exam questions

Exam N10-008 All Questions

View all questions & answers for the N10-008 exam

Exam N10-008 topic 1 question 822 discussion

Actual exam question from CompTIA's N10-008
Question #: 822
Topic #: 1
[All N10-008 Questions]

A network security engineer is responding to a security incident. The engineer suspects that an attacker used an authorized administrator account to make configuration changes to the boundary firewall. Which of the following should the network security engineer review?

  • A. Network traffic logs
  • B. Audit logs
  • C. Syslogs
  • D. Event logs
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
tempovpn
Highly Voted 1 year ago
Selected Answer: B
It was on my exam (April 25th, 2024) (Firewall) Audit logs provide a chronological record of system activities, including user actions, access attempts, and configuration changes, crucial for security monitoring and compliance audits.
upvoted 12 times
...
a87d6a4
Most Recent 8 months ago
Selected Answer: B
Audit logs track changes made to the configuration and actions performed by authorized accounts, including administrative changes to firewall settings. Reviewing these logs can help identify if an authorized administrator account was used for unauthorized actions or if any suspicious changes were made.
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago