Performance-based questions

The part of the exam that fails the most people. Partial credit applies, so place what you know.

1 of 3
4.9Performance-based~4 min

Place each investigative question on the data source that answers it best.

Tap an item, then tap where it belongs

  • Email metadata / headers

    • Empty

  • OS security log

    • Empty

  • Endpoint / EDR log

    • Empty

  • Firewall log

    • Empty

  • NetFlow

    • Empty

  • Packet capture

    • Empty