mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A company uses a SIEM to correlate logs from…
A company uses a SIEM to correlate logs from multiple sources. Which log source is most critical for detecting privilege escalation attacks?
⚠ Common exam trap
It's easy for candidates to choose firewall logs or DNS logs because they associate them with detecting attacks in general, but the question specifically targets privilege escalation, which requires logs that capture user identity and privilege changes, not network-level events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication logs
Authentication logs are most critical for detecting privilege escalation attacks because they record user identity changes, such as the use of 'su' or 'sudo' commands, and account modifications like group membership changes. A SIEM can correlate these events with other logs to identify anomalous privilege transitions, such as a standard user suddenly acquiring administrative rights, which is a hallmark of privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication logs
Why this is correct
Authentication logs are paramount for detecting security incidents like privilege escalation because they meticulously record all login attempts, account lockouts, password changes, and user role modifications across operating systems, applications, and directory services. A Security Information and Event Management (SIEM) system correlates these granular events to identify suspicious patterns, such as multiple failed login attempts followed by a successful one from an unusual location, or unauthorized privilege assignments, which are direct indicators of a potential account compromise or escalation.
- ✗
DNS logs
Why it's wrong here
DNS logs primarily record queries and responses related to domain name resolution, mapping hostnames to IP addresses. While invaluable for identifying command-and-control (C2) traffic, data exfiltration via DNS tunneling, or connections to known malicious domains, they do not directly capture user login attempts, account changes, or system access events. Therefore, DNS logs lack the specific details required to detect authentication-based security incidents such as privilege escalation.
- ✗
Firewall logs
Why it's wrong here
Firewall logs document network connection attempts, including source/destination IP addresses, ports, protocols, and the allow/deny actions taken by the firewall. They are essential for monitoring network perimeter security, identifying unauthorized network access, and detecting denial-of-service attacks. However, firewall logs typically operate at the network layer and do not contain granular details about specific user authentication events, account modifications, or internal system access, which are critical for identifying privilege escalation within an operating system or application.
- ✗
Web server logs
Why it's wrong here
Web server logs capture details about HTTP/HTTPS requests made to web applications, including client IP addresses, requested URLs, user agents, and server response codes. These logs are vital for detecting web application attacks like SQL injection, cross-site scripting (XSS), or directory traversal. While some web applications might log successful application-level logins within their specific logs, general web server access logs do not inherently record system-level authentication attempts or broader account privilege changes across an enterprise's infrastructure, making them less direct for detecting privilege escalation.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.