Investigating user activity, application usage, and detected threats relies on specific firewall log types: - Option A (Correct): Traffic logs record details about every session flowing through the firewall that matches a logging-enabled security policy rule. They include source/destination IP/port, zones, application ID, user ID, action (allow/deny/drop), and session duration. This is fundamental for seeing who accessed what application. - Option B (Correct): Threat logs record all detected security threats, including malware, exploits, spyware, and command-and-control activity, based on the applied Threat Prevention, Antivirus, and WildFire profiles. These logs directly indicate malicious activity. - Option C (Correct): URL Filtering logs record details about URL access attempts, including the requested URL, the URL category, the configured action (allow/block/alert), the source user, and the destination IP. This is essential for tracking user access to specific websites, including known malicious ones. - Option D (Incorrect): Configuration logs track changes made to the firewall's configuration, which is not relevant for investigating traffic-related security incidents. - Option E (Incorrect): System logs record events related to the firewall's operation (e.g., interface status changes, daemon restarts, resource utilization) but not the details of user traffic or detected threats within those flows.