For which of the following security architecture areas should the administrator recommend review and modification?

A security administrator determines several months after the first instance that a local privileged user has been routinely logging into a server interactively as “root” and browsing the Internet. The administrator determines this by performing an annual review of the security logs on that server.

For which of the following security architecture areas should the administrator recommend review and modification? (Select TWO).
A . Log aggregation and analysis
B . Software assurance
C . Encryption
D . Acceptable use policies
E . Password complexity
F . Network isolation and separation

Answer: A,D