An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)

Network logs provide crucial information about traffic flow, source and destination IP addresses, ports, and protocols, which can pinpoint the internal host communicating with the command-and-control server. Firewall logs record allowed and denied connections, including source and destination IPs and ports, making them essential for identifying unauthorized outbound connections to a malicious server and the internal host initiating them. Application logs track activity within specific applications, not necessarily network connections. Authentication logs focus on user login attempts. DHCP logs assign IP addresses but don't detail ongoing network communications. Database logs track database queries and access, not network-level communication with external servers.