Exam CS0-003 topic 1 question 295 discussion

tcpdump. The keyword is "non-secured communication". tcpdump allows you to analyze the "malicious intent" over a "non-secured communication" as the traffic is readable.

Why would you not check Directory these are user accounts

D. IDS (Intrusion Detection System) logs IDS logs are specifically designed to detect and log potentially malicious activity.

D - IDS. Best choice for detecting Malicious activity.

D. IDS An Intrusion Detection System (IDS) is designed to monitor network traffic for malicious activity. In this case, an IDS can detect non-secure connections to the identity provider, potentially indicating malicious intent. By analyzing the traffic patterns, the IDS can provide valuable insights into the nature of the attack, such as the source IP address, the affected user accounts, and the specific vulnerabilities exploited. While DNS, tcpdump, and directory logs can provide useful information, they are not specifically designed to detect malicious intent. DNS logs can show domain resolution, tcpdump can capture network traffic, and directory logs can show user authentication attempts, but they may not provide the level of context and threat intelligence that an IDS can offer.