How should this type of evidence be categorized?

Refer to the exhibit.

An analyst received this alert from the Cisco ASA device, and numerous activity logs were produced .

How should this type of evidence be categorized?
A . indirect
B . circumstantial
C . corroborative
D . best

View Answer

Answer: C

Explanation:

Indirect=circumstantail so there is no posibility to match A or B (only one answer is needed in this question). For suer it’s not a BEST evidence – this FW data inform only of DROPPED traffic. If smth happend inside network, presented evidence could be used to support other evidences or make our narreation stronger but alone it’s mean nothing.