200-201 Host-Based Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Failed logon attempts indicating a possible brute-force attack

  Why this is correct

  Event ID 4625 is logged whenever a logon attempt fails, and repeated occurrences from one source IP address indicate sustained authentication failures consistent with brute-force activity. This directly satisfies the stem's constraint of multiple 4625 events from the same source, distinguishing it from successful logons (4624) or lockouts (4740).

• ✗

  Successful logon after multiple attempts

  Why it's wrong here

  Event 4625 indicates failed authentication; a successful logon after repeated failures writes 4624, often preceded by multiple 4625 entries. It tempts because brute-force attacks end in a successful logon, but 4625 alone never confirms success, so it misreads the event's outcome field.

• ✗

  Credential validation by a domain controller

  Why it's wrong here

  Event 4625 records a failed logon attempt, not successful credential validation; validation success writes 4624. Auditors often conflate authentication events, so it tempts as the general logon category, but it would be correct only when describing successful account authentication activity on a domain controller.

• ✗

  A user account was created

  Why it's wrong here

  Account creation writes Event 4720 in the Security log, not 4625. The option tempts because repeated failed logons sometimes precede attacker-created accounts, but 4625 itself only records an authentication attempt that failed, carrying no account-provisioning detail.

Go deeper

Related to this question