200-201 Question 97
Single answerA security analyst is investigating an incident using data collected from various tools. Which of the following technologies provides logs about network traffic that includes source and destination IP addresses, protocols, and port numbers?
- A
Firewall
- B
Endpoint Detection and Response (EDR)
- C
SIEM (Security Information and Event Management)
- D
Intrusion Detection System (IDS)
Show answer and explanation
Correct answer: A
Explanation
Firewalls are designed to monitor and control network traffic. They generate logs containing essential details such as source and destination IP addresses, protocols, and port numbers, which are crucial for investigating network-related incidents. While other tools like EDR, SIEM, and IDS are essential for security, they do not provide the same type of detailed network traffic logs as a firewall.
- A. Correct.
Firewalls generate logs containing detailed network traffic data including source and destination IP addresses, protocols, and port numbers. These logs are valuable for monitoring and incident investigation purposes.
- B. Incorrect.
EDR primarily focuses on endpoint activity, such as file changes, process executions, and registry modifications. While it provides critical security data, it does not directly provide network traffic logs.
- C. Incorrect.
SIEM aggregates and correlates data from various sources, but it does not independently generate network traffic logs. It relies on input from other tools, such as firewalls, for network data.
- D. Incorrect.
IDS monitors network traffic for malicious activity or policy violations. While it detects and alerts on suspicious traffic, it does not typically generate detailed traffic logs like a firewall does.