Free CompTIA Security+ SY0-701 Practice Question
A security analyst is reviewing the logs from an intrusion detection system (IDS) and needs to correlate these logs with network traffic to understand the scope of a suspected breach. Which of the following will provide the MOST useful information for correlating the time of the suspicious IDS alerts with the network traffic captured?
Traffic flow metadata collected from network devices such as switches and routers
User account changes logged in the authentication server records
Device configuration settings from the network management system
Application error messages captured by the system's event logs
This question's topic:
CompTIA Security+ SY0-701 /
Security Operations
SAVE $49