A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well-known IoT device exploit. The analyst needs to review logs to identify the time of initial…

The correct answer is C. Firewall. Firewall logs are the best starting point because IoT devices communicate over the network, and the firewall sits at the boundary where external exploit traffic first enters - capturing source IPs, destination ports, timestamps, and connection attempts that reveal the moment of…

Submitted by chen.hong· Mar 6, 2026Security operations

Question

A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well-known IoT device exploit. The analyst needs to review logs to identify the time of initial exploit. Which of the following logs should the analyst review first?

Options

AEndpoint
BApplication
CFirewall
DNAC

How the community answered

(42 responses)

A
5% (2)
B
12% (5)
C
81% (34)
D
2% (1)

Explanation

Firewall logs are the best starting point because IoT devices communicate over the network, and the firewall sits at the boundary where external exploit traffic first enters - capturing source IPs, destination ports, timestamps, and connection attempts that reveal the moment of initial compromise. Endpoint logs (A) are less useful here because many IoT devices (cameras, sensors, thermostats) run minimal or proprietary firmware that doesn't generate traditional endpoint telemetry compatible with SIEM tools. Application logs (B) would only be relevant if the exploit targeted a specific application layer service, and even then they wouldn't capture the initial network-level intrusion vector. NAC (D) logs track device authentication and network access control decisions, which could show when a device joined the network but not the exploit traffic itself.

Memory tip: Think "network first" for IoT - since IoT devices lack robust local logging, the network perimeter (firewall) is where the evidence lives. The mnemonic "IoT = I Only Trust (the) firewall" can help you remember to go to firewall logs when investigating IoT-based attacks.

Topics

#Log analysis#Incident response#IoT security#Network security

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice