SIEM Investigation: Executable Analysis Log Source

SY0-701 By islever Editorial Last updated

Given a scenario, use appropriate data sources to support investigation.

Short answer

D The security analyst should use Endpoint logs to gather detailed information about the executable running on the corporate laptop.

Question

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
  1. Application
  2. IPS/IDS
  3. Network
  4. Endpoint Correct Answer

Key Takeaways

The question tests the ability to select the correct log type for executable analysis; the common trap is confusing application logs (which track software usage) with endpoint logs (which track system-level process execution).

When investigating suspicious executables on a corporate laptop, the endpoint log is the definitive data source for process and file details. This page explains why endpoint logs are superior to application or network logs for this specific scenario.

Common mistake: Candidates often choose Application logs because they associate 'executable' with 'application', failing to recognize that detailed technical metadata about the running process resides in the host/endpoint logs.

Expert Analysis

Why the Answer Is Correct

Endpoint logs are generated by agents installed on individual devices (laptops, desktops, servers) and capture granular host-level events. These logs include critical forensic data such as process creation, file access, registry changes, and executable hashes. Since the analyst needs to analyze the specific executable running on the machine, the endpoint log provides the necessary context that other logs cannot.

Why the Other Options Are Wrong

Application logs typically record high-level events related to software functionality (e.g., errors, user interactions) rather than low-level process execution details. Network logs and IPS/IDS logs focus on traffic patterns, packets, and protocol anomalies but do not reveal what is happening inside the host's memory or file system regarding specific executables.

Community Comment Notes

Community consensus strongly supports Endpoint logs, with users noting that 'employees laptop=endpoint' establishes the direct link between the device and the log source. Comments emphasize that endpoint logs contain 'name, path, hash values, execution history,' which are essential for identifying malicious behavior. One user correctly pointed out that while application logs show what an app does, endpoint logs provide the technical evidence needed for investigation.

Exam Strategy

Always map the asset mentioned in the scenario to its corresponding log type. If the investigation focuses on a specific device's internal state (processes, files), choose Endpoint logs. If it focuses on traffic flow, choose Network logs.

Frequently Asked Questions

Why aren't Application logs sufficient for executable analysis?

Application logs track software usage and errors but lack low-level forensic data like process hashes, parent-child relationships, and file paths found in endpoint logs.

Can Network logs show executable details?

No, network logs capture traffic metadata (IPs, ports, protocols) but cannot see inside encrypted payloads or identify specific processes running on the host.

More SY0-701 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. metzen227 👍 13
    Endpoint logs: Endpoint logs, also known as host logs, record events and activities that occur on individual endpoints (such as laptops, desktops, or servers). These logs can include information about processes, applications, system events, user logins, file accesses, and more. Endpoint logs are a valuable source of data for investigating security incidents on specific devices, including information about the executables running on the machine. For the investigation described in the scenario, the most appropriate data source for obtaining additional information about the executable running on the employee's corporate laptop is Endpoint logs. Endpoint logs can provide detailed insights into the processes and executables running on the machine, helping the security analyst to further analyze and respond to the potential security threat.
  2. e5c1bb5 👍 4
    to further clarify, endpoint logs are stored on the actual device so the data their looking for should be in endpoint logs.
  3. SHADTECH123 👍 3 Answered D
    Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee's corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the security analyst to understand the behavior of the executable and its potential impact on the system and network.
  4. dbrowndiver 👍 3 Answered D
    Endpoint logs can provide information about the executable in question, including its name, path, hash values, execution history, and associated processes. This data is crucial for identifying potentially malicious executables and understanding their behavior on the system.
  5. slackbot 👍 2 Answered A
    why not application logs? these will reveal what the application actually does? unless this is something explicitly mentioned by ComTIA that it must be the system logs, i would pick the app logs
Show 3 more comments
  1. e5c1bb5 👍 8 Answered D
    employees laptop=endpoint
  2. justin_es6 👍 1 Answered C
    we see network we wrong
  3. shady23 👍 1 Answered D
    D. Endpoint

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide