100-160 Question 157
Select 3A company's security team suspects that a recent application crash might be the result of unauthorized access to the system. As a Cisco Certified Support Technician, you are tasked with investigating the issue. Which logs should you prioritize analyzing to identify potential anomalies or unauthorized activities?
- A
Application logs in the Event Viewer
- B
Audit logs related to user authentication and access
- C
System logs in the Event Viewer
- D
Firewall syslog entries
- E
Browser history logs on the affected machine
Show answer and explanation
Correct answers: A, B, D
Explanation
To investigate an application crash that might involve unauthorized access, it is essential to analyze logs that can provide relevant information. Application logs can reveal crash details, audit logs track authentication and access anomalies, and syslog entries from firewalls can expose suspicious network activities. Together, these logs provide a comprehensive view of potential unauthorized behavior. System logs and browser history are less relevant to this scenario.
- A. Correct.
Application logs in the Event Viewer can provide insights into the cause of the crash and may show unusual behavior related to the application.
- B. Correct.
Audit logs are critical for identifying unauthorized access attempts, as they track user authentication and access permissions.
- C. Incorrect.
System logs in the Event Viewer may have hardware or OS-level information but are less likely to directly indicate unauthorized access.
- D. Correct.
Firewall syslog entries can help identify suspicious network activity that may correlate with the unauthorized access.
- E. Incorrect.
Browser history logs are not typically used to investigate application crashes or system-level unauthorized access.