Which log source reveals executable details on a laptop during a SIEM alert investigation?

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

Application
IPS/IDS
Network
Endpoint Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your ability to match the log source to the required data; though network/IPS logs show traffic, only endpoint logs contain the executed file's identity and activities.

For SY0-701, when SIEM alerts show suspicious traffic from a corporate laptop, endpoint logs are the best data source for executable details. Community consensus highlights endpoint logs capture process execution, hashes, and behavior needed for incident investigation.

Choosing Application logs is the most common mistake because they appear to show what an application does, but they do not reliably record executable process execution, file paths, hashes, or command-line activity; endpoint logs do.

Community Discussion (8 comments)

metzen227 👍 13

Endpoint logs: Endpoint logs, also known as host logs, record events and activities that occur on individual endpoints (such as laptops, desktops, or servers). These logs can include information about processes, applications, system events, user logins, file accesses, and more. Endpoint logs are a valuable source of data for investigating security incidents on specific devices, including information about the executables running on the machine. For the investigation described in the scenario, the most appropriate data source for obtaining additional information about the executable running on the employee's corporate laptop is Endpoint logs. Endpoint logs can provide detailed insights into the processes and executables running on the machine, helping the security analyst to further analyze and respond to the potential security threat.

e5c1bb5 👍 8 Selected: D

employees laptop=endpoint

slackbot 👍 2 Selected: A

why not application logs? these will reveal what the application actually does? unless this is something explicitly mentioned by ComTIA that it must be the system logs, i would pick the app logs

justin_es6 👍 1 Selected: C

we see network we wrong

dbrowndiver 👍 3 Selected: D

Endpoint logs can provide information about the executable in question, including its name, path, hash values, execution history, and associated processes. This data is crucial for identifying potentially malicious executables and understanding their behavior on the system.

SHADTECH123 👍 3 Selected: D

Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee's corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the security analyst to understand the behavior of the executable and its potential impact on the system and network.

shady23 👍 1 Selected: D

D. Endpoint

e5c1bb5 👍 4

to further clarify, endpoint logs are stored on the actual device so the data their looking for should be in endpoint logs.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Endpoint logs (host logs) are generated on the employee’s laptop and record process creation, executable paths, hashes, file accesses, and system events. As comment [1] notes, endpoint logs are valuable for investigating incidents on specific devices, including executable information. Comment [3] adds they provide the executable name, path, hash values, execution history, and associated processes, which is exactly the additional data needed.

Why the Other Options Are Wrong

Application logs (A) record the application’s own events, not necessarily every executable/process detail; comment [5] questions this, but endpoint logs are the host-level source. IPS/IDS logs (B) and network logs (C) capture traffic and intrusion detections, but they don't reveal what executable ran on the endpoint. Comment [7] indicates a test-taker initially chose network and recognized the error. Endpoint is the only source that ties network activity back to a specific executable on the laptop.

Community Comment Notes

The community overwhelmingly supports D, with 83 votes and comments like "employee's laptop=endpoint" [6]. Comment [2] clarifies that endpoint logs are stored on the actual device. The comments emphasize that endpoint logs include process and executable details, making them the right data source for investigating suspicious executable behavior after a SIEM alert. Some commenters initially considered Application logs, but the consensus is that host-level endpoint data is necessary.

Official Reference

Exam Strategy

When a question asks for executable data on an endpoint, immediately eliminate network-level sources and look for 'endpoint,' 'host,' or 'system' logs. Remember that SIEM alerts are often triggered by network traffic, but the investigation must pivot to endpoint logs to identify the process and file.

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide