Logging and monitoring · Question 9 of 12
Which log sources are particularly valuable for detecting attacks?
3 answers are correct. Medium
Show answer
Answer
- B Events from endpoint protection systems
- D Logs from firewalls and proxies
- E Login logs from directory services
Explanation
Logins reveal account misuse, firewall and proxy logs reveal unusual connections, and endpoint systems report suspicious processes. Combined in the SIEM, they produce a picture of the attack. Which sources matter depends on your own risks.