Event Log Analysis GCFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An examiner finds Event ID 4732 in the Security log of a Windows Server. The event message states: 'A member was added to a security-enabled local group.' The subject is 'CONTOSO\jsmith' and the target group is 'Administrators'. What action did the user perform?

   • ARemoved a user from the Administrators group
   • BAdded a user to the Administrators group
   • CCreated a new local group named Administrators
   • DChanged the password of the Administrators group
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing the Security log on a Windows 10 system and finds Event ID 4720, which indicates a user account was created. The analyst wants to determine which user account was created. Which field in the event entry should the analyst examine?

   • AEvent ID
   • BSubject User Name
   • CLevel
   • DTarget User Name
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is investigating a possible privilege escalation. The analyst finds Event ID 4672 (special privileges assigned to new logon) in the Security log at 10:00, and Event ID 4688 (process creation) at 10:01. The analyst wants to confirm that the process was started with the elevated privileges. Which field in the 4688 event should the analyst examine?

   • AToken Elevation Type
   • BSubject User Name
   • CProcess ID
   • DParent Process ID
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An examiner is investigating a Windows 10 system and needs to determine whether a user ran a specific PowerShell command. The examiner has access to the PowerShell Operational log, but it appears to be empty. Which other log or source could contain evidence of PowerShell command execution?

   • AThe Setup log with Event ID 2 (setup event)
   • BThe System log with Event ID 7045 (service installation)
   • CThe Application log with Event ID 1000 (application error)
   • DThe Security log with Event ID 4688 (process creation) and command line auditing enabled
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst needs to export the last 100 Security log events from a Windows 10 system to a CSV file for further analysis in a spreadsheet. The analyst wants to use a built-in command-line tool. Which command should the analyst use?

   • AGet-WinEvent -LogName Security -MaxEvents 100 | Export-Csv -Path events.csv
   • BGet-EventLog -LogName Security -Newest 100 | Out-File events.csv
   • Cwevtutil gl Security
   • Dwevtutil qe Security /c:100 /f:text > events.txt
   Reveal Solution Discussion Select an answer first