Suppose an attacker intrudes upon one of your servers. How do you reconstruct the events of a crime? Log files are the first place to check for administrative issues and security activity. Log files help you put together a timeline of events surrounding everything from a performance problem to a security incident.

Check the explanation

Explanation:

Checking for any anomalies from baseline behavior or identifying certain suspicious actions on your network are some of the ways to identify bad system or porous network activities. A testing guarantees that your control and monitoring facilities executes task as intended and maintain proper operation.

Monitoring also ensures that you capture proofs and data when your testing process and procedures fail to observe all possibilities or when legitimate behavior permits unallowed activity.

Always believe the fact that even legitimate traffic can be utilized in illegitimate ways and, sometimes, legitimate traffic can become illegitimate through its mode of usage. Services that are protected can be attacked internally or accessed externally via the loopholes in firewall rules.

answer; one person; monarch;