Determining Phishing Link Success via Log Sources

SY0-601 By islever Editorial Last updated

Short answer

A Network logs provide the necessary evidence to determine if the connection to the malicious site was successful.

Question

An analyst is reviewing an incident in which a user clicked on a link in a phishing email. Which of the following log sources would the analyst utilize to determine whether the connection was successful?
  1. Network Correct Answer
  2. System
  3. Application
  4. Authentication

Key Takeaways

The exam tests knowledge of log categories; the trap is confusing application-level activity with network-level connectivity verification.

This question tests the ability to identify the correct log source for verifying connection success after a phishing click. Network logs are the definitive source for tracking traffic flow and connectivity status.

Common mistake: Candidates often select Application or Authentication logs, mistakenly believing that browser activity or login attempts are the primary indicators of whether the initial TCP/IP connection was established.

Expert Analysis

Why the Answer Is Correct

Network logs are the appropriate source because they record data regarding traffic flow, including DNS queries, IP addresses, ports, and protocols. By reviewing these logs, an analyst can determine if the user's device successfully communicated with the malicious external server, regardless of what happened at the application layer. This aligns with standard incident response procedures where network telemetry is the first line of evidence for connection validation.

Why the Other Options Are Wrong

Application logs (Option C) typically focus on software behavior, errors, or specific actions within an app, but may not capture the underlying network handshake if the application failed to launch or was blocked. Authentication logs (Option D) only show if credentials were presented and verified; a successful connection does not require authentication, so these logs might be empty even if the link worked. System logs (Option B) generally track OS events like startup/shutdown or file access, which are less direct for verifying network reachability than network-specific logs.

Community Comment Notes

Community members consistently point out that network logs provide visibility into traffic between the device and the phishing site. One commenter noted that network logs reveal if a connection was blocked by a firewall, emphasizing their utility in determining success or failure of the link. Another user highlighted that browsing history and URL visits are tracked at the network level, reinforcing why Option A is the best choice.

Official Reference

https://www.nist.gov/publications/guide-computer-security-log-management

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'connection' success or traffic flow, always prioritize Network logs over Application or System logs. Remember that 'successful connection' refers to the establishment of communication channels (TCP/UDP), which is a network-layer function.

Frequently Asked Questions

Why not use Application logs?

Application logs track software events, but network logs directly show if the device reached the server, which is the core requirement.

Do I need DNS logs specifically?

DNS is part of network activity. General network logs often encompass or correlate with DNS query results to show resolution and connection.

More SY0-601 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Yomzie 👍 16
    Hint:: A phishing link in an email leads you where? A URL. A malicious site. Where do you find info about your Internet visits and browsing history? Answer:: Network Logs.
  2. johnabayot 👍 9 Answered A
    Network log sources can show the traffic between the user's device and the phishing website, such as DNS queries, the IP addresses, the port, and the protocols. Network logs can also reveal if the connection was blocked by a firewall or other security tools.
  3. salah112 👍 2 Answered A
    A. Network To determine whether the connection resulting from a user clicking on a link in a phishing email was successful, the analyst would typically review network logs. Network logs provide information about network traffic, connections, and communication between systems. By analyzing network logs, the analyst can identify if the user's system made a successful connection to an external server or if there were any unusual or malicious activities.
  4. Hs1208 👍 2 Answered D
    D. HVAC HVAC systems play a crucial role in maintaining appropriate temperature and humidity levels in data centers and other facilities housing IT equipment.
  5. dfc6822 👍 1
    A. Network To determine whether the connection was successful after a user clicked on a link in a phishing email, the analyst would typically utilize network logs. Network logs can provide information on connections, traffic, and communication between the user's system and external servers or websites.
Show 1 more comment
  1. Hs1208 👍 1 Answered A
    A. Network

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide