[&] What are the three main categories of log sources in the context of incident response?
- Physical, digital, and logical logs
- Hardware, software, and user logs
- Endpoint, network, and application logs -- Correct
- System, application, and database logs

[&] What activity can be detected using network logs?
- Lateral movement between hosts -- Correct
- Application crash analysis
- Software installation records
- Creating new user accounts

[&] What type of log would you examine to diagnose software or hardware failures?
- Cloud log
- Application log
- Endpoint log -- Correct
- Network log

[&] In the context of logging, what does the term 'log shipping' refer to?
- Moving log files physically between locations
- Converting logs into a readable output format
- Formatting and sending logs to a SIEM for analysis -- Correct
- Packaging log data for remote storage