A city SOC already has a perimeter firewall. Leadership asks who connected to the water-plant jump host. Which data source is most useful?
Select an answer to reveal the explanation.
Short Explanation
"Who talked to the jump host" is a conversation log, not a library overdue list. Firewall or stream telemetry saw the session; the parks CMS and City Hall badges did not.
Full Explanation
Leadership asking who connected to the water-plant jump host is a network-connection question. The most useful sources are firewall or network-traffic logs (or Splunk Stream) that record sessions to that jump-host address or hostname—source, destination, time, and ideally identity or zone context. Those records let the city SOC answer who talked to the OT jump point without inventing unrelated civic systems as substitutes.
Public parks-and-recreation website CMS access logs fail by scope: web CMS activity does not document jump-host connections on the water-plant network. Badge-reader door events at City Hall lack network fields and place people at a door, not on a TCP session to the jump host. The library catalog's overdue-book database is an application inventory of loans, not connection telemetry to OT infrastructure.
Exam caveat: match the data source to the question type—connection questions need firewall/traffic (or equivalent), not physical access or unrelated application databases.
Operational check: identify the jump host's IPs and management interfaces, search CIM Network_Traffic or firewall indexes for those destinations in the incident window, correlate with Asset and Identity, and only then enrich with badge or CMS data if physical or web context is a separate question.