A+ V14 Event Viewer Security Log Auditing

1. Event ID 4672 indicates the assignment of which type of privilege?

Administrative privileges

User rights

Special privileges

Network access rights

2. Event ID 4740 in the Security log indicates which type of account event?

Account creation

Account locked out

Password expiration

Account enabled

3. In Event Viewer, the Forwarded Events log is used for which purpose?

Storing application-specific events

Collecting events from remote computers

Archiving old security events

Tracking system performance metrics

4. Which Windows command-line tool is used to query and configure audit policies?

Eventvwr.exe

Auditpol.exe

Wevtutil.exe

Logman.exe

5. What is the purpose of archiving Event Viewer logs?

To free disk space and retain historical data

To prevent unauthorized access to logs

To automatically delete old events

To reduce system performance overhead

6. Event ID 4720 in the Security log indicates which account-related event?

Account deletion

User account created

Password reset

Account disabled

7. In Event Viewer, which filter option allows you to search for events containing specific text?

Event ID filter

Source filter

Keywords or Description search

Level filter

8. Which audit policy setting enables tracking of file and folder access?

Audit Logon Events

Audit Object Access

Audit Directory Service Access

Audit Account Logon

9. What does the System log in Event Viewer primarily track?

User login activity

Application errors and service issues

Hardware, driver, and Windows service events

Network connection attempts

10. Which Event Viewer feature allows you to save filtered log data for later analysis?

Export to CSV

Create Custom View

Archive Log

Both A and B

11. Which Windows tool is the primary interface for viewing system, security, and application logs?

Event Viewer

Performance Monitor

Device Manager

Task Manager

12. What command opens Local Group Policy Editor to configure audit policies?

Eventvwr.msc

Auditpol.exe

Gpedit.msc

Services.msc

13. Which audit policy category tracks user account management events?

Logon/Logoff

Account Management

Privilege Use

Policy Change

14. In Event Viewer, what does filtering by Event Level allow you to view?

Only critical errors and warnings

Events by severity: Critical, Error, Warning, Information, Verbose

Events from specific applications only

Events within a specific time range

15. What is the maximum default size of the Security log before events are overwritten?

512 KB

1 MB

20 MB

100 MB

16. Event ID 4625 in the Security log indicates which type of security event?

Successful logon

Failed logon attempt

Account enabled

Privilege use

17. Which tool is used to configure which security events are logged on a Windows system?

Event Viewer only

Audit Policy settings

Group Policy Editor

Both B and C

18. What does Event ID 4624 typically indicate in the Security log?

Account lockout

Successful account logon

Failed logon attempt

Password change event

19. In Event Viewer, which log type records events related to application functionality and errors?

Security log

System log

Application log

Forwarded Events log

20. What is the primary purpose of the Security log in Event Viewer?

Track application crashes and errors

Record authentication attempts and security events

Monitor hardware driver issues

Log network connectivity changes

A+ V14 Event Viewer and Security Log Auditing Quiz