Determining Phishing Link Success via Log Sources

Answer Correct answer: A — Network logs provide the necessary evidence to determine if the connection to the malicious site was successful.

An analyst is reviewing an incident in which a user clicked on a link in a phishing email. Which of the following log sources would the analyst utilize to determine whether the connection was successful?

  1. Network Correct Answer
  2. System
  3. Application
  4. Authentication
phishing email log sources network logs incident response sy0-601 connection verification determine connection success

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests knowledge of log categories; the trap is confusing application-level activity with network-level connectivity verification.

This question tests the ability to identify the correct log source for verifying connection success after a phishing click. Network logs are the definitive source for tracking traffic flow and connectivity status.

Candidates often select Application or Authentication logs, mistakenly believing that browser activity or login attempts are the primary indicators of whether the initial TCP/IP connection was established.

Community Discussion (6 comments)

Yomzie 👍 16
Hint:: A phishing link in an email leads you where? A URL. A malicious site. Where do you find info about your Internet visits and browsing history? Answer:: Network Logs.
johnabayot 👍 9 Selected: A
Network log sources can show the traffic between the user's device and the phishing website, such as DNS queries, the IP addresses, the port, and the protocols. Network logs can also reveal if the connection was blocked by a firewall or other security tools.
salah112 👍 2 Selected: A
A. Network To determine whether the connection resulting from a user clicking on a link in a phishing email was successful, the analyst would typically review network logs. Network logs provide information about network traffic, connections, and communication between systems. By analyzing network logs, the analyst can identify if the user's system made a successful connection to an external server or if there were any unusual or malicious activities.
dfc6822 👍 1
A. Network To determine whether the connection was successful after a user clicked on a link in a phishing email, the analyst would typically utilize network logs. Network logs can provide information on connections, traffic, and communication between the user's system and external servers or websites.
Hs1208 👍 2 Selected: D
D. HVAC HVAC systems play a crucial role in maintaining appropriate temperature and humidity levels in data centers and other facilities housing IT equipment.
Hs1208 👍 1 Selected: A
A. Network

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Network logs are the appropriate source because they record data regarding traffic flow, including DNS queries, IP addresses, ports, and protocols. By reviewing these logs, an analyst can determine if the user's device successfully communicated with the malicious external server, regardless of what happened at the application layer. This aligns with standard incident response procedures where network telemetry is the first line of evidence for connection validation.

Why the Other Options Are Wrong

Application logs (Option C) typically focus on software behavior, errors, or specific actions within an app, but may not capture the underlying network handshake if the application failed to launch or was blocked. Authentication logs (Option D) only show if credentials were presented and verified; a successful connection does not require authentication, so these logs might be empty even if the link worked. System logs (Option B) generally track OS events like startup/shutdown or file access, which are less direct for verifying network reachability than network-specific logs.

Community Comment Notes

Community members consistently point out that network logs provide visibility into traffic between the device and the phishing site. One commenter noted that network logs reveal if a connection was blocked by a firewall, emphasizing their utility in determining success or failure of the link. Another user highlighted that browsing history and URL visits are tracked at the network level, reinforcing why Option A is the best choice.

Official Reference

Exam Strategy

When asked about 'connection' success or traffic flow, always prioritize Network logs over Application or System logs. Remember that 'successful connection' refers to the establishment of communication channels (TCP/UDP), which is a network-layer function.

Frequently Asked Questions

Why not use Application logs?

Application logs track software events, but network logs directly show if the device reached the server, which is the core requirement.

Do I need DNS logs specifically?

DNS is part of network activity. General network logs often encompass or correlate with DNS query results to show resolution and connection.

Related Analysis

A security manager is implementing MFA and patch management.

S-Grade

A security analyst is responding to a malware incident at a

S-Grade

An accounting intern receives an invoice via email from the

A-Grade

← Back to SY0-601 Study Guide