Event Log Analysis GCFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When correlating events across multiple Windows event logs to reconstruct a timeline, which field is most critical for establishing the sequence of activities?

   • AComputer Name
   • BSource
   • CEvent ID
   • DDate and Time
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which field in a Windows event log entry indicates the severity or importance of the event, such as Error, Warning, or Information?

   • ALevel
   • BUser
   • CSource
   • DEvent ID
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is investigating a malware infection. The analyst finds a suspicious process creation (Event ID 4688) in the Security log at 10:00, and a corresponding file creation in the file system at 10:02. The analyst wants to confirm that the file was created by the suspicious process. Which approach would best establish this correlation?

   • AEnable and review Process Creation auditing with command-line inclusion, then compare the process's command line to the file path
   • BEnable and review File System auditing (Audit File System) on the folder, then correlate the process ID in the file access event with the process ID in the 4688 event
   • CCompare the timestamps of the 4688 event and the file creation time
   • DCheck the parent process in the 4688 event
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic analyst is examining a Windows 10 system and finds an event with Event ID 1102 in the Security log. The event indicates that the audit log was cleared. The analyst wants to determine who cleared the log. Which field in the event entry should the analyst examine?

   • AEvent ID
   • BSubject User Name
   • CLevel
   • DSource
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An examiner is analyzing an event log entry and sees the following fields: Event ID 4688, Source: Microsoft-Windows-Security-Auditing, Level: Information, and a message that includes 'New Process Name: C:\Windows\System32\cmd.exe'. What can the examiner conclude from this entry?

   • AA service was installed, and the service name is cmd.exe
   • BA user logged on, and the process name is cmd.exe
   • CA process was created, and the process name is cmd.exe
   • DA process was terminated, and the process name is cmd.exe
   Reveal Solution Discussion Select an answer first