Which of the following is the MOST important objective of a post-incident review?

After receiving reports latency, a security analyst performs an Nmap scan and observes the following output:

Which of the following suggests the system that produced output was compromised?

Which of the following threat classifications would MOST likely use polymorphic code?

Risk management wants IT to implement a solution that will permit an analyst to intercept, execute, and analyze potentially malicious files that are downloaded from the Internet.
Which of the following would BEST provide this solution?

Which of the following sets of attributes BEST illustrates the characteristics of an insider threat from a security perspective?