312-39V2: Certified SOC Analyst v2

Pearl is an L1 SOC analyst at a global financial institution that uses SQL Server databases to store and manage sensitive customer information. During her routine security monitoring, she sees a SOC-dashboard alert for a brute-force attack attempt against the organization’s web-application login page. While investigating, she finds multiple failed login attempts from the same IP address, followed by a successful login as a server administrator. Recognizing the possible threat, she immediately turns to the database-server logs to examine unauthorized access patterns. Her detailed log analysis reveals that the attacker brute-forced a privileged website user account and, using the compromised credentials, obtained access to the SQL Server database. Which log will help her determine whether the intruder made any unauthorized database modifications?