Which of the following represent the BEST immediate actions to prevent unauthorized server access?

A large number of connections to port 80 is discovered while reviewing the log files on a server. The server is not functioning as a web server .

Which of the following represent the BEST immediate actions to prevent unauthorized server access? (Choose two.)
A . Audit all group privileges and permissions
B . Run a checksum tool against all the files on the server
C . Stop all unneeded services and block the ports on the firewall
D . Initialize a port scan on the server to identify open ports
E . Enable port forwarding on port 80
F . Install a NIDS on the server to prevent network intrusions

Answer: A,D