A city SOC already has a perimeter firewall. Leadership asks who connected to the water-plant jump host. Which data source is most useful?
Select an answer to reveal the explanation.
Short Explanation
"Who talked to the jump host" is a conversation log, not a library overdue list. Firewall or stream telemetry saw the session; the parks CMS and City Hall badges did not.
Full Explanation
Connection questions are answered by network-defense telemetry: firewall accept/deny logs, network-traffic CIM, or stream session data that include source, destination, and time for the water-plant jump host. A public website CMS, physical badge events without network fields, and library catalog records do not reconstruct who connected. The existing perimeter firewall is already a high-value source for this civic use case; the analyst should search it (or equivalent stream) rather than unrelated applications.