Which event log entry would most likely indicate that a service was installed on a Windows system?

An Event ID 6005 in the System log

An Event ID 4624 in the Security log

An Event ID 7045 in the System log

An Event ID 1000 in the Application log

An examiner is reconstructing a timeline of a malware infection. The examiner finds the following events: 10:00:00 Event ID 4624 (logon), 10:00:05 Event ID 4688 (process creation: wscript.exe), 10:00:10 Event ID 4104 (PowerShell script block), 10:00:15 Event ID 5140 (network share access). Which event is most likely the initial infection vector?

Event ID 5140 (network share access)

Event ID 4104 (PowerShell script block)

Event ID 4688 (process creation: wscript.exe)

An examiner is reconstructing a timeline of a data exfiltration incident. The examiner has access to the Security log, System log, and PowerShell Operational log. Which sequence of events would best indicate that a user used PowerShell to download and execute a script that accessed a network share?

Security log: logon (4624) → PowerShell Operational: script block (4104) → Security log: network share access (5140)

PowerShell Operational: script block (4104) → System log: shutdown (1074) → Security log: logon (4624)

System log: service start (7045) → Security log: logon (4624) → PowerShell Operational: script block (4104)

Security log: network share access (5140) → PowerShell Operational: script block (4104) → Security log: logon (4624)

An examiner is reviewing the Security log of a Windows 10 system and finds Event ID 4624 with Logon Type 10. The user is a standard user. What does this event indicate?

The user logged on locally at the console

The user accessed the system via Remote Desktop (RDP)

GIAC Certified Forensic Examiner

Domain 4Objective 2

Event Log Analysis GCFE Practice Questions (Page 1)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 1–5

1foundation · easy
Which event log entry would most likely indicate that a service was installed on a Windows system?
Select an answer first
2expert · hard
An analyst is reconstructing a timeline of a user's activities. The analyst has the following events: Event ID 4624 (logon) at 09:00, Event ID 4688 (process creation) at 09:02, Event ID 4663 (file access) at 09:05, and Event ID 4634 (logoff) at 09:10. The analyst wants to confirm that the file access was performed by the user who logged on. Which field in the 4663 event should the analyst compare with the 4624 event?
Select an answer first
3expert · hard
An examiner is reconstructing a timeline of a malware infection. The examiner finds the following events: 10:00:00 Event ID 4624 (logon), 10:00:05 Event ID 4688 (process creation: wscript.exe), 10:00:10 Event ID 4104 (PowerShell script block), 10:00:15 Event ID 5140 (network share access). Which event is most likely the initial infection vector?
Select an answer first
4application · medium
An examiner is reconstructing a timeline of a data exfiltration incident. The examiner has access to the Security log, System log, and PowerShell Operational log. Which sequence of events would best indicate that a user used PowerShell to download and execute a script that accessed a network share?
Select an answer first
5application · medium
An examiner is reviewing the Security log of a Windows 10 system and finds Event ID 4624 with Logon Type 10. The user is a standard user. What does this event indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Event Log Analysis GCFE Practice Questions (Page 1)

Questions 1–5

Which event log entry would most likely indicate that a service was installed on a Windows system?

An examiner is reconstructing a timeline of a data exfiltration incident. The examiner has access to the Security log, System log, and PowerShell Operational log. Which sequence of events would best indicate that a user used PowerShell to download and execute a script that accessed a network share?

An examiner is reviewing the Security log of a Windows 10 system and finds Event ID 4624 with Logon Type 10. The user is a standard user. What does this event indicate?

Keep studying — System and Device Analysis