Exam SY0-701 topic 1 question 536 discussion

The correct answer is: C. Firewall Explanation: Firewall logs are the most likely to provide information about the initial exploit, as firewalls monitor and log network traffic, including attempts to exploit vulnerabilities in IoT devices. These logs can show suspicious or unauthorized connections to the IoT device, which can help identify the time of the initial exploit. Endpoint logs (A) might provide details about the affected device, but they are less likely to capture the initial network-based exploit. Application logs (B) are specific to applications and may not be relevant if the exploit targeted the IoT device itself rather than an application running on it. NAC (Network Access Control) logs (D) focus on device authentication and network access, which may not directly reveal the time of the exploit. Thus, Firewall logs are the most appropriate starting point for identifying the time of the initial exploit.

If this was network exploit I would have gone with C, But the question is regarding a IoT device and wants to know time of the exploit of the device's vulnerability. So endpoint logs would tell you that.