At a university, a service account has an interactive session on a research server where that account has never logged on, and the listening ports are unchanged. Which server-profile element changed?
Select an answer to reveal the explanation.
Short Explanation
The change is who has an interactive session, not which doors are open. You record a service account in a new interactive session under logged-on users and service accounts. The listening ports stayed the same; campus traffic volume and the disk-image sign-out record describe different things.
Full Explanation
A server profile tracks logged-on users and service accounts as well as listening ports. An interactive session for a service account that has never logged on to this research server is a change in logged-on users and service accounts. The listening ports are unchanged, so “Logged-on users and service accounts, including a new interactive session for that service account” describes the changed element. “Listening ports, the TCP and UDP sockets the research server currently has open for clients” would apply if a socket opened or closed, but the scenario says the ports did not change. “Total throughput, the volume of traffic the research server moved across the campus during the window” describes network traffic volume, not the identity of a session on the host. “Chain of custody, the handwritten record of who handled a disk image taken from that server” documents evidence handling; no image or handoff is part of this change. Exam caveat: service accounts belong in the logged-on user picture of the server profile, even when they are assumed to be non-interactive. Practical check: compare current interactive sessions with the server baseline, confirm that this service account was not supposed to log on interactively, and record the session’s time and source.