Which Logs Reveal Malicious Intent in Non-Secure IdP Access?

CS0-003 By islever Editorial Last updated

Given a scenario, analyze indicators of potentially malicious activity Given a scenario, use appropriate tools or techniques to determine malicious activity

Short answer

C Directory logs (Active Directory or IdP sign-in logs) expose account authentication sources, timing, and patterns needed to judge malicious intent.

Question

A SOC receives several alerts indicating user accounts are connecting to the company’s identity provider through non-secure communications. User credentials for accessing sensitive, business-critical systems could be exposed. Which of the following logs should the SOC use when determining malicious intent?
  1. DNS
  2. tcpdump
  3. Directory Correct Answer
  4. IDS

Key Takeaways

The exam tests whether you can distinguish account-centric authentication evidence from network-detection evidence; the trap is treating IDS or tcpdump as the default answer just because the alert mentions non-secure traffic.

The SOC must choose a log source to judge whether user accounts reaching the identity provider over non-secure channels are malicious. This page establishes that Directory logs, not packet captures or IDS alerts alone, provide the account authentication context needed for that decision.

Common mistake: The most common wrong answer is IDS logs because they sound purpose-built for detecting malicious activity, but they show network signatures rather than the user-account authentication patterns needed to establish intent.

Expert Analysis

Why the Answer Is Correct

Directory logs, especially Active Directory or Entra ID sign-in logs, are the account-centric record of who authenticated to the identity provider, from which IP address or device, at what time, and whether MFA or failures occurred. Because the alert is framed around user accounts and identity-provider access, these fields let the SOC correlate the non-secure connections with account behavior and decide whether the activity looks like credential misuse rather than a benign misconfiguration. Determining malicious intent requires that identity context; raw network packets or signature hits alone cannot show whether the account owner or an attacker initiated the connection. Directory logs also match the question's wording because they are an actual log source rather than a packet-capture utility.

Why the Other Options Are Wrong

DNS logs show domain-name resolution and cannot identify which user account authenticated or whether the session succeeded. Tcpdump is a packet-capture tool, not a log source; it can prove that credentials traversed the wire in cleartext, but it does not establish user intent or account behavior. IDS logs are valuable for network detections and signatures, yet they do not provide the account-level authentication context needed to decide whether an IdP connection is malicious. The question asks which logs to use when determining malicious intent for user accounts, so the network-centric options are supporting evidence at best.

Community Comment Notes

As linkmonkey239 noted, the phrase "non-secured communication" makes tcpdump attractive because readable traffic can confirm credential exposure, but that is not the same as determining malicious account intent. Susan4041 asks why the SOC would not check Directory because "these are user accounts", and Superash lists the relevant Directory fields such as login attempts, login sources, and timing patterns. Learners including zecomeia_007 and agfencer favor IDS because it is designed to detect malicious activity; the distinction is that IDS reports network behavior, while the question asks for account-level evidence to infer intent. The split shows why the item is easy to misread: non-secure traffic tempts a network-tool answer, but the identity-provider and user-account wording points to Directory logs.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a CySA+ item asks which log to use, map the log to the entity under investigation: accounts point to directory or identity-provider sign-in logs, packets to tcpdump, domains to DNS, and network exploitation to IDS. Do not let a phrase like 'non-secure communications' override the account-centric wording of the stem.

Frequently Asked Questions

Why aren't IDS logs the best source for determining malicious intent here?

IDS logs show network detections and signatures, but they do not provide the account-level authentication context—source, timing, MFA result—needed to judge whether IdP access is malicious.

Could tcpdump confirm credentials are exposed over non-secure IdP traffic?

It could capture cleartext traffic for confirmation, but tcpdump is a packet-capture tool, not an account log, and it is not the log source for determining user malicious intent.

More CS0-003 FAQ →

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. linkmonkey239 👍 13 Answered B
    tcpdump. The keyword is "non-secured communication". tcpdump allows you to analyze the "malicious intent" over a "non-secured communication" as the traffic is readable.
  2. ChopSNap 👍 5 Answered D
    D. IDS An Intrusion Detection System (IDS) is designed to monitor network traffic for malicious activity. In this case, an IDS can detect non-secure connections to the identity provider, potentially indicating malicious intent. By analyzing the traffic patterns, the IDS can provide valuable insights into the nature of the attack, such as the source IP address, the affected user accounts, and the specific vulnerabilities exploited. While DNS, tcpdump, and directory logs can provide useful information, they are not specifically designed to detect malicious intent. DNS logs can show domain resolution, tcpdump can capture network traffic, and directory logs can show user authentication attempts, but they may not provide the level of context and threat intelligence that an IDS can offer.
  3. Susan4041 👍 5 Answered C
    Why would you not check Directory these are user accounts
  4. zecomeia_007 👍 4 Answered D
    D. IDS (Intrusion Detection System) logs IDS logs are specifically designed to detect and log potentially malicious activity.
  5. Cimoooooo 👍 4
    D - IDS. Best choice for detecting Malicious activity.
Show 10 more comments
  1. cj207800 👍 3 Answered D
    IDS logs (Intrusion Detection System) are specifically designed to detect and log suspicious network activity, such as attempts to exploit non-secure channels. IDS can flag when sensitive data (like credentials) are transmitted insecurely or when known attack patterns are detected over the network.
  2. Superash 👍 2 Answered C
    Directory logs (such as Active Directory or Azure AD) contain: • Login attempts (success/failure) • Login sources (IP address or device) • Timing of attempts and their patterns
  3. kmicic77 👍 1 Answered C
    The alert is about user accounts authenticating to the identity provider (IdP) over an insecure channel. To judge whether those connections are benign (misconfiguration) or part of an attack, the SOC needs to see who logged in, from where, how often, with what result, and over which protocol—all of which are captured in directory/IdP logs (e.g., Active Directory, Azure AD)
  4. agfencer 👍 1 Answered D
    The core of the question asks what log source the SOC should use when determining malicious intent behind connections utilizing unsecure communication protocols. Intrusion Detection System (IDS) logs explicitly inspect network traffic payloads and behaviors for known IoC's, exploit signatures or malicious network patterns so its D. IDS
  5. JayWeston 👍 1
    I have never heard of Active Directory being shortened to directory. When I googled directory logs the AI overview did talk about directory logs as a thing, but when going to the source documentation the only referenced was active directory logs. This seems like an AI hallucination.
  6. Pochex 👍 1 Answered D
    An IDS log can identify suspicious authentication patterns, or other indicators that user credentials are being intercepted or abused.
  7. JayWeston 👍 1
    The exam question asks about non-secure communications not malicious activity.
  8. ybyttv 👍 1
    then authentication may not necessary happen on AD or windows system
  9. c4cc596 👍 1
    The last thing it asks about is malicious intent
  10. 1chung 👍 1 Answered B
    I go with B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide