Exam N10-008 topic 1 question 408 discussion

Although all these could be used in a situation like this, the key term was "from the internet," the only thing that watches/disseminates/monitors/ etc. your network from the internet is a firewall.

To determine whether an internal server had an unauthorized access attempt, the security engineer should review: C. The firewall logs Firewall logs provide information about network traffic, including any attempts to access internal servers from hosts on the internet. Unusual or unauthorized access attempts can often be identified by analyzing firewall logs. These logs may include details about source IP addresses, destination IP addresses, ports, and actions taken (allowed or denied). Options A (The ARP table) and B (NetFlow statistics) might provide network-related information, but they may not specifically capture unauthorized access attempts. Option D (The audit logs on the core switch) could be relevant for certain types of events, but firewall logs are more commonly used for monitoring and detecting external access attempts.