Running daily vulnerability scans on all corporate endpoints is primarily done to track the status of patching installations. These scans help identify any missing security patches or vulnerabilities that could be exploited by attackers. Keeping the endpoints up-to-date with the latest patches is critical for maintaining security.
* Finding shadow IT cloud deployments and monitoring hardware inventory are better achieved through other tools.
* Hunting for active attackers would typically involve more real-time threat detection methods than daily vulnerability scans.

Input validation is a primary control for preventing SQL injection. SQL injection occurs when an attacker submits malicious database commands through application input fields, URL parameters, cookies, or forms. If the application fails to validate and handle input properly, the attacker's input may be interpreted as part of a SQL query. Strong input validation rejects unexpected characters, enforces type and length restrictions, and allows only properly formatted values. It should also be paired with parameterized queries and prepared statements. DNS hijacking involves manipulation of DNS resolution, not application input. Time-of-check vulnerabilities are race-condition issues. Sideloading involves installing software outside an approved repository. Therefore, SQL injection is the vulnerability most directly prevented by input validation.

The best answer is C. Firewall logs.
The PowerShell command shown is suspicious because it uses:
-exec bypass to bypass PowerShell execution policy
IEX (Invoke-Expression) to execute downloaded content in memory
Net.WebClient.DownloadString() to retrieve a remote script from the IP address 176.30.40.50 The question asks which logs will help confirm an established connection to that IP address. The best source for confirming that network communication actually occurred is firewall logs, because they record allowed and blocked inbound or outbound network connections between systems and remote IP addresses.
Why the other options are incorrect:
A). System event logsThese may show local operating system events, but they are not the best source for confirming a network connection to a specific external IP.
B). EDR logsEDR logs may show suspicious PowerShell execution and related behavior, and in some environments they may also show network activity. However, when the question specifically asks to confirm an established connection to a particular IP, firewall logs are the most direct and standard answer.
D). Application logsApplication logs generally track application-specific events and are not the best source for validating outbound network connections to a suspicious IP.
From a Security+ perspective, suspicious script execution should be correlated with network logs to validate command-and-control or malware download activity. That makes firewall logs the best choice.

A vulnerability scan is the most likely method to identify legacy systems. These scans assess an organization's network and systems for known vulnerabilities, including outdated or unsupported software (i.e., legacy systems) that may pose a security risk. The scan results can highlight systems that are no longer receiving updates, helping IT teams address these risks.
Bug bounty programs are used to incentivize external researchers to find security flaws, but they are less effective at identifying legacy systems.
Package monitoring tracks installed software packages for updates or issues but is not as comprehensive for identifying legacy systems.
Dynamic analysis is typically used for testing applications during runtime to find vulnerabilities, but not for identifying legacy systems.

A responsibility matrix clarifies the division of responsibilities between the cloud service provider (CSP) and the customer, ensuring that each party understands and implements their respective security controls.
References: Security+ SY0-701 Course Content.