An administrator is concerned that PCs on the internal network may be acting as zombies
participating in external DDoS attacks. Which of the following could BEST be used to confirm the
administrator’s suspicions?

A.
Proxy logs

B.
AV server logs

C.
HIDS logs

D.
Firewall logs