ISC2 CC Security Operations Practice Question
A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)
⚠ Common exam trap
It's easy for candidates to confuse 'system logs' or 'authentication logs' with network visibility — candidates pick them because they sound security-relevant, but only firewall and proxy logs actually show outbound data flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall logs
Firewall logs (A) are correct because they record allowed and denied connections with source/destination IP addresses, ports, and byte/packet counts, letting the analyst spot large or anomalous outbound transfers to external hosts. Proxy logs (C) are correct because they capture HTTP/HTTPS requests, URLs, user agents, and often the volume of data uploaded or downloaded, which is essential for identifying web-based exfiltration channels. Patch management logs (B) only track software update deployment and compliance, so they reveal nothing about network data flows. System logs (D) contain OS, service, and application events but generally lack the destination and transfer-volume detail needed to confirm outbound exfiltration. Authentication logs (E) show logon, logoff, and failed-access events, which help with account compromise analysis but not with tracing data leaving the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Firewall logs
Why this is correct
Firewall logs capture allowed and denied connections with source and destination IP addresses, ports and byte counts, revealing large or anomalous outbound flows to external hosts. This satisfies the exfiltration scenario by exposing volume and destination of egress traffic crossing the network perimeter.
- ✗
Patch management logs
Why it's wrong here
Patch management logs record software update compliance and deployment status, containing no records of network connections or transferred bytes, so they cannot evidence outbound exfiltration. They are tempting because they support vulnerability and asset-hygiene investigations, where patch state is directly relevant.
- ✓
Proxy logs
Why this is correct
Proxy logs record outbound HTTP/HTTPS requests with destination URLs, hostnames, bytes transferred and user identity, directly exposing data leaving the network. This satisfies the scenario's need to identify outbound transfers, since the proxy sits inline and logs application-layer egress detail that packet-level sources cannot reconstruct.
- ✗
System logs
Why it's wrong here
System logs record operating system events such as service starts, kernel messages and errors, not outbound connection destinations or byte counts, so they cannot trace data transfers. They are tempting because they help diagnose host compromise, which frequently accompanies exfiltration.
- ✗
Authentication logs
Why it's wrong here
Authentication logs capture sign-in events, account lockouts and session establishment, not the volume or destination of data leaving the network, so they cannot show exfiltration. They are tempting because compromised credentials often precede exfiltration, making them useful for establishing initial access.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.