Which of the following policies would state an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?

An analyst is investigating an anomalous event reported by the SOC. After reviewing the system logs the analyst identifies an unexpected addition of a user with root-level privileges on the endpoint. Which of the following data sources will BEST help the analyst to determine whether this event constitutes an incident?

A security analyst suspects a malware infection was caused by a user who downloaded malware after clicking Error! Hyperlink reference not valid. in a phishing email.
To prevent other computers from being infected by the same malware variation, the analyst should create a rule on the .

A security analyst is supporting an embedded software team. Which of the following is the BEST recommendation to ensure proper error handling at runtime?

A Chief Information Security Officer (CISO) is concerned the development team, which consists of contractors, has too much access to customer data.
Developers use personal workstations, giving the company little to no visibility into the development activities.
Which of the following would be BEST to implement to alleviate the CISO's concern?