Log Files Show the Admin User Has Logged into a Public-Facing

Log files show the admin user has logged into a public-facing device on several occasions in the evening. None of the technicians admit to doing any after-hours work, and the password has been changed several times but failed to prevent the logins. Which of the following should be the NEXT step to attempt to harden the device?

A) Disable unused ports.
B) Reset the two-factor token.
C) Disable virtual ports.
D) Upgrade the firmware.