hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A security incident occurred where an…
A security incident occurred where an unauthorized user accessed a workstation. You need to review the event logs to determine when the breach happened. Which Control Panel applet would you use to launch the Event Viewer?
⚠ Common exam trap
CompTIA often tests the distinction between the Security and Maintenance applet (which shows security status but not logs) and Administrative Tools (which contains Event Viewer), leading candidates to mistakenly choose Security and Maintenance because of the word 'Security' in the name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Administrative Tools
Administrative Tools is the Control Panel applet that provides access to advanced system tools, including Event Viewer. To investigate a security breach, you would open Administrative Tools and then launch Event Viewer to review security logs for unauthorized access events. This is the correct path because Event Viewer is not directly listed in the main Control Panel categories; it is nested within Administrative Tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System
Why it's wrong here
The 'System' control panel item primarily provides an overview of basic computer information, such as the Windows edition, processor type, installed RAM, and computer name. It also offers quick access to settings for remote desktop, system protection, and advanced system properties. However, it does not contain direct links or functionality to launch the Event Viewer for detailed log analysis, making it unsuitable for investigating security incidents.
- ✗
Security and Maintenance
Why it's wrong here
The 'Security and Maintenance' utility acts as a centralized dashboard, consolidating high-level alerts and status information regarding system security, updates, and general maintenance tasks. While it might report on critical issues, it only provides summary information and does not offer the granular detail or direct access to the Event Viewer necessary for in-depth investigation of specific security events. Its purpose is to inform users of potential problems, not to serve as a forensic analysis tool.
- ✓
Administrative Tools
Why this is correct
The 'Administrative Tools' folder is the designated location within Windows for a collection of advanced system utilities and management consoles, specifically designed for administrators and power users. This comprehensive suite includes essential tools like Event Viewer, Performance Monitor, Services, and Computer Management, which are critical for diagnosing system issues, monitoring performance, and investigating security incidents. Accessing Event Viewer through Administrative Tools provides the necessary interface to review detailed security logs for unauthorized access.
- ✗
Device Manager
Why it's wrong here
Device Manager is a dedicated utility for managing and troubleshooting hardware components connected to a computer, allowing users to view installed devices, update or roll back drivers, and check for hardware conflicts. Its primary function revolves around hardware configuration and driver status, providing no direct or indirect access to system event logs or security audit trails. Therefore, it is entirely unrelated to the task of analyzing software-generated events or investigating unauthorized user access.
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.