Your corporate security policy requires that a user performing attacks must have limited network
access and activities until an administrator can investigate.
In the admin GUI, which sensor event policy action must you configure in “Configuration” >
“Sensors” > “Sensor Event Policies” > [rule name] to accomplish this?
A.
Ignore
B.
Replace user’s role
C.
Terminate user session
D.
Disable user account