Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA Security+ · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Firewall logs track inbound/outbound network connections, which can reveal communication attempts to the suspected command-and-control (C2) server, even if endpoint logs were deleted. These logs often include: Source/destination IPs and ports. Timestamps of blocked/allowed traffic. Protocol details (e.g., HTTP, DNS).
To add onto this, what am I going to see in the ACL? A compromised user? At least the firewall will give us information about the command-and-control servers traffic and attack vector.
While the endpoint logs themselves are deleted, the firewall logs might still provide valuable information. Firewalls typically record network traffic, including outbound connections, which could help the analyst identify the destination of the suspicious communication. By examining the firewall logs, the analyst might be able to determine the IP address of the command-and-control server and gather other relevant information about the incident.