Exam CS0-002 topic 1 question 380 discussion

This is what happens when you write a comment while you are drunk. anyway: 200MB * 0.50 = 100MB of logs of response code 200 , so it's B

403 errors, also known as Forbidden errors, occur when a user tries to access a resource that they are not authorized to access, that should be a huge sign a alarm ... 404 errors are for pages that do not exist, could have some information of the source but 403 logs are addressing directly with the malicious activity.

so guy to get this straight so we investigate the code with the highest amount traffic volume in this case code 200?

200MB and 50% is 200, which means that 100MB is 200, 200 logs need investigation first so I think it is B

Answer D

Answer is B

Answer is B

The reason for this is that 50% of the logs contain response code 200, which is a successful HTTP response code indicating that the web server successfully processed the request. This means that the source of the activity is likely to be generating successful requests that the server is responding to with a 200 code. By using the grep command to search for "200" in the access_log file, the security analyst can quickly identify the source of this activity. The other response codes, such as 403 and 404, indicate errors or forbidden access, which are less likely to be related to the high volume of logs.