EDR on a finance workstation shows Outlook launching mshta.exe, followed by a scheduled task named UpdateSvc_91 and repeated HTTPS beacons to a newly registered domain. The user is still working and has not rebooted. Which two telemetry sources would best help the analyst confirm the initial execution path and determine whether the host has communicated with other suspicious infrastructure? Select two.

Spooler service logs, because mshta.exe commonly prints documents before starting network activity.

Spooler logs are not a useful source for confirming script execution or beaconing. Printing activity is unrelated to the observed process chain and external communications in this case.

RAID controller logs, because they show whether the workstation’s storage hardware is failing.

RAID logs are only relevant to disk or array health. They do not help identify the execution path, scheduled task creation, or suspicious internet traffic from the endpoint.

NTP synchronization logs, because time drift is the most likely cause of the alert.

Time synchronization problems can affect investigations, but they do not explain malicious process launches or outbound beaconing. They are a lower-priority support check, not the best telemetry for this alert.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: EDR process tree and parent-child execution telemetry, because it reveals the original application that launched the script host. — The best sources are the EDR process tree and proxy logs. The process tree reconstructs how Outlook launched mshta.exe and whether additional payloads were created or persisted. Proxy logs show where the host connected on the network and whether the traffic pattern matches beaconing to a suspicious external domain. Together, they answer both parts of the investigation: execution path and external communication scope. Why others are wrong: Spooler, RAID, and NTP logs do not address the malware execution chain or outbound command-and-control traffic. They can sometimes be useful context, but they are not the most efficient sources for confirming how the threat started or whether it is still phoning home.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.