Which of the following is least likely to be a primary blue team logging source?

• A. Mobile game analytics
• B. Firewalls
• C. EDR
• D. Web proxies

Answer: (D)

The main idea is to focus on logging sources that provide direct, actionable visibility into security events across the environment. Endpoints with EDR give you detailed, real-time insight into what programs run, what files change, and suspicious behavior on individual machines. Firewalls capture the traffic that enters and leaves the network, showing what was allowed or blocked and helping you spot anomalous patterns at the perimeter. Web proxies also log web activity and can reveal risky browsing or data exfiltration attempts, which is valuable for security monitoring.

Mobile game analytics, however, are typically telemetry aimed at developers for engagement, performance, and user behavior within a game. They’re not designed to reflect the organization's security posture or incidents, and they generally don’t map to enterprise threat signals. While web proxy data is useful, its coverage and relevance can be less universal across diverse environments (due to TLS encryption, direct internet access, or cloud-based access methods), making it less of a reliable primary source in some contexts compared to endpoints and firewalls. For these reasons, web proxies are considered the least likely to be a primary blue team logging source in this set.