CS0-003 Security Operations Practice Question
A security analyst is configuring a SIEM correlation rule to detect potential brute-force attacks. Which log source combination is most appropriate for this rule?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication logs and firewall logs
Authentication logs show login attempts, and firewall logs show source IPs; combining them can detect multiple failed logins from an IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication logs and firewall logs
Why this is correct
Correlating authentication logs with firewall logs allows analysts to map failed login attempts to specific external IP addresses and network traffic patterns. This combination is essential for identifying distributed brute-force attacks, as it links application-level credential failures with network-level connection attempts.
- ✗
Authentication logs and DNS logs
Why it's wrong here
While authentication logs track credential validation, DNS logs only record domain name resolution requests and IP mappings. They lack the network connection details and IP-to-port traffic data needed to trace the origin of unauthorized login attempts or brute-force activity.
- ✗
Firewall logs and IDS logs
Why it's wrong here
Intrusion Detection System (IDS) logs identify known attack signatures, and firewall logs track packet filtering, but neither source captures actual user authentication events. Without explicit login success or failure data from directory services or local systems, a SIEM cannot accurately flag brute-force authentication attempts.
- ✗
Endpoint logs and cloud audit logs
Why it's wrong here
Endpoint logs primarily record local system events like process creation and registry modifications, while cloud audit logs track API calls within cloud environments. Neither of these sources provides the unified network-edge connection data and centralized authentication telemetry required to correlate external brute-force attacks against on-premises infrastructure.
Go deeper
Related to this question
Learn chapter
Cloud Security Posture Management (CSPM)
Key term
Log source
A log source is any system, device, or application that generates and records event data, such as timestamps and activities, for monitoring and security analysis.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.