Which of the following is the MOST important reason for logging firewall activity?

The correct answer is D. Incident investigation. Firewall logs are the most critical evidentiary source during a security incident. They provide a detailed record of network traffic-what was allowed, what was blocked, source and destination addresses, timestamps, and protocols-that investigators use to reconstruct attack…

Submitted by kev92· Apr 18, 2026Information Security Incident Management

Question

Options

AMetrics reporting
BFirewall tuning
CIntrusion prevention
DIncident investigation

How the community answered

(31 responses)

A
3% (1)
B
10% (3)
C
3% (1)
D
84% (26)

Explanation

Firewall logs are the most critical evidentiary source during a security incident. They provide a detailed record of network traffic-what was allowed, what was blocked, source and destination addresses, timestamps, and protocols-that investigators use to reconstruct attack timelines, identify compromised systems, and determine the scope of a breach. While metrics reporting (A), firewall tuning (B), and intrusion prevention (C) are valid uses of firewall logs, incident investigation is the most important because it directly supports the organization's ability to detect, respond to, and recover from security events-core functions of an information security program.

Topics

#Firewall logging#Incident investigation#Security operations

Community Discussion

No community discussion yet for this question.

Full CISM Practice