Question 13

Endpoint logs should be checked first to help find the root cause of the access issues.

Analyzing endpoint logs is crucial as they provide detailed information about user activities and system operations on individual devices. This data can reveal whether the security update has affected specific endpoints, leading to access problems.

A) Endpoint logs

Endpoint logs are essential for diagnosing issues related to application access, especially after a security update. They can show errors, warnings, and user activity that occurred during the time of the update, allowing the security team to pinpoint if the problem originated at the user’s device or application level.

B) IPS/IDS logs

While IPS/IDS logs monitor network traffic for suspicious activity, they are less relevant for identifying user-specific access issues. These logs may not provide direct insight into problems arising from a recent security update, making them a secondary option for troubleshooting this particular situation.

C) SIEM logs

SIEM logs aggregate data from various sources and can provide a broader overview of security incidents. However, they may not directly indicate access problems tied to a specific application after a security update, making them less useful for quickly identifying the root cause in this case.

D) DNS logs

DNS logs track domain name resolution and can help identify issues related to network connectivity. However, they do not provide information about application-level access problems caused by a security update, thus making them irrelevant for this specific scenario.

Conclusion

The correct choice to investigate first is the endpoint logs, as they provide the most direct evidence of issues stemming from the recent security update affecting user access. Other options, while potentially useful in a broader investigation, do not target the immediate concern as effectively as the endpoint logs do.