Event Log Analysis GCFE Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   An analyst sees Event ID 4624 in the Security log. What user action does this event typically indicate?

   • AA user successfully logged on to the system
   • BA user changed their password
   • CA user was added to a local group
   • DA user attempted to log on but failed
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An analyst is investigating a user who allegedly accessed a confidential file. The analyst has enabled Object Access auditing and finds Event ID 4663 (file access) in the Security log. The event shows the file name and the user, but the analyst needs to determine if the user actually read the file or just opened it to view properties. Which field in the event entry should the analyst examine?

   • AEvent ID
   • BProcess Name
   • CObject Type
   • DAccess Mask
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   An examiner is using Event Viewer to analyze a Windows 10 system. The examiner needs to find all events from the last 7 days that have a level of 'Error' or 'Critical' across multiple logs. What is the most efficient built-in method?

   • ACreate a custom view that includes all logs and filters by level and time
   • BOpen each log individually and apply a filter for level and time
   • CUse the 'Filter Current Log' option on the Application log only
   • DExport all logs to XML and search in a text editor
   Reveal Solution Discussion Select an answer first