Comp TIA Security + Certification Questions Part 3

A security administrator suspects that data on a server has been exhilarated as a result of un- authorized remote access.
Which of the following would assist the administrator in con-firming the suspicions? (Select TWO)