SY0-701 Question 23

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D: User's laptop is the Endpoint that SIEM has raised an alert against. Application log is potentially available if the Admin can connect to the end-point and see the executable's run log (if any)

• Chose D2

  Correct anwser is: D This is because the question starts out by saying the analyst was research network logs within the SIEM, and not a host's logs. If the analyst was searching host logs, and the host was a Windows machine, then Application logs would be the correct answer. If the host was a Linux machine, it would be the Syslog/Journald or explicit application logs within /var/log. So since the question is very open ended on this portion, and typically a SIEM will collect endpoint device logs also. You would search the endpoint logs within the SIEM for the appropriate application log entries of the host(s).

• Chose D3

  Endpoint logs: Endpoint logs, also known as host logs, record events and activities that occur on individual endpoints (such as laptops, desktops, or servers). These logs can include information about processes, applications, system events, user logins, file accesses, and more. Endpoint logs are a valuable source of data for investigating security incidents on specific devices, including information about the executables running on the machine. For the investigation described in the scenario, the most appropriate data source for obtaining additional information about the executable running on the employee's corporate laptop is Endpoint logs. Endpoint logs can provide detailed insights into the processes and executables running on the machine, helping the security analyst to further analyze and respond to the potential security threat.