Log Data Sources (Security+): Firewall, IDS, Endpoint

1. Which log data source provides real-time visibility into encrypted traffic patterns without decrypting the payload?

Endpoint antivirus

Firewall (via metadata and flow analysis)

Host-based IDS

System event viewer

2. A security analyst needs to correlate three log sources to investigate a suspected breach. Which sources would provide the most complete picture?

Firewall, IDS, and endpoint EDR

Firewall and IDS only

Endpoint and DNS logs only

Firewall and web server logs

3. Which statement best distinguishes IDS logs from firewall logs in terms of analysis focus?

IDS logs focus on policy violations; firewalls focus on attack content

IDS logs analyze payload content for attacks; firewalls focus on allowed/denied decisions

Firewalls detect malware; IDS logs track user behavior

IDS logs are encrypted; firewall logs are always plaintext

4. An endpoint log records 'Registry key modified: HKLM\System\CurrentControlSet\Services.' Which monitoring type captured this?

Firewall state inspection

IDS deep packet inspection

Host-based registry audit

Network flow analysis

5. Firewall logs reveal multiple connection attempts to port 443 from an internal IP to an external IP in 60 seconds. What does this pattern suggest?

Normal HTTPS web browsing

Possible data exfiltration or command-and-control

A legitimate software update

Email server communication

6. A log shows a file was deleted from a protected directory on a Linux endpoint. Which source tracked this change?

Firewall outbound rule

Network IDS

Host-based file integrity monitor

DHCP server

7. An IDS generates an alert for 'Potential DDoS attack: 10,000 SYN packets from 192.168.100.0/24.' What makes this an IDS detection?

It identified a volumetric attack pattern

It blocked the traffic automatically

It logged user authentication failures

It recorded firewall rule violations

8. Which log source would capture the exact command-line arguments used when a user launched an executable?

Network firewall

IDS sensor

Endpoint process audit log

Router ACL log

9. A firewall log shows 'Alert: Geolocation mismatch—login from China detected.' How does this differ from typical firewall logging?

Firewall cannot perform geolocation analysis

Firewall with threat intelligence enrichment

IDS must have generated this alert

Endpoint EDR detected the anomaly

10. An endpoint generates a log when a scheduled task was created to execute at system startup. What monitoring capability detected this?

Network IDS signature

Firewall policy enforcement

Host-based behavioral monitoring

DNS sinkhole

SNMP polling

11. Which device typically generates logs containing source and destination IP addresses, ports, and protocol information for traffic passing through a network perimeter?

Firewall

Endpoint antivirus

SIEM

Web server

12. A log entry shows 'User account 'admin' failed login attempt 5 times in 10 minutes.' Which source is most likely?

Network firewall

IDS pattern detection

Endpoint authentication log

Web application firewall

13. An IDS alert shows 'Possible buffer overflow attempt detected.' Which characteristic defines this as an IDS log entry?

It monitors traffic for policy violations only

It analyzes packet content against attack signatures

It records all network connections

It tracks user authentication attempts

14. Which log source would you consult to determine if a process injected code into another running process on a Windows machine?

Firewall NAT translation log

Endpoint EDR (Endpoint Detection and Response)

Network IDS alert

SNMP trap

15. A firewall generates a log showing 'Connection denied: Source 192.168.1.50, Destination 8.8.8.8:53.' What does this indicate?

A DNS query was blocked by policy

An endpoint initiated malware communication

An IDS signature was triggered

A legitimate user accessed the internet

16. Endpoint logs reveal that a user executed a suspicious executable from a temporary folder. What type of monitoring captured this?

Network-based IDS

Host-based endpoint detection

Firewall session tracking

DHCP server logs

17. A log entry shows 'Alert: SQL injection payload detected in HTTP request.' Which source generated this?

Firewall access control list

IDS/IPS inspection engine

Endpoint registry monitor

Router interface statistics

18. Which log data source would best capture blocked outbound connections to known malicious IP addresses?

Endpoint file integrity monitor

Firewall with threat intelligence

Kernel audit log

Application performance monitor

19. A Windows endpoint logs indicate a new service was started with administrator privileges. Which log source produced this entry?

Network firewall

Endpoint event log

IDS sensor

DNS server

20. An IDS detects a TCP port scan attempt on your network. What type of log entry would this generate?

Connection establishment from legitimate users

Suspicious pattern matching attack signatures

Successful authentication event

Application crash report

Log Source Quiz: Firewall, IDS or Endpoint?

1. Which log data source provides real-time visibility into encrypted traffic patterns without decrypting the payload?

2.

What first name or nickname would you like us to use?

2. A security analyst needs to correlate three log sources to investigate a suspected breach. Which sources would provide the most complete picture?

3. Which statement best distinguishes IDS logs from firewall logs in terms of analysis focus?

4. An endpoint log records 'Registry key modified: HKLM\System\CurrentControlSet\Services.' Which monitoring type captured this?

5. Firewall logs reveal multiple connection attempts to port 443 from an internal IP to an external IP in 60 seconds. What does this pattern suggest?

6. A log shows a file was deleted from a protected directory on a Linux endpoint. Which source tracked this change?

7. An IDS generates an alert for 'Potential DDoS attack: 10,000 SYN packets from 192.168.100.0/24.' What makes this an IDS detection?

8. Which log source would capture the exact command-line arguments used when a user launched an executable?

9. A firewall log shows 'Alert: Geolocation mismatch—login from China detected.' How does this differ from typical firewall logging?

10. An endpoint generates a log when a scheduled task was created to execute at system startup. What monitoring capability detected this?

11. Which device typically generates logs containing source and destination IP addresses, ports, and protocol information for traffic passing through a network perimeter?

12. A log entry shows 'User account 'admin' failed login attempt 5 times in 10 minutes.' Which source is most likely?

13. An IDS alert shows 'Possible buffer overflow attempt detected.' Which characteristic defines this as an IDS log entry?

14. Which log source would you consult to determine if a process injected code into another running process on a Windows machine?

15. A firewall generates a log showing 'Connection denied: Source 192.168.1.50, Destination 8.8.8.8:53.' What does this indicate?

16. Endpoint logs reveal that a user executed a suspicious executable from a temporary folder. What type of monitoring captured this?

17. A log entry shows 'Alert: SQL injection payload detected in HTTP request.' Which source generated this?

18. Which log data source would best capture blocked outbound connections to known malicious IP addresses?

19. A Windows endpoint logs indicate a new service was started with administrator privileges. Which log source produced this entry?

20. An IDS detects a TCP port scan attempt on your network. What type of log entry would this generate?