A city firewall shows 10.20.30.40 contacting a rare destination at 02:00, and the SOC must name the laptop and the staff identity that held that address. What should the analyst combine?
Select an answer to reveal the explanation.
Short Explanation
An overnight IP is a locker number, not a nametag. DHCP says which laptop rented the locker, DNS helps confirm the name, and the firewall proves the session. No single civic log usually carries all three.
Full Explanation
Naming the laptop and staff identity behind firewall address 10.20.30.40 at 02:00 requires stitching address assignment, name resolution, and session evidence. The analyst should combine DHCP leases, recursive DNS, and firewall session logs for that time window: DHCP maps IP to host, DNS can corroborate hostname, firewall shows the rare destination session, and Asset and Identity can attach the staff owner. No single one of those sources fully answers both device and identity for a municipal investigation.
Firewall logs alone fail because a destination IP does not identify the laptop hostname or the human user. Badge-reader logs alone fail because physical presence does not always map to the DHCP lease on the network segment under investigation. Mail-gateway DLP alerts alone fail because exfiltration tools do not reliably register source hostname for an arbitrary rare destination, and DLP may be unrelated to this session.
Exam caveat: IP-to-host-to-user attribution is a multi-source join; exam traps offer one log as if it were complete identity proof.
Operational check: pull the DHCP lease for 10.20.30.40 at 02:00, confirm hostname via DNS, open firewall sessions for that source, then resolve owner via Asset and Identity before contacting the staff member.