Exam SY0-701 topic 1 question 191 discussion

While the endpoint logs themselves are deleted, the firewall logs might still provide valuable information. Firewalls typically record network traffic, including outbound connections, which could help the analyst identify the destination of the suspicious communication. By examining the firewall logs, the analyst might be able to determine the IP address of the command-and-control server and gather other relevant information about the incident.

Since the logs on the endpoint were deleted, the security analyst would likely turn to firewall logs. Firewall logs can provide information about network traffic, including outbound connections that may indicate communication with a command-and-control server. These logs can help the analyst identify suspicious traffic patterns or unauthorized communication that bypassed endpoint defenses.

This isn't correct. The answer has to be C. In the question, it specifically states that the logs on the endpoint were deleted. That tells me that someone had access to those logs, which means there might have very well been tampering on the endpoint. The ACL has the ability to show us who was able to access those logs and when they were deleted.

B. Firewall