CompTIA SecurityX (CAS-005) CAS-005 — Question 191

A company's internal network is experiencing a security breach and the threat actor is still active Due to business requirements, users in this environment are allowed to utilize multiple machines at the same time. Given the following log snippet: Which of the following accounts should a security analyst disable to best contain the incident without impacting valid users?