Log Sources and Telemetry

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Log Sources and Telemetry

Key Takeaways Explain This Topic AI

Telemetry is useful only when it is timely, trustworthy, normalized, and tied to an asset or identity.

Security monitoring commonly uses logs from endpoints, identity providers, network devices, cloud platforms, applications, and DNS.

Timestamps, source, destination, user, action, result, and asset context are core fields for investigation.

Time synchronization via NTP supports accurate cross-system correlation; UTC timestamps avoid time-zone confusion.

Log retention, write-once storage, and access control preserve evidence integrity for incident response and compliance.

Last updated: June 2026

Telemetry Is the Foundation of Detection

Telemetry is the collection of events, metrics, alerts, and records that describe what happened in an environment. On the CompTIA Security+ SY0-701 exam, logging and monitoring fall under Domain 4 (Security Operations), which carries roughly 28% of scored content — the largest single domain. A single log line rarely tells the whole story. Analysts combine endpoint, identity, network, cloud, and application data to reconstruct user behavior and system activity into a coherent timeline.

The exam expects you to know not just that logs exist, but which source answers a given investigative question. Knowing that a DNS query log reveals domain resolution, while a firewall log reveals the actual connection, is the kind of distinction performance-based questions (PBQs) test directly.

Common Log Sources and What They Answer

Source Useful events Example investigation question

Identity provider (IdP) Logins, MFA, token use, group changes Was the user authenticated from an unusual source?

Endpoint detection and response (EDR) Process starts, file writes, network connections Did a script launch a suspicious child process?

Firewall Allowed and denied traffic, 5-tuple flows Did the host connect to an unexpected destination?

Domain Name System (DNS) Name lookups, NXDOMAIN responses Did the endpoint query a suspicious or newly registered domain?

Web proxy URL access, user agent, content category Did the user download a payload?

Cloud control plane API calls, role changes, storage access Did someone open a public storage bucket or alter a security group?

Operating system (OS) Authentication, service starts, audit policy Was a privileged logon (Windows Event ID 4672) seen?

Application Authentication, transactions, errors Was sensitive data accessed or changed?

Fields That Matter

Useful logs answer five questions fast: who, what, when, where, and result . Security+ scenarios add noise, but these core fields remain constant.

• Field Why it matters
• Timestamp (UTC) Establishes sequence and supports correlation
• User or principal Ties action to an identity
• Source IP or host Shows where activity originated
• Destination Shows what was accessed
• Action Shows what was attempted
• Result Success, failure, blocked, allowed, or error
• Process or command line Distinguishes user action from malware behavior
• Asset criticality Drives response prioritization
• Worked Example: One Event vs. a Chain

Read these four normalized events as a single sequence: 2026-06-14T12:01:14Z idp user=kmorgan result=success mfa=success source_ip=198.51.100.18 device=unmanaged

2026-06-14T12:04:39Z edr host=LAP-044 user=kmorgan process=powershell.exe parent=winword.exe command="-enc SQBFAFgA..." severity=high

• 2026-06-14T12:04:41Z dns host=LAP-044 query=cdn-update-example.net result=198.51.100.77
• 2026-06-14T12:04:43Z firewall src=LAP-044 dst=198.51.100.77 dst_port=443 action=allow bytes_out=88412

The IdP line alone reads as a normal login. The combined telemetry tells a far worse story: an unmanaged-device login, a document spawning an encoded PowerShell command, a lookup to an attacker-controlled domain, and outbound HTTPS to that same resolved IP. No single source proves compromise — the correlation across sources does.

Time and Integrity

Time synchronization is critical. If endpoint clocks drift five minutes behind accurate firewall clocks, an analyst may invert cause and effect. Use Network Time Protocol (NTP) against an authoritative source and store timestamps in Coordinated Universal Time (UTC) so events from different zones line up without conversion errors.

Logs must also be protected, because attackers routinely clear event logs, stop agents, or disable audit settings to cover tracks. Defenses include:

Centralized collection so logs leave the host quickly (an attacker who owns the host cannot retroactively edit forwarded data).

Write-once / WORM storage so records cannot be altered after capture.

Access control limiting who can read or delete logs.

Alerting on log-source silence — a host that suddenly stops logging is itself a signal.

Retention policies that keep data long enough for slow-burn investigations and compliance mandates.

Normalization, Parsing, and Severity

Raw logs arrive in dozens of formats: syslog from network gear, the Windows Event log, JSON from cloud APIs, and key-value pairs from applications. Normalization parses each into a common schema so a query can compare them. Many environments standardize on syslog severity levels (0 through 7) , where 0 (Emergency) is most severe and 7 (Debug) is least. Mapping vendor-specific severities onto one scale lets analysts filter consistently. Knowing that syslog runs over UDP port 514 by default — and that secure transport adds TLS on TCP 6514 — is the kind of concrete detail Security+ rewards.

Logging the Right Volume

More logging is not automatically better. Verbose debug logging fills storage, slows search, and buries the signal. The practical target is security-relevant events: authentication outcomes, privilege changes, process execution, configuration changes, and data access. A useful test for any proposed log source is whether it would help answer a real investigative question from the table above.

Common Traps

Collecting logs but retaining them too briefly to support an investigation.

Logging only blocked traffic and missing allowed malicious traffic.

Ignoring clock drift, which scrambles event ordering.

Treating an alert as proof without reviewing the supporting telemetry chain.

Capturing high-volume debug data with no asset, user, or business context to make it actionable.

Forwarding logs in clear text over UDP 514, where they can be lost or tampered with, instead of using a reliable, encrypted transport.