Question 17

Application logs should be retrieved to review information about the source IP for the login.

Application logs contain detailed records of user activities, including login attempts, which would provide the necessary information about the source IP associated with the compromised credentials.

A) Network

Network logs primarily capture traffic data and may include information about connections and data packets. However, they do not typically provide specifics on user-level activities such as logins, making them less relevant for investigating compromised credentials in a webmail application.

B) Application

Application logs are the most relevant for this scenario as they document user interactions with the application, including successful and failed login attempts. This log type will provide the exact source IP address from which the webmail login was attempted, making it essential for the investigation.

C) System

System logs generally track system-level events and operations, such as system errors and service status changes. While they can provide some insights into the overall health of the system, they do not focus on user-specific actions like logins, thus failing to deliver the necessary information regarding the source IP.

D) Firewall

Firewall logs monitor and log traffic that passes through the firewall, noting blocked or allowed connections. Although they can indicate whether a specific IP address was allowed or denied access, they do not provide detailed application-level information such as user login attempts, making them insufficient for this investigation.

Conclusion

The application logs are definitively the correct choice as they specifically track user login attempts and include the source IP information needed for the investigation of compromised credentials. Other options, while related to network security, do not provide the detailed user-level data required to analyze the situation effectively.