A Windows workstation's application log shows a series of Event ID 4625 (logon failure) entries for a standard user account, each occurring at 3:00 AM over the past week. The user denies being active at that time. The security team wants to determine whether this indicates a brute-force attack or a misconfigured scheduled task. Which two log sources should the analyst correlate to make this determination?

ForwardedEvents log and PowerShell operational log

Application log and Security log

System log and Task Scheduler operational log

A security analyst is reviewing syslog messages from a firewall and notices that the admin account has been locked out multiple times. The analyst also sees that the firewall's system log shows repeated failed SSH login attempts from the same IP address. Which action should the analyst take first?

Investigate the source IP address and correlate with other logs

Change the admin password immediately

Block the IP address at the firewall

What is the primary purpose of audit logs in a Windows system?

To record system crash dump information

To store application error messages for debugging

To track performance metrics like CPU usage

To record security-related events such as logon attempts and object access

A security team is setting up a syslog server to collect logs from multiple network devices. They want to ensure that log messages are not lost during high-volume periods and that the messages are encrypted. Which syslog implementation should they choose?

Use a proprietary logging protocol from the device vendor

Syslog over TCP with TLS (e.g., RFC 5425)

Syslog over UDP (standard port 514)

A user reports that a custom application fails to start every time the user logs in. The application writes an error to the Windows Application log. Which Event Viewer action should the administrator take to capture the error and determine the cause?

Open the System log and look for driver errors

Open the Setup log and look for installation errors

Open the Application log, find the most recent error from the application's source, and view its details

Open the Security log and look for logon failures

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 3Objective 5

Interpret System Logs 100-160 Practice Questions (Page 4)

Part of the Endpoint Security Concepts domain, which makes up ~25% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 16–20

16application · medium
A Windows workstation's application log shows a series of Event ID 4625 (logon failure) entries for a standard user account, each occurring at 3:00 AM over the past week. The user denies being active at that time. The security team wants to determine whether this indicates a brute-force attack or a misconfigured scheduled task. Which two log sources should the analyst correlate to make this determination?
Select an answer first
17application · medium
A security analyst is reviewing syslog messages from a firewall and notices that the admin account has been locked out multiple times. The analyst also sees that the firewall's system log shows repeated failed SSH login attempts from the same IP address. Which action should the analyst take first?
Select an answer first
18foundation · easy
What is the primary purpose of audit logs in a Windows system?
Select an answer first
19expert · hard
A security team is setting up a syslog server to collect logs from multiple network devices. They want to ensure that log messages are not lost during high-volume periods and that the messages are encrypted. Which syslog implementation should they choose?
Select an answer first
20application · easy
A user reports that a custom application fails to start every time the user logs in. The application writes an error to the Windows Application log. Which Event Viewer action should the administrator take to capture the error and determine the cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.