Event Log Analysis GCFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic analyst is investigating a Windows 10 workstation. The user claims they did not log in during the night, but the analyst finds successful logon events in the Security log. The analyst wants to determine whether the logon was interactive at the console or remote. Which field in the event log entry should the analyst examine?

   • ASource
   • BEvent ID
   • CLevel
   • DLogon Type
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An examiner is investigating a possible privilege escalation. The examiner finds Event ID 4672 in the Security log, which indicates special privileges were assigned to a new logon. Which additional event should the examiner look for to confirm that a user was added to the Administrators group before this logon?

   • AEvent ID 4624 (successful logon)
   • BEvent ID 4732 (member added to security-enabled local group)
   • CEvent ID 7045 (service installation)
   • DEvent ID 4688 (process creation)
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is reconstructing a timeline of a suspected intrusion. The analyst finds a successful logon (Event ID 4624) in the Security log at 10:00, a process creation (Event ID 4688) in the Security log at 10:05, and a service installation (Event ID 7045) in the System log at 10:10. The analyst wants to confirm that the process creation was initiated by the user who logged on. Which additional data source would best confirm this?

   • AThe process creation event's 'Creator Process Name' and 'Subject User Name' fields
   • BThe logon event's 'Logon GUID' field
   • CThe service installation event's 'Service Name' field
   • DThe System log's 'Event ID 7045' source
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is investigating a data exfiltration incident. The analyst finds a successful logon (Event ID 4624) in the Security log at 09:00, a PowerShell process creation (Event ID 4688) at 09:05, and a network connection to an external IP (Event ID 5156) in the Security log at 09:10. The analyst wants to prove that the PowerShell process made the network connection. Which approach would best establish this correlation?

   • ACheck the source IP address in the 5156 event
   • BCompare the Logon GUID in the 4624 event with the Logon GUID in the 5156 event
   • CCheck the destination port in the 5156 event
   • DCompare the Process ID (PID) in the 4688 event with the Process ID in the 5156 event
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which built-in Windows utility provides a graphical interface to view, filter, and export event logs?

   • AResource Monitor
   • BPerformance Monitor
   • CEvent Viewer
   • DTask Manager
   Reveal Solution Discussion Select an answer first