SY0-701 Security Operations Practice Question
A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?
⚠ Common exam trap
The SY0-701 exam often tests the misconception that VPN concentrator logs alone can identify the device type, but they only show authentication and external IP, not whether the session originated from the assigned managed laptop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint detection and response telemetry from the user's laptop
B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN concentrator logs
Why it's wrong here
VPN concentrator logs confirm the session (username, source IP, timestamp, tunnel protocol) but reveal nothing about the endpoint's integrity or health. They can show that a device authenticated with valid credentials, yet they cannot prove that the device was not compromised, lacked security patches, or was not running unauthorized software. The source IP may be a NAT address or a public IP shared by many devices, further obscuring the true endpoint identity.
- ✓
Endpoint detection and response telemetry from the user's laptop
Why this is correct
Endpoint detection and response (EDR) telemetry from the user's laptop provides the highest-fidelity evidence for validating a VPN login. It can confirm the device's unique hardware ID, hostname, and EDR agent status, while also showing whether the laptop was trusted, healthy, and free of active compromises at the time of login. By correlating process execution, network connections, and user activity, EDR can tie the VPN authentication to the exact endpoint and rule out a stolen token or a forged client.
- ✗
DNS query logs from the internal resolver
Why it's wrong here
DNS query logs from the internal resolver show which hostnames were queried and by which internal IP address, but they do not map directly to VPN session IDs or authenticate the user. A successful VPN login creates an encrypted tunnel, and DNS queries from that tunnel are typically resolved by the internal resolver, making them appear to come from the VPN concentrator's IP or a shared gateway — not the user's laptop. Without a session-to-IP binding and device identity, these logs cannot prove which device initiated the login.
- ✗
Email gateway logs for the executive mailbox
Why it's wrong here
Email gateway logs track message metadata for the mailbox (sender, recipient, subject, attachment hashes) and are useful for detecting phishing or malicious attachments, but they contain no records of VPN authentication events. They do not include the source device's IP, hostname, or any session tokens, so they cannot validate the endpoint that performed the login. Even if a phishing email is found, it would be circumstantial and would not replace endpoint-level evidence for the VPN alert.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.