Which of the following network vulnerability scan indicators BEST validates a successful, active scan?

A security administrator is investigating many recent incidents of credential theft for users accessing the company's website, despite the hosting web server requiring HTTPS for access. The server's logs show the website leverages the HTTP POST method for carrying user authentication details.
Which of the following is the MOST likely reason for compromise?

An administrator needs to implement a connection to a supplier for confidential order processing and also provide a method for support engineers in the field to connect to the ERP. Which of the following should the administrator implement?

A security analyst investigate a report from an employee in the human resources (HR) department who is issues with Internal access. When the security analyst pull the UTM logs for the IP addresses in the HR group, the following activity is shown:
Which of the following actions should the security analyst take?

An attacker exploited a vulnerability on a mail server using the code below.

Which of the following BEST explains what the attacker is doing?