One view of intrusion detection systems is that they should be of value to an analyst trying to disprove that an intrusion has taken place. Insurance companies and lawyers, for example, would find such evidence invaluable in assessing liability. Consider the following scenario. A system has both classified and unclassified documents in it. Someone is accused of using a word processing program to save an unclassified copy of a classified document. Discuss if, and how, each of the three forms of intrusion detection mechanisms could be used to disprove this accusation.

You have been supporting csm tech publishing's windows server 2016 server network for over a year. the office has two windows server 2016 servers running active directory and a number of other roles. management has informed you that a small sales office is opening in the same building three floors up. the sales manager wants to install a sales application on a server located in the sales office. this server will have limited physical security because there's no special room dedicated for it, which means it will be accessible to non-it personnel and visitors. you're considering installing windows server 2016 server core on the new server because accessing its console regularly probably won't be necessary, and this server will be managed from one of the other csm tech publishing servers. what are the benefits and drawbacks of using server core for this branch office? what are some things you should do to set up this server management environment?