200-201 Host-Based Analysis Practice Question
An analyst is examining a Windows system for evidence of privilege escalation or credential theft. Which THREE Event IDs should the analyst focus on in the Security log? (Select THREE)
⚠ Common exam trap
Cisco often tests the distinction between Event IDs that log authentication attempts (4624, 4625) versus those that log credential usage (4648, 4776), trapping candidates who confuse successful logons (4624) with evidence of credential theft.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
4648
Event ID 4648 (A logon was attempted using explicit credentials) is correct because it records when a user explicitly provides credentials to run a program or service, which is a common technique in privilege escalation (e.g., runas) and credential theft (e.g., pass-the-hash). This event captures the target account, source process, and target workstation, making it invaluable for detecting lateral movement or credential misuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
4648
Why this is correct
Explicit credentials logon, often used with runas for privilege escalation.
- ✓
4776
Why this is correct
Credential validation events can indicate pass-the-hash or brute-force.
- ✗
4720
Why it's wrong here
Account creation may be part of persistence, not directly privilege escalation.
- ✗
4625
Why it's wrong here
Failed logon events indicate brute-force attempts, not necessarily privilege escalation.
- ✓
4624
Why this is correct
Successful logon events can reveal lateral movement.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.