SY0-701 Question 398
Single answerLog data: Firewall logs , Application logs , Endpoint logs , OS-specific security logs , IPS/IDS logs , Network logs , MetadataA security analyst is investigating a suspected data exfiltration incident from a finance application server. The firewall shows several large outbound HTTPS sessions from the server to an unfamiliar external IP late at night. However, the application team states that the finance application normally uses HTTPS for legitimate API calls, and the firewall logs do not show the requested URLs or file names. Which log source would provide the most useful additional evidence to determine whether sensitive files were actually compressed and staged for exfiltration on the server before the outbound connections occurred?
- A
Endpoint logs from the server showing process execution, file access, and command-line activity
- B
Network flow logs from the core switch showing source and destination IP addresses, ports, and byte counts
- C
IPS/IDS alerts showing signature matches for known malware communicating over HTTPS
- D
Application access logs from the finance application showing successful user logins and API requests
Show answer and explanation
Correct answer: A
Explanation
The best answer is endpoint logs because the question asks for evidence that files were compressed and staged on the server before exfiltration. Firewall logs and network logs are valuable for identifying suspicious outbound connections, but they primarily provide network metadata rather than host activity. Endpoint telemetry is specifically suited to reveal process execution, file creation, archive generation, command-line usage, and other indicators of collection and staging. This aligns with common incident response practice: correlate network indicators with host-based logs to confirm the attack chain. Security teams frequently use sources such as EDR data, Microsoft Sysmon, Windows Security logs, Linux auditd, and similar endpoint logging to investigate collection and exfiltration behavior. Best practices from common security monitoring guidance, including vendor documentation for SIEM/EDR products and frameworks such as NIST incident response guidance, emphasize correlating host logs with network and firewall data to validate suspicious outbound traffic and determine scope.
- A. Correct.
Correct. Endpoint logs are the best source to confirm host-level activity that typically precedes exfiltration, such as archive creation, use of compression tools, suspicious PowerShell or shell commands, file access patterns, and execution of utilities like zip, tar, 7z, or certutil. This directly addresses whether files were staged on the server before transmission. In real environments, EDR telemetry, Sysmon logs, Linux audit logs, and similar endpoint sources are often used for this purpose.
- B. Incorrect.
Incorrect. Network flow logs are useful for validating that large data transfers occurred, when they occurred, and to which destination. However, flow logs generally provide metadata such as IPs, ports, protocols, timestamps, and byte counts rather than evidence of local file staging or compression on the host. They help quantify exfiltration but not prove host-side preparation of data.
- C. Incorrect.
Incorrect. IPS/IDS logs may help if the activity matches a known signature, anomaly, or malicious indicator. But HTTPS traffic is often encrypted, limiting payload visibility unless there is TLS inspection, and many exfiltration techniques will not trigger a known signature. IDS/IPS alerts are less reliable than endpoint evidence for proving files were compressed and staged locally.
- D. Incorrect.
Incorrect. Application logs can show whether legitimate users accessed records or whether the application initiated expected API calls, which may help with context. However, they usually do not capture operating system commands, ad hoc file compression, or staging behavior outside the application's normal logging scope. This is a common misconception when the suspected exfiltration may have occurred at the host or OS level rather than through normal application functions.