What is the correct answer to this question. There are two different answers for this question. One says

What is the correct answer to this question. There are two different answers for this question. One says B. DNS Logs while the other says C. System Logs. Which is correct please explain?

Question:

During a security incident investigation, an analyst consults the company’s SIEM and sees an event concerning high traffic to a known, malicious command-and-control server. The analyst would like to determine the number of company workstations that may be impacted by this issue. Which of the following can provide the information?

A. WAF logs

B. DNS logs

C. System logs

D. Application logs