Domain 4 is the largest part of SY0-701, and a fair portion of it is one type of question dressed up differently. A short scenario outlines what an analyst needs to figure out, and then four data sources are listed below it, and you pick one. Firewall logs. Endpoint logs. DNS query logs. Vulnerability scan results.
Most study material prepares you for the wrong version of that question. It teaches the log types as a list, detailing the fields each one contains, and quizzes you on what a firewall log includes. The exam rarely tests that. Instead, it asks which source answers the question in the scenario, and the best way to prepare is to learn the mapping from the question to the source rather than the contents of each source.
Three layers, three questions
The layer a source resides at tells you what it can prove, and that's really the key.
The boundary proves reachability. Firewall logs list source and destination IP addresses. They also include port, protocol, and the allow or deny decision, making them quick for spotting denied inbound traffic, port scans, and failed egress. A wall of denies from one internal host is a scanning or beaconing signature. What can a firewall log not tell you? What ran on the machine.
The host proves execution. Endpoint and EDR logs record process creation with the parent-child relationship intact, which is how you see that Word spawned PowerShell. They also track file system and registry changes and link an outbound connection to the exact binary that opened it. When the scenario asks about what ran, or asks you to confirm a parent process, you're dealing with the host.
The application proves what was touched. Application logs connect activity to a user ID and a session ID and a request ID and an API endpoint. That follows one actor's path through the software and shows which records got queried. Nothing at the network boundary can answer that.
The distractor is always the source that might have a clue
Question creators often use nearby sources as wrong answers. The cleanest example is packet capture against flow records. Both are network evidence, both would be in the room during an investigation, and they answer different questions.
Flow records show who talked to whom and how much and for how long. They're cheap to keep and are the backbone of network investigation, which is why they appear safe. Packet capture is the full content of the traffic at one point in the network, and it's the only source that reveals what was actually transferred. So if the scenario asks about data leaving the environment or what a session contained, you want the packet capture, even though the flow record looks relevant.
An alert and a block are different pieces of evidence
Intrusion detection and intrusion prevention are often taught together, with a slash in between. On this objective, the slash matters quite a lot. An IDS log shows an alert. An IPS log shows a block. Both provide a signature ID and the offending packets.
Why does this distinction matter? Because it is evidentiary rather than trivia. If the question is whether the attack hit its target, an IDS entry says the traffic was seen and allowed through, and an IPS entry says the session was stopped. Same signature, opposite conclusion about impact. A question asking about containment would look for the block.
Two sources that describe state rather than activity
Vulnerability scan results and configuration and change data are the other reliable distractor pair, and they fail for one reason. They describe what a system looks like rather than what happened on it. A scan says port 3389 is open and unpatched. It doesn't say anyone connected. Configuration and change records show what the device was set to and when someone made changes, which is useful for proving unauthorized changes but not for reconstructing an intrusion.
Dashboards fit into the same caution. A dashboard summarizes volume so a person can spot patterns, and it's a starting point rather than evidence. Every finding on one gets confirmed against underlying logs before it goes into a report, and an option that offers a dashboard as proof is almost always wrong.
How to drill this
Read the stem's verb first before looking at the options. Who logged in? That's authentication, so it goes to the OS security log, which means Windows Security or auth.log depending on the platform. What ran? That's execution, so it goes to endpoint logging. What was transmitted? That's content, so it's packet capture. What was reachable? That's about the boundary, so it's the firewall. There are only four verbs and they cover a lot.
Then practice the objective as a block rather than scattered through a mixed set, because the sources only separate when you see them side by side. The Domain 4 practice set is filtered to security operations, and objective 4.9 is listed as Use Data Sources to Support an Investigation in the full objectives list if you want CompTIA's own wording. Individual source names sit in the glossary as well.
One final habit. When two options both look defensible, ask which one directly answers the question and which one just contains a clue. That's the split the question was built on. Once you spot it, the four options stop being four.
Top comments (0)