Your firewall log knows a connection happened and nothing about what it carried

Security Operations is the biggest domain on Security+ SY0-701, at 28 percent. Threats and Vulnerabilities is 22. Security Architecture is 18. A good share of that biggest domain is scenario questions where something has already gone wrong and you have to say which data source can answer the question in front of you. Most people study the attacks and skip the artifacts. Then the exam hands them a breach and four log types, and asks which one saw it. Can you say why three of them could not have? Every log is a witness with a fixed vantage point The question is never which log is best. It is which log was standing somewhere that it could have seen the thing being asked about. Read the options that way and most of them eliminate themselves. Here is the vantage point of each source, and, more useful, the boundary where it goes blind. Firewall logs. A connection was allowed or denied between two addresses and ports at a particular time. That is the whole story. It does not know what traveled inside the connection, and if the traffic was encrypted then nothing about the payload was ever available to it. Very good for "did this host ever talk to that address." Useless for "what did the attacker run." Endpoint and OS security logs. Processes that started, and accounts that logged on. Privileges that got used, on that machine. This is where "what did the attacker actually do" lives, and it is where you find which account was used. It is blind to any host that was not running an agent, which is the second half of most exam scenarios. Application logs. The event in the application's own terms. There is no other source that knows which query ran or which record was touched. Blind to everything happening outside that application. IDS and IPS logs. A signature matched. Notice what that sentence claims and what it does not. It tells you what the sensor thinks it saw, which is a claim about a pattern rather than a statement about impact. A high severity alert on a blocked attempt and a high severity alert on a successful one look much the same in the log. Network flow logs. Who talked to whom, and how much. This is the source for exfiltration volume questions, because it can show three gigabytes leaving at two in the morning without knowing a byte of what was in it. Packet captures. Everything, at the cost of storage and of having decided to capture before the incident. When a question offers a capture, check whether the scenario ever said anyone was capturing. Often it did not, and that is the trap. Metadata. Headers without content. In an email scenario that is the routing and the addresses, with none of the message body. The test that resolves most of these items Read what the question is trying to establish. Then ask whether the artifact was positioned to observe that specific thing. If the question is about content and the artifact only records connections, that option is wrong, no matter how sensible it looks sitting in the list. Two traps live in the gap between those two sentences. The first is picking the source with the most data instead of the one with the right vantage point. Packet capture is the most complete answer on paper and the wrong answer most of the time, because nobody had it running. The second is treating an absence of events as evidence that nothing happened. A host with no logging agent produces no events, whether or not it was compromised. Exam scenarios lean on this. So does real work. Why firewall logs are the ones people misjudge Of all of these, the firewall log is where I see the most confusion, and I think the reason is that people learn firewalls as a concept and never read a rule set as a document. A rule set is evaluated in order. The first rule that matches wins, and everything below it never runs. So a broad allow sitting above a specific deny means the deny is decoration, and the log will faithfully record the traffic being permitted with no hint that a rule further down was meant to stop it. Read as a list of decisions, those entries make sense. Read as a mystery, they do not. The fastest way to fix that is to work an actual rule set rather than read about one. I built a free firewall exercise that runs in the browser with no account, at secplusmastery.com/security-plus-pbq. It is mine, so weigh it accordingly. Professor Messer's free SY0-701 series and Jason Dion's practice exams come at the same ground from the other direction. One study move worth the time Pull the V7 objectives from CompTIA's Security+ page. The form there hands them over along with a practice test, in exchange for an email address. Find the objectives that deal with data sources and investigations. For each source listed, write one sentence saying what it can prove and one saying where it goes blind. Fourteen sentences, maybe twenty minutes. It converts a memorized list into a decision you can make under a clock, which is the only form of it the exam will accept.