Please forgive me if this is a stupid question, but my background is in networking and I do not know a lot about webserver security.

If someone attempts to exploit a webserver, and we see in the logs that the server returned anything other than a 200 OK response (for example 404 not found or 301 moved) is it still possible that the server could have been exploited?

The reason I ask is if the response indicates that nothing could have happened, we can filter those events out as noise.

UPDATE: Thank you all for the confirmation. I just need to figure out how to get the rest of the people on my team to realize that just because a Webserver returns an error code, it does not mean that the attack did not go through. Too many times people look at that return code and stop the investigation thinking it was unsuccessful.