SY0-701 · Objective 4.9 · Security Operations
4.9 Data sources for investigations explained
The official objective: “Given a scenario, use data sources to support an investigation.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 4.9 covers
Objective 4.9 asks which data source answers a specific investigative question. The exam gives you a goal and a list of sources, and only one of them actually holds the answer.
Log data is the largest group. Firewall logs show which connections were allowed or blocked between addresses and ports. Application logs record what an application did, such as sign-ins, errors and transactions. Endpoint logs, including data from EDR agents and tools like Sysmon, show which processes ran on a host, what files they touched and what network connections they made. Operating system security logs record authentication events, privilege use and policy changes; on Windows, the Security event log is where you find who signed in and when. IPS and IDS logs record matched attack signatures and blocked traffic. Network logs, such as from switches and routers, record device events and traffic flow. DNS logs are a special case worth remembering: they show every name a host tried to resolve, including domains it never actually connected to, which is useful for spotting malware that tries many command and control domains.
Metadata is data about data. Email headers show the path a message took. File metadata shows who created or changed a file and when. Metadata often answers 'who' and 'when' without needing the content.
The objective also lists other data sources. Vulnerability scans show which weaknesses existed on a system at a point in time, which helps explain how an attacker got in. Automated reports summarise activity on a schedule. Dashboards give a live overview at a glance. Packet captures hold the full contents of network traffic, which is the only way to see exactly what was sent, but they are large and usually kept only briefly or on demand.
Flow data, such as NetFlow, sits between logs and packet captures. It records which hosts talked, over which ports, when and how much data moved, without the contents. That makes it ideal for spotting data exfiltration by volume or unusual connections, without the storage cost of full capture.
To answer well, restate the question as 'what do I need to see?' Who signed in: OS security log. Which process made a connection: endpoint log. Which domains were looked up: DNS log. How much data left and to where: flow data. The exact payload sent: packet capture.
What candidates mix up
- NetFlow versus packet capture: flow data shows who talked and how much; a capture shows what was said.
- Firewall log versus endpoint log: the firewall sees connections at the boundary; the endpoint log shows which process on the host made them.
- DNS log versus proxy log: DNS logs show name lookups, even ones that never led to a connection.
Practice questions for 4.9
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
An investigator needs a list of the external domain names a compromised workstation tried to reach, including domains where no TCP connection was ever established. Which log source is the best fit?
- AQuery logs from the DNS resolver the workstation uses
- BNetFlow records exported from the perimeter router
- CFirewall session logs for outbound allowed traffic
- DDHCP lease logs from the workstation's subnet
Show answer and explanation
Answer: A) Query logs from the DNS resolver the workstation uses
DNS resolver query logs record every name a host looked up, so they show contacted or attempted domains even with no completed connection. Flow, firewall and DHCP logs record addresses or leases, not the domain names that were requested.
- ACorrect. Resolver query logs record the source IP, the DNS name requested, the record type, the response code and the response data. A host looks up a name before it connects, so the lookup is logged even if the connection later failed or never happened. Note that a caching resolver may log only unique, non-cached queries.
- BIncorrect. Flow records describe IP traffic (addresses, ports, byte counts). They contain no domain names, and if a connection was never attempted, there is no flow at all.
- CIncorrect. Session logs show IP addresses and ports for connections the firewall handled. They miss domains whose lookups never led to an allowed session, and they do not normally name the domain.
- DIncorrect. DHCP logs map IP addresses to MAC addresses and hostnames over time. They help identify which device had an address, but they record nothing about the destinations it contacted.
Question 2
An analyst needs to see which internal hosts communicated with which external addresses, over which ports and how much data moved, without capturing packet contents. Which data source fits best?
- ANetFlow records
- BFull packet captures
- CAntivirus logs
- DSNMP traps
Show answer and explanation
Answer: A) NetFlow records
- ANetFlow summarizes traffic flows by source, destination, ports and volume, without storing payloads.
- BPacket captures store complete contents, which is more data than needed and costly to keep.
- CAntivirus logs record malware detections on hosts, not traffic flows.
- DSNMP traps are device-initiated alerts about conditions such as link failures, not flow summaries.
Question 3
To understand exactly what data an attacker sent during an intrusion, an analyst needs the full contents of network traffic, not just summaries. Which data source is needed?
- AA packet capture
- BNetFlow records
- CAn SNMP trap
- DA vulnerability scan report
Show answer and explanation
Answer: A) A packet capture
- APacket captures record full traffic contents, enabling detailed reconstruction of what was sent.
- BNetFlow records summarize flows without payloads.
- CAn SNMP trap is a device alert, not traffic content.
- DA scan report lists weaknesses, not traffic.
Other Security Operations objectives
Also: the Security Operations domain page (28% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.