A security administrator needs to determine which system a particular user is trying to login to at various times of the day. Which of the following log types would the administrator check?

Firewall logs record network traffic flow information such as source/destination IPs and ports but do not track user identity or login events at the application or OS level.

Application logs capture events specific to a given application's operation and errors but do not provide a centralized view of user login attempts across multiple systems.

IDS (Intrusion Detection System) logs record detected anomalies and potential attack signatures in network traffic, not individual user authentication activity.

Security logs (also called security audit logs or Windows Security Event logs) specifically record authentication events such as logon attempts, logon failures, and the target resource or system involved, making them the definitive source for identifying which systems a user is attempting to access and at what times.