Multiple users report that they cannot access a certain application after a recent security update. Which of the following should the security team check first to help find the root cause?

Rationale

Endpoint logs should be checked first to help find the root cause of the application access issue.

Endpoint logs provide detailed information about the activities and status of individual devices accessing the application. By reviewing these logs, the security team can identify any errors or security policies that may have been affected by the recent security update, which could be preventing users from accessing the application.

A (Endpoint logs) CORRECT

Endpoint logs are crucial for troubleshooting access issues because they record device-specific events, including user logins, application errors, and security alerts. Checking these logs first allows the security team to pinpoint any device-related problems that could stem from the recent security update and directly impact user access.

B (IPS/IDS logs) YOUR ANSWER

Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) logs monitor network traffic for suspicious activities and potential threats. While these logs are important for identifying security incidents, they may not provide specific insights into application access issues or recent changes affecting user experiences with the application.

C (SIEM logs) YOUR ANSWER

Security Information and Event Management (SIEM) logs aggregate and analyze security data from various sources across the network. Although they can provide a broad overview of security events, they may not offer the immediate, device-specific details needed to diagnose why users are unable to access the application after an update.

D (DNS logs) YOUR ANSWER

DNS logs track domain name queries and can indicate issues related to domain resolution. However, if users are reporting access issues due to a security update, the problem is likely more related to endpoint configurations or application settings rather than DNS resolution, making these logs less relevant for this specific scenario.

Conclusion

When multiple users report access issues following a security update, the most effective first step for the security team is to examine the endpoint logs. This approach allows for the identification of device-specific issues that may be hindering access, ensuring a targeted and efficient troubleshooting process. Other logs, while valuable in different contexts, do not provide the immediate insights necessary to resolve user access problems related to recent updates.

Multiple users report that they cannot access a certain application after a recent security update. Which of the following should the security team check first to help find the root cause?

Endpoint logs should be checked first to help find the root cause of the application access issue.

Related Questions

Related Quizzes

How familiar were you with this question?

Report an Issue

Rate this Practice Test