A privileged account is used on a jump box at 02:15, and the SIEM shows multiple interactive logons from the same account to different servers within 10 minutes. The administrator says they used a password vault for the session. Which log source best confirms whether the access was authorized?

DHCP lease logs from the jump box subnet

DHCP logs only show address assignment and do not verify whether privileged access was authorized.

Printer server logs for the operations department

Printer logs have no meaningful connection to privileged authentication or session authorization.

Web proxy logs for outbound browsing activity

Web proxy logs may show internet access, but they do not validate privileged credential checkout or approval.

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Privileged access management or password vault audit logs — Privileged access management or password vault audit logs are the best source because they record when credentials were checked out, by whom, for what session, and often whether approval workflows were followed. In a jump-box or administrative workflow, those logs directly answer whether the privileged use was expected and authorized. That makes them much more useful than generic infrastructure logs when investigating suspicious after-hours administrative activity. Why others are wrong: DHCP logs help identify network address assignment, but they do not establish authorization for privileged access. Printer logs are unrelated to authentication and would not prove anything about an admin session. Web proxy logs can show browsing behavior, yet they do not confirm credential checkout or approval in a privileged access workflow. The right evidence source is the one that tracks privileged session governance.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.