200-201 Security Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DNS logs

  Why it's wrong here

  DNS logs capture queried domain names, resolver responses and record types, but never the full URL path, HTTP method or user-agent string. They are tempting for spotting malicious domains during triage, yet request-level detail such as URLs and user agents is recorded by a web server or proxy access log.

• ✗

  Firewall logs

  Why it's wrong here

  Firewall logs record permitted or denied connections by IP address and port, not application-layer detail such as requested URLs or user-agent strings. It is tempting because firewalls sit on the HTTP path and log every session, and would be correct for tracing connection attempts, not for inspecting request content.

• ✓

  Web server logs

  Why this is correct

  Web server logs record each HTTP transaction, capturing request method, URL path, query strings, status codes and User-Agent headers. This satisfies the requirement for detailed request-level data, unlike firewall logs that show only connection metadata or NetFlow records lacking application-layer detail.

• ✗

  System logs

  Why it's wrong here

  System logs record OS-level events such as service starts, kernel messages and authentication, carrying no HTTP request fields like URLs or user agents. They are tempting because they often capture web server process errors, but the request-level detail lives in the web server's own access log, not the system log.

Go deeper

Related to this question