Topic: CS0-003 topic 1 question 194

A laptop that is company owned and managed is suspected to have malware. The company implemented centralized security logging. Which of the following log sources will confirm the malware infection?

A.
XDR logs
B.
Firewall legs
C.
IDS logs
D.
MFA logs

Re: CS0-003 topic 1 question 194

Among the options provided, the log source that would most likely confirm the malware infection on the company-owned and managed laptop is:

A. XDR logs

XDR (Extended Detection and Response) logs aggregate and correlate data from various security sources, such as endpoint detection and response (EDR), network traffic analysis (NTA), and other security tools. These logs provide comprehensive visibility into security events and incidents across the organization's infrastructure.

If the laptop is suspected to have malware, the EDR component of the XDR solution would likely generate logs indicating suspicious or malicious behavior on the endpoint. This could include activities such as file modifications, process executions, network connections to known malicious domains, or other indicators of compromise (IOCs) associated with malware infections.

Re: CS0-003 topic 1 question 194

Just wanna say thanks for taking tjhe time to put in so many good, detailed answers.

Re: CS0-003 topic 1 question 194

I would say A. The laptop could be outside of the company network and an IDS would not have any relevant logs. Only the XDR would have logs in that situation.

Re: CS0-003 topic 1 question 194

XDR - IDS has nothing to do with endpoints

Re: CS0-003 topic 1 question 194

This is XDR logs.  XDR and EDR are sometimes interchangeable terms.
IDS is traditionally associated with network traffic, and logs are typically collected from networking devices, not user workstations.

Re: CS0-003 topic 1 question 194

XDR -
eXtended Detection and Response

Re: CS0-003 topic 1 question 194

Intrusion Detection System (IDS) logs are specifically designed to monitor network traffic for suspicious or malicious activity. If the laptop is suspected to have malware, the IDS logs may capture network traffic associated with the malware's behavior, such as communication with command-and-control servers, attempts to exploit vulnerabilities, or unusual patterns of data transfer.