CompTIA · Security+ SY0-801
Investigation data
Security+ SY0-801 · Lesson 26 of 32 · 3:58:20
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the Security+ SY0-801 exam (CompTIA Security+ V8). In this lesson: log and trace data types (firewall, application, endpoint, operating system, and network logs, plus metadata), data sources like vulnerability scans, NetFlow, and packet captures, integrity and system images (memory dumps and bit-level copies), stakeholders, and log parsing. Includes three original practice questions.
Preview the topics
- Investigators know that a laptop sent data to an outside address, but they need the full content of what was sent, and the traffic was not encrypted. Which source shows it?
- An investigation shows that a buyer at Ashgrove approved fake invoices from a supplier that does not exist. Besides legal, which teams should join the investigation?
- Before turning off a compromised server, investigators want its running processes, its open connections, and the encryption keys in memory. What must they capture first?