A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?
A) email security appliance
B) DNS server
C) Antivirus solution
D) network device

Question

Quizplus · Accepted Answer

DNS server logs can provide information about the external site that the malware-infected file is attempting to beacon to.

A Scanner Detected a Malware-Infected File on an Endpoint That