management, especially when handling prohibited vendors or technologies. Continued use of banned devices could expose the organization to legal penalties, fines, or federal investigation.
Data sovereignty (B) refers to data storage location laws, not hardware bans. Cost of replacement (C) is an operational concern, not a legal one. Loss of license (D) typically applies to software, not network hardware.
Therefore, the general counsel's primary concern is A: Sanctions.

To enhance security for a system running an end-of-life operating system, placing the system in an isolated VLAN is the most effective approach. By isolating the system from the rest of the network, you can limit its exposure to potential threats while maintaining its functionality. This segmentation helps protect the rest of the network from any vulnerabilities in the outdated system.
* Installing HIDS (Host-based Intrusion Detection System) can help detect intrusions but won't mitigate the risks posed by an unsupported OS.
* Decommissioning may not be feasible if the system is critical.
* Encrypting the system's hard drive protects data at rest but doesn't address vulnerabilities from an outdated OS.

To determine whether data exfiltration has occurred, the most effective tool is a packet capture (PCAP).
Packet captures allow investigators to see exactly what data left the network, including file contents, payloads, headers, protocols, and destination information. PCAP files provide full-fidelity network evidence, enabling analysts to reconstruct sessions and review exfiltrated content byte-by-byte.
Security+ SY0-701 emphasizes PCAP as the gold standard for forensic network investigations, especially when dealing with:
Malware beaconing
Command-and-control (C2) traffic
Data leakage
Unauthorized transmissions
Network logs (C) provide summaries such as IP addresses, ports, and timestamps but do not show actual data contents. Metadata (B) gives descriptive information (e.g., file size, type) but not transmitted payloads.
Application logs (A) show application-level events but do not capture network data.
If the analyst needs to confidently determine if sensitive information was exported to the attacker, only packet capture provides the required depth of visibility.