hardMultiple ChoiceObjective-mapped

CS0-003 A company uses a centralized logging solution Practice Question

A company uses a centralized logging solution. A security analyst receives a log from a host indicating a user account 'jsmith' was created locally on a server. The analyst suspects this is a backdoor account. Which of the following log sources would provide the most context to confirm the creation method and identify the responsible process?

⚠ Common exam trap

CompTIA often tests the distinction between detection (Event ID 4720) and forensic attribution (Sysmon Event ID 1), leading candidates to choose the security log that confirms the event occurred rather than the log that reveals how and by what process it was executed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sysmon Event ID 1 (Process creation)

Sysmon Event ID 1 captures every process creation event with detailed command-line arguments, parent process information, and hashes. This allows the analyst to see exactly which executable (e.g., net.exe, powershell.exe, or a custom script) created the 'jsmith' user account and what command-line parameters were used, providing definitive evidence of the creation method and responsible process.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Sysmon Event ID 1 (Process creation)
Why this is correct
Sysmon Event ID 1 provides highly granular details about process creation, including the executable's full path, command-line arguments, user context, and critically, the parent process that initiated it. This rich contextual information is invaluable for tracing the execution chain and understanding how a new account might have been created, such as via an unusual script or malicious binary. It allows security analysts to quickly identify the root cause and the specific method used for account creation.
✗
Network logs
Why it's wrong here
Network logs primarily capture communication metadata, such as source and destination IP addresses, ports, protocols, and traffic volume between systems. While essential for detecting network-based attacks or data exfiltration, they offer no visibility into internal host-level process creation events or the parent-child relationships of processes executing locally on an endpoint. Therefore, they cannot directly reveal the specific process responsible for creating a user account on a machine.
✗
Application logs
Why it's wrong here
Application logs record events specific to the operation of a particular software application, detailing actions like user logins within the application, database transactions, or application errors. These logs are designed to monitor the application's internal state and user interactions, not the underlying operating system's process creation activities. Consequently, they typically lack the system-level detail required to identify which process initiated the creation of a new user account.
✗
Windows Security Event Logs (Event ID 4720)
Why it's wrong here
Windows Security Event ID 4720 specifically logs the creation of a new user account, providing details such as the new account's name, SID, and the security principal (user) who performed the action. However, this native Windows event log critically omits the *process* that initiated the account creation, including its executable path or parent process. Without this crucial process context, it's challenging to determine the exact method or tool used to create the account, hindering a thorough forensic investigation.

Go deeper

CS0-003 A company uses a centralized logging solution Practice Question

Why each option matters

Option-by-option breakdown

Related to this question