Investigators need to know whether the night operator was physically inside the water plant when a suspicious workstation logon occurred. What can physical badge logs provide?
Select an answer to reveal the explanation.
Short Explanation
A badge swipe is a time clock, not a packet capture. It can support the story that the operator was on site, which is Diamond-Model victim and infrastructure context. It will not show C2, and it is not a stand-in for jump-host logons.
Full Explanation
Physical badge logs can show whether the night operator was inside the water plant when a suspicious workstation logon occurred, supporting Diamond Model victim and infrastructure context about who was where relative to the asset. They do not provide C2 or network evidence, do not replace Windows authentication on the jump host, and do not prove which password was used. Badge data corroborates physical presence; it is not a substitute for cyber telemetry in municipal investigations.
Treating badge logs as direct evidence of C2 beaconing through the plant industrial firewall fails by modality—door swipes are not packets. Using them as replacement telemetry for Windows authentication fails because physical presence is not successful domain logon evidence. Claiming they prove the operator's domain password was used from the historian confuses badge identity with credential use on a host or controller path.
Exam caveat: physical access supports context; it does not replace authentication, network, or C2 sources on SPLK-5001 items.
Operational check: align badge-in and badge-out times with jump-host Authentication events; if badge shows absence during a logon, escalate credential theft or remote access; still pull Windows and firewall logs for the cyber facts.