Event Log Analysis GCFE Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   An analyst is investigating a Windows 10 system and needs to review events related to user logon and logoff. Which event log should the analyst examine?

   • ASecurity log
   • BSystem log
   • CApplication log
   • DSetup log
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An examiner is reviewing the Security log of a Windows 10 system and finds Event ID 4688 (process creation) with the following details: Parent Process: C:\Windows\System32\cmd.exe, New Process: C:\Users\Public\payload.exe. The examiner also finds Event ID 4104 in the PowerShell Operational log at the same time. What is the most likely sequence of events?

   • AThe user ran PowerShell, which launched cmd.exe, which then launched payload.exe
   • BThe user ran payload.exe directly, and PowerShell was used to create a scheduled task
   • CThe user ran cmd.exe, which launched payload.exe, and PowerShell was used to download or execute the payload
   • DThe user ran payload.exe, which launched cmd.exe, and PowerShell was used to clean up
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which Windows event log is the primary repository for events generated by the operating system and its services, such as driver failures and service start/stop messages?

   • ASecurity
   • BSystem
   • CSetup
   • DApplication
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   An analyst is investigating a Windows Server 2016 system and needs to review events related to system shutdowns and unexpected restarts. Which event log should the analyst examine?

   • ASetup log
   • BApplication log
   • CSecurity log
   • DSystem log
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is investigating a Windows 10 system and needs to find all events from the last 24 hours that have a Warning level in the System log. The analyst wants to use a built-in tool. Which command should the analyst use?

   • AGet-EventLog -LogName System -EntryType Warning -After (Get-Date).AddDays(-1)
   • BGet-WinEvent -FilterHashtable @{LogName='System'; Level=3; StartTime=(Get-Date).AddDays(-1)}
   • Cwevtutil qe System /q:"*[System[(Level=3)]]" /rd:true /c:100
   • DEvent Viewer with a custom view
   Reveal Solution Discussion Select an answer first