Interpret System Logs 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Windows domain controller has auditing enabled for 'Audit logon events' (success and failure). You notice a large number of Event ID 4625 (failed logon) events for a single user account, but the source IP is the domain controller itself. The account is a service account used by a legacy application. What is the most likely cause?

   • AThe account is locked out and the DC is attempting to unlock it
   • BThe auditing policy is misconfigured and generating false positives
   • CAn attacker is trying to brute-force the account from the DC
   • DThe legacy application is using cached credentials that have expired, causing repeated failed logons from the DC
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Windows server is experiencing random reboots. The System log shows Event ID 41 (Kernel-Power) but no other errors before the event. The administrator suspects a hardware issue. Which additional log should the administrator check to gather more evidence?

   • ASystem log for Event ID 1001 (BugCheck) or WHEA-Logger events
   • BSetup log for Event ID 1001
   • CApplication log for Event ID 1000
   • DSecurity log for Event ID 4625
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A security analyst needs to enable auditing for failed logon attempts on a Windows server. Which audit policy should the analyst configure?

   • AAudit account management
   • BAudit logon events
   • CAudit object access
   • DAudit process creation
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A syslog server receives a message from a router with severity level 3 (errors) at 2:00 AM, but the router's clock is set to UTC while the syslog server is in Eastern Time (UTC-5). The analyst sees the message timestamp as 2:00 AM, but the actual event occurred at 9:00 PM local time. What is the best way to resolve this discrepancy?

   • AConfigure the router to use NTP and set its time zone to the same as the syslog server
   • BIgnore the time difference because syslog timestamps are not important
   • CManually subtract 5 hours from all syslog messages
   • DAdjust the syslog server's time zone to UTC
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which Windows log is used to store audit events that are generated when auditing is enabled for security-related activities?

   • ASystem log
   • BSetup log
   • CSecurity log
   • DApplication log
   Reveal Solution Discussion Select an answer first