hardMultiple Choice
220-1202 Practice Question: A security incident has occurred: an employee's…
A security incident has occurred: an employee's workstation was used to access unauthorized websites. The manager wants to review recent web browsing history and application usage. Which administrative tool can provide a comprehensive timeline of user activity on the Windows 10 system?
⚠ Common exam trap
CompTIA often tests the misconception that Performance Monitor can trace user actions because of its name, but it is strictly a performance data collector, not an activity logger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event Viewer to examine Security and Application logs for user activity.
Event Viewer is the correct administrative tool because it consolidates Security logs (e.g., event ID 4624 for logons, 4648 for explicit logon attempts) and Application logs that record user activity such as web browsing and application launches. By filtering these logs, a manager can reconstruct a timeline of user actions on the Windows 10 system, including unauthorized website access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performance Monitor to create a trace of user actions.
Why it's wrong here
Incorrect. Performance Monitor tracks system performance, not user activity like web browsing.
- ✗
Task Scheduler to view past task executions.
Why it's wrong here
Incorrect. Task Scheduler shows only scheduled tasks, not general user activity.
- ✓
Event Viewer to examine Security and Application logs for user activity.
Why this is correct
Correct. Event Viewer logs security events (logons) and application events, which can help reconstruct user activity.
- ✗
Local Users and Groups to check user group memberships.
Why it's wrong here
Incorrect. This tool manages user accounts and groups, not activity logs.
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.