Which Logs Identify a Host Impacted by a Command-and-Control Server?
Given a scenario, use appropriate data sources to support investigation.
Given an incident, apply appropriate incident response activities.
An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)
Answer
Correct answer: D, E — Analyze network and firewall logs to identify the internal host communicating with the command-and-control server.
Community Votes
100% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the ability to select appropriate log sources for C2 incident investigation; the trap is choosing DHCP logs to map IP to host instead of the traffic logs that reveal the C2 communication itself.
Analyzing network and firewall logs is the correct approach to identify a host communicating with a command-and-control server in Security+ SY0-701 scenarios. This page explains why Network (D) and Firewall (E) logs are the answer, contrasting them with DHCP and other log types.
Many candidates choose DHCP and Firewall logs, assuming DHCP is needed to map the internal IP to a device, but the question asks for logs that identify the impacted host—network and firewall logs directly show the C2 traffic and the internal IP.
Community Discussion (10 comments)
Shaman73
👍 11
Selected: DE
D. Network E. Firewall
VincentvdS
👍 1
Selected: DE
n the context of a command-and-control (C2C) server, analyzing network and firewall logs is more effective for identifying the impacted host. These logs provide detailed information about network traffic, including connections to and from the C2C server, which can help pinpoint the affected devices. The two most relevant logs to analyze in this scenario would be: D. Network Network logs can provide insights into the traffic patterns and connections related to the C2C server. E. Firewall Firewall logs can help identify any unusual or unauthorized connections to the C2C server, aiding in the identification of the impacted host.
Aces155
👍 1
Selected: CD
Bing copilot is saying C and D. The best two logs to analyze for identifying the impacted host in a command-and-control incident would be: Network logs: These provide detailed information about network traffic, including connections to and from the command-and-control server. DHCP logs: These help map IP addresses to specific devices at given times, which is crucial for identifying the impacted host. While firewall logs are valuable for security information, network and DHCP logs together provide the most comprehensive data needed to pinpoint the specific host involved.
41c27e6
👍 2
Selected: DE
Network Logs (D): Network logs are crucial for identifying communication between the compromised host and the command-and-control server. These logs will typically include details of network traffic, including IP addresses, ports, protocols, and patterns of communication. By analyzing network logs, you can track outbound connections that may have been initiated by the infected host to communicate with the command-and-control server. Firewall Logs (E): Firewall logs are useful for identifying inbound and outbound traffic that is blocked or allowed by the firewall. They can help pinpoint suspicious traffic patterns, such as attempts to connect to known malicious IP addresses (such as the command-and-control server). Firewall logs will also show if the infected host tried to bypass any restrictions to communicate with external servers.
Exam_Prep221
👍 1
Selected: CE
DHCP logs: Identify which device was assigned the IP address communicating with the C2 server. Firewall logs: Show network traffic between the impacted host and the C2 server.
c7b3ff0
👍 1
Selected: BE
Since this is specifically asking about identifying the impacted host, I chose B and E. B. Authentication - This log helps identify any unauthorized access or unusual login attempts related to compromised hosts. E. Firewall - provide insights into incoming and outgoing traffic patterns, detecting comms with the C2 server to help identify the affected host.
dbrowndiver
👍 2
Selected: CE
C. DHCP and E. Firewall logs are the correct answers because they provide essential information to trace network communications and identify the specific host(s) impacted by the command-and-control server connection. Firewall logs help pinpoint unusual outbound connections, such as those from internal hosts to a suspicious external server, thus identifying potential breaches. DHCP logs map IP addresses to devices, while firewall logs reveal the network traffic patterns, making them both crucial for this analysis. DHCP logs are crucial for linking IP addresses seen in network activity to actual devices, especially in dynamic environments where IP addresses frequently change.
101e7ca
👍 4
Selected: DE
"command-and-control server" is the problem, attacker has accessed the network and taken control of a machine. We should check the inbound and outbound traffic logs. These will be on the Router(Network) and network Firewall.
Bimbo_12
👍 3
Selected: DE
To identify the impacted host in a cybersecurity incident involving a command-and-control server, the most relevant logs to analyze would be: C. DHCP and E. Firewall : Firewall logs capture network traffic and can show which internal hosts communicated with external IP addresses, including the command-and-control server. By analyzing firewall logs, you can identify the internal IP addresses that initiated or received communication with the command-and-control server, helping to pinpoint the impacted host. If you have already identified suspicious network traffic (e.g., connections to a C2 server) in firewall or network logs, the next step is often to determine which device was responsible for that traffic. DHCP logs are necessary for this step because they map IP addresses to specific devices. Without this mapping, knowing the IP address alone is insufficient, especially in environments where IP addresses are dynamically assigned. By consulting DHCP logs, you can quickly identify the physical or virtual device behind the suspicious activity.
cdsu
👍 2
Answer: C. DHCP E. Firewall C: Impacted host. To trace back any suspicious network activity to a specific device E: Firewall logs contain records of all incoming and outgoing traffic
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Network logs and firewall logs both capture network traffic details, including source and destination IP addresses, ports, and protocols. When a host is communicating with a command-and-control server, these logs will record the outbound connections from the internal IP to the external C2 IP. By analyzing network logs (e.g., NetFlow, packet captures) and firewall logs, an investigator can pinpoint which internal IP address is making the suspicious connections. This directly identifies the impacted host at the network layer. The combination of these two logs provides corroborating evidence of the C2 communication.Why the Other Options Are Wrong
Application logs record events within applications and would not typically show C2 network traffic. Authentication logs track login attempts and could indicate compromised credentials but do not show C2 communication. DHCP logs only show IP address assignments; they do not record traffic to a C2 server, so they cannot independently identify which host is communicating with the C2. While DHCP logs can help map an IP to a MAC address after the IP is known, they are not the primary logs to analyze for C2 traffic. Therefore, options A, B, and C are not the best choices.Community Comment Notes
Some community members, like dbrowndiver, argued for DHCP and Firewall logs, stating that "DHCP logs map IP addresses to hosts" and firewall logs show the C2 connection. However, the majority of commenters, including user 101e7ca, correctly noted that "the inbound and outbound traffic logs" will be on the router and firewall, pointing to Network and Firewall logs. As Shaman73 simply affirmed, "D. Network E. Firewall" is the consensus. The key distinction is that network and firewall logs directly reveal the C2 communication, while DHCP logs only provide supporting mapping information.Official Reference
Exam Strategy
When asked to choose logs for identifying a C2-impacted host, focus on logs that capture network traffic and IP connections. Remember that DHCP logs only map IPs to devices and do not show the actual malicious communication, so they are usually a distractor.
Frequently Asked Questions
Why not DHCP logs to identify the impacted host?
DHCP logs only map IP addresses to MAC addresses; they do not show the C2 communication, so you first need network or firewall logs to find the suspicious IP.
Why are application logs not useful for C2 incidents?
Application logs record events within applications, not network traffic to external C2 servers, so they won't reveal which host is communicating with the attacker.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →