Which Log Source Reveals Executable Activity on a Corporate Laptop?

SY0-701 By islever Editorial Last updated

Given a scenario, use appropriate data sources to support investigation. Explain security alerting and monitoring concepts and tools.

Short answer

D Use endpoint logs to obtain process, path, hash, and execution-history data about the executable on the employee's corporate laptop.

Question

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
  1. Application
  2. IPS/IDS
  3. Network
  4. Endpoint Correct Answer

Key Takeaways

The question tests log-source selection by pivoting from a network alert to host-level executable evidence, with the main trap being application logs, which are narrower than endpoint telemetry.

This SY0-701 scenario tests whether you can choose the right log source when a SIEM network alert requires executable-level details from an employee laptop. The answer is endpoint logs, because they record local process and execution activity.

Common mistake: A common wrong choice is A, application logs, because the subject is an executable; however, application logs capture an application's own messages, not the broader process creation, path, hash, and execution history needed to investigate a binary on the endpoint.

Expert Analysis

The pivotal phrase is “executable running on the machine.” The alert begins with potential malicious network traffic in the SIEM, but the question does not ask which log detected that traffic. It asks for additional data about the binary on the employee’s corporate laptop. That shifts the evidence source from network telemetry to host telemetry, and the laptop is the endpoint. The correct option is D.

Why the alternatives fail. C, network logs, could explain the original alert by showing IP addresses, ports, protocols or flow volume, but they typically cannot identify the local executable that generated the traffic. B, IPS/IDS logs, may record a signature or anomaly detection, yet they describe traffic and detection events, not process execution details. A, application logs, is the closest trap: the executable is an application, but application logs usually contain only messages the application itself emits. They do not provide a general inventory of process creation, executable path, hash, command line and parent process for every binary.

What endpoint logs add. Endpoint logs are host logs stored on the device. They can show process creation, executable path, command line, hashes, user context, parent-child process relationships and execution history. Comments on this scenario reinforce that distinction: the endpoint is the machine named in the alert, and its logs hold the executable evidence; application logs might be relevant only if the analyst could access an application-specific run log. “Additional data” also signals a pivot beyond the SIEM’s network alert, not a repeat of network or IPS/IDS data.

Decision rule. Match the requested evidence to its origin. Traffic records answer “what crossed the network?” Endpoint records answer “what ran on the laptop?” Since the question asks about the executable, D is the only source that directly satisfies the requirement.

Official Reference

https://www.comptia.org/en-us/certifications/security/

This link opens the official vendor documentation in a new tab.

Exam Strategy

Separate the alert that opened the case from the evidence the question asks for. Here, network traffic is context, but “executable running on the machine” points to host telemetry; when a question asks about process execution, file hashes, command lines, or local user activity on a laptop or server, map it to endpoint logs rather than IPS/IDS or network flow logs. If an option names a narrower log category, such as application logs, ask whether it covers all executables or only one application's messages.

Frequently Asked Questions

Why isn't application logging the best source for executable details?

Application logs generally contain messages the application chooses to emit, not a complete host-level record of process creation, command line, path, hash, or parent process. Endpoint logs provide that broader executable context.

What endpoint log fields help investigate a suspicious executable?

Look for process creation events, executable path, command line, file hash, user context, parent-child process relationships, and execution timestamps. These details help correlate the binary with the original network alert.

Can network or IPS/IDS logs identify which executable ran on the laptop?

They can show traffic patterns and detections, but they usually cannot reliably map a flow to a specific local binary. Use them to establish network context, then pivot to endpoint telemetry for process-level evidence.

More SY0-701 FAQ →

Community Votes

D
89%
A
11%

89% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. e5c1bb5 👍 5
    to further clarify, endpoint logs are stored on the actual device so the data their looking for should be in endpoint logs.
  2. slackbot 👍 4 Answered A
    why not application logs? these will reveal what the application actually does? unless this is something explicitly mentioned by ComTIA that it must be the system logs, i would pick the app logs
  3. dklzvndjc 👍 3 Answered D
    Endpoint logs: Endpoint logs, also known as host logs, record events and activities that occur on individual endpoints (such as laptops, desktops, or servers). These logs can include information about processes, applications, system events, user logins, file accesses, and more. Endpoint logs are a valuable source of data for investigating security incidents on specific devices, including information about the executables running on the machine. For the investigation described in the scenario, the most appropriate data source for obtaining additional information about the executable running on the employee's corporate laptop is Endpoint logs. Endpoint logs can provide detailed insights into the processes and executables running on the machine, helping the security analyst to further analyze and respond to the potential security threat.
  4. SHADTECH123 👍 3 Answered D
    Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee's corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the security analyst to understand the behavior of the executable and its potential impact on the system and network.
  5. dbrowndiver 👍 3 Answered D
    Endpoint logs can provide information about the executable in question, including its name, path, hash values, execution history, and associated processes. This data is crucial for identifying potentially malicious executables and understanding their behavior on the system.
Show 5 more comments
  1. brettw 👍 2 Answered D
    Correct anwser is: D This is because the question starts out by saying the analyst was research network logs within the SIEM, and not a host's logs. If the analyst was searching host logs, and the host was a Windows machine, then Application logs would be the correct answer. If the host was a Linux machine, it would be the Syslog/Journald or explicit application logs within /var/log. So since the question is very open ended on this portion, and typically a SIEM will collect endpoint device logs also. You would search the endpoint logs within the SIEM for the appropriate application log entries of the host(s).
  2. 7d6fad2 👍 2 Answered D
    Correct answer is D. For awareness, the scenario states "A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop." It is malicious network traffic, everything else is just there to throw you off. Endpoint logs will show everything you need: application issues, user activities, malware executed on workstation. It isn't application logs because the scenario doesn't mention that "an application" is causing issues.
  3. eskayvee 👍 1 Answered D
    D: User's laptop is the Endpoint that SIEM has raised an alert against. Application log is potentially available if the Admin can connect to the end-point and see the executable's run log (if any)
  4. Heyitsme23 👍 1 Answered D
    D is the answer
  5. shady23 👍 1 Answered D
    D. Endpoint

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide