A Security+ V8 investigation question may identify an artifact and ask what it proves. The fastest way to choose correctly is to define the question first: who authenticated, which systems talked, what traversed the network, or what existed in memory? No one artifact can answer all four.
1. Start with the investigative question
| Question | Likely evidence | Limit |
|---|---|---|
| Who signed in? | Identity-provider or authentication logs | Logs can identify an account without proving a particular person operated it |
| Which endpoints exchanged traffic? | NetFlow or IP Flow Information Export (IPFIX) | Flow summaries do not supply full application content |
| What was inside a transfer? | Full packet capture where available | Encrypted payloads may remain unreadable |
| What process was running? | Endpoint process telemetry or memory capture | A later snapshot may miss earlier transient activity |
| What was on the storage device? | Forensic disk image | A disk image does not automatically preserve volatile memory |
An alert is a starting clue. Correlate it with a primary source before claiming a malicious action occurred.
2. Logs and identity evidence
Authentication logs can reveal sign-in time, result, account, source address, device details, and sometimes a risk decision. Endpoint logs add process creation, services, file operations, and security events. DNS logs show name-resolution requests; firewall and web proxy logs show allowed or blocked connections.
Example: A login monitor flags impossible travel. Two authentications from distant locations close in time support the alert, especially with timestamps, source addresses, and authentication outcomes. They do not by themselves prove two different people used the account. VPN egress, shared gateways, inaccurate IP geolocation, or session-token abuse can affect interpretation.
Time zones, clock drift, retention settings, and missing log fields can change the reconstruction. Normalize times before building a timeline.
3. Flow records and packet captures
NetFlow and IPFIX summarize network conversations. Typical records describe the source and destination, addresses and ports, protocol, counts, and time. A flow record helps identify who communicated, when, and approximately how much.
A packet capture records network packets. Depending on capture location and configuration, it may include headers and application payload. Encryption still protects the payload when the analyst lacks the relevant decryption context. Packet capture can also be incomplete because of filtering, dropped packets, or capture starting after the incident.
Example: An endpoint transfers an unusual amount of data to an external address. IPFIX can support a volume-and-destination finding. It cannot establish the exact confidential file contents. File-access records, data-loss-prevention alerts, or packet evidence may be needed to establish what was transferred.
4. Memory, disk images, and snapshots
A memory capture can preserve volatile state: running processes, loaded modules, some network connections, and other in-memory artifacts. Collecting memory can itself change system state, so follow the investigative procedure and document actions.
A forensic bit-level disk image is intended to preserve storage contents for analysis, including relevant areas outside ordinary visible files. Hash the acquisition and record how it was collected and stored. A filesystem backup or cloud snapshot may be operationally valuable, but it is not automatically equivalent to a forensic image.
For cloud systems, use the provider's available audit logs, snapshots, and instance metadata while noting which artifacts the provider exposes and which actions are outside the investigator's control.
5. Timestamps, integrity, and custody
Evidence is more useful when the team can explain where it came from and how it was handled.
- Chain of custody records collection, transfers, handlers, storage, and relevant actions.
- Hash values help show whether a particular acquired file or image has changed since hashing. They do not prove that the original content was accurate.
- Time normalization allows events from systems using different zones and clocks to be compared.
- Preservation decisions consider volatility: a shutdown can erase memory and some temporary artifacts.
- Scope and authority matter. Investigators must follow organizational, legal, and privacy requirements.
A dashboard screenshot can guide the investigation, but the retained event records generally provide better detail for verification.
6. Choose an evidence source
| Scenario | Choose first | Reason |
|---|---|---|
| Trace repeated failed logins against one user | Authentication event logs | Contain account, result, time, and source context |
| Confirm an unusual outbound traffic spike | Flow export | Shows network endpoints, time, and volume |
| Inspect a suspicious unencrypted request | Packet capture | Can provide protocol and payload evidence |
| Determine whether a malicious process was in RAM | Memory acquisition | Preserves volatile state |
| Reproduce analysis on a preserved drive | Forensic disk image | Captures storage for controlled examination |
7. Rapid review grid
- Identity and login outcome: Authentication logs.
- Network conversations and volume: NetFlow or IPFIX.
- Packets and protocol details: Packet capture.
- Running and volatile artifacts: Memory acquisition.
- Preserved storage examination: Forensic disk image.
- Evidence integrity and handling: Hashes plus documented custody.
These tools complement each other. A strong answer matches the evidence to the exact claim rather than choosing whichever artifact sounds most technical.