100-160 Question 156
Select 3A cybersecurity analyst is investigating a suspected malware infection on a Windows server. They open the Event Viewer and notice a large number of failed login attempts followed by a successful administrator login from an unfamiliar IP address. Which logs should the analyst examine next to gather more information about the potential threat?
- A
Security logs to review authentication and access-related events
- B
System logs to check for hardware or system-level errors
- C
Application logs to identify anomalies in application behavior
- D
Syslog from network equipment to trace the source IP address
- E
Audit logs to verify changes to user permissions or configurations
Show answer and explanation
Correct answers: A, D, E
Explanation
In this scenario, the analyst should focus on logs that provide insights into the failed login attempts, the suspicious administrator login, and the unfamiliar IP address. Security logs will help understand the authentication behavior, syslog will trace the source IP address, and audit logs will reveal if any sensitive changes were made after the successful login. Together, these logs provide a comprehensive view of the potential threat.
- A. Correct.
Security logs in the Event Viewer are critical for tracking authentication attempts, successful logins, and unauthorized access attempts. These logs are essential for investigating the failed login attempts and subsequent successful administrator login.
- B. Incorrect.
System logs focus on system-level events such as hardware issues or system crashes. While they may provide some context, they are not directly relevant to analyzing authentication anomalies or tracing the source of the threat.
- C. Incorrect.
Application logs record the behavior of specific applications but are less relevant for investigating failed login attempts or suspicious administrator logins. They are not the primary source for this scenario.
- D. Correct.
Syslog captures event data from network devices such as routers, switches, or firewalls. Examining syslog can help trace the unfamiliar IP address back to its origin, providing more context for the investigation.
- E. Correct.
Audit logs provide detailed records of changes to system configurations, user permissions, and sensitive operations. These logs can reveal if the administrator account was compromised and used to modify permissions or settings.