ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 305 - SY0-701 discussion

Report
Export

A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?

A.
IPS
Answers
A.
IPS
B.
Firewall
Answers
B.
Firewall
C.
ACL
Answers
C.
ACL
D.
Windows security
Answers
D.
Windows security
Suggested answer: B

Explanation:

Since the logs on the endpoint were deleted, the next best option for the analyst is to examine firewall logs. Firewall logs can reveal external communication, including outbound traffic to a command-and-control (C2) server. These logs would contain information about the IP addresses, ports, and protocols used, which can help in identifying suspicious connections.

IPS logs may provide information about network intrusions, but firewall logs are better for tracking communication patterns.

ACL logs (Access Control List) are useful for tracking access permissions but not for identifying C2 communication.

Windows security logs would have been ideal if they had not been deleted

asked 02/10/2024
DATA 7 DATA7
41 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first