🛡️ Free practice test question from: Log types (Security+)

Packet capture (PCAP) logs would be the most effective log type to determine the actual data that was exfiltrated. Packet captures can provide the complete payload data transferred over the network, allowing the analyst to reconstruct exactly what was sent.

*****

A) DNS logs only show the domain names resolved, which can indicate the intended destination but not the actual data sent. The connection could have failed, or different data could have been sent than what the domain name suggested.

B) Firewall logs show the connection details (IPs, ports), confirming communication occurred, but they do not log the content of the communication. They show that a connection happened, not what was sent.

C) Network logs provide summaries of network traffic, including the volume of data transferred. This is helpful for identifying potentially large data exfiltration events, but it doesn't reveal the specific content of the data. They show how much data was sent, not what data was sent.