nerdexam
CompTIA

SY0-701 · Question #1

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data…

The correct answer is D. Endpoint. Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee's corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the…

Submitted by salim_om· Mar 6, 2026Security Operations

Question

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

Options

  • AApplication
  • BIPS/IDS
  • CNetwork
  • DEndpoint

How the community answered

(20 responses)
  • A
    5% (1)
  • C
    5% (1)
  • D
    90% (18)

Explanation

Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee's corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the security analyst to understand the behavior of the executable and its potential impact on the system and

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-701 Practice