Question 54

Application logs should be retrieved for the investigation.

Application logs are essential for tracking user activity, including login attempts, on a cloud-based webmail platform. They provide detailed information about the specific actions taken by users, including the source IP addresses associated with those actions.

A) Network

Network logs focus on monitoring traffic flow across the network but do not provide specific details about user interactions with applications. While they may indicate that a connection was made, they lack the granularity needed to identify who logged in and from which IP address.

B) Application

Application logs record detailed information about user sessions, including successful and failed login attempts, user behavior, and associated metadata like source IP addresses. This makes them the most appropriate choice for the security analyst to determine the origin of the compromised login.

C) System

System logs typically contain information about the operating system's activities and events, such as system errors and configuration changes. They do not track user-specific actions related to application usage, making them irrelevant for this investigation.

D) Firewall

Firewall logs monitor traffic that passes through the firewall and can indicate attempted connections. However, they do not provide detailed information about user behavior within specific applications, which is necessary to ascertain the source of the compromised login.

Conclusion

The application logs are definitively the right choice as they provide the detailed user activity information needed to trace the source IP of the login. Other options, such as network, system, and firewall logs, do not offer the specific insights required for investigating user actions within a webmail application. Thus, they fail to meet the needs of the security analyst in this scenario.