ExamworthyExamworthy
Open the appStart free

SY0-701 - Security Operations - Section 4.9

Given a scenario, use data sources to support an investigation.

Use log data, firewall logs, packet captures, metadata, and vulnerability scan results to reconstruct an incident timeline and establish its scope. Select packet captures when full session content is needed, and metadata or firewall logs when only connection records are available or full capture is impractical.

log datafirewall logspacket capturesmetadatavulnerability scans

Practice question for this objective

Free sampleSecurity Operationsmedium

A security analyst at a regional law firm is investigating a suspected data exfiltration incident in which a paralegal's workstation may have uploaded client documents to an external service over an encrypted channel during the previous night. The endpoint detection agent shows that a browser process was active during the suspect window, but the analyst needs to confirm the destination IP addresses, the volume of bytes transferred, and the duration of each outbound session without relying on a full packet capture that the firm does not collect at this site. Which data source should the analyst consult first to recover that information?

  • AThe perimeter firewall connection logs covering the suspect window, filtered by the workstation's source IP address. Correct
  • BThe Windows security event log on the workstation, filtered for logon and logoff events in the suspect window.
  • CThe latest authenticated vulnerability scan report for the workstation showing missing patches and weak configurations.
  • DThe endpoint antivirus quarantine log for the workstation covering the previous twenty-four hours.
Recognise that firewall connection logs are the primary data source for reconstructing outbound flow destinations, volumes, and durations when packet captures are not available. Stateful firewalls record one entry per flow with source and destination addresses, ports, byte counters, and timestamps for session start and end. That metadata is exactly what is needed to characterise an exfiltration attempt over an encrypted channel, even though it does not reveal payload contents, which is why firewall logs are routinely the first stop in this kind of investigation.

Why A is correct: Firewall connection logs record source and destination IP addresses, ports, byte counts, and session duration for each flow, so they directly answer the destinations, volume, and duration questions even when full packet payloads are not captured.

Why B is wrong: Logon and logoff events confirm who was signed in but they do not record outbound destinations, byte counts, or session duration, so they cannot answer any of the three specific questions the analyst needs to close out.

Why C is wrong: A vulnerability scan describes the host's exposure at a point in time but it captures no flow records, so it cannot tell the analyst which destinations were contacted or how much data left the workstation.

Why D is wrong: Quarantine logs only list files the antivirus detected and isolated; they do not record network destinations, byte volumes, or session timing, so they cannot reconstruct the outbound activity the analyst is trying to verify.

See more SY0-701 practice questions, answers explained.

More in this domain

Back to all Security Operations objectives, or the SY0-701 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.