CHFI OS and Network Forensics Practice Question
Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)
⚠ Common exam trap
Many exam-takers confuse Event ID 4625 (failed logon) with 4624 (successful logon), or mistakenly associate 4720 (account creation) with logon activity, while overlooking the specific purpose of 4648 for explicit credential usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
4648
Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
4648
Why this is correct
Event ID 4648 records a logon attempt using explicit credentials, such as when a user runs a process with `runas` or supplies alternate domain credentials for a network connection. This satisfies the stem’s constraint of “explicit credential usage” because the event logs the target account and the source process, distinguishing it from interactive logon events like 4624.
- ✗
4720
Why it's wrong here
4720: A user account was created.
- ✓
4624
Why this is correct
4624: An account was successfully logged on.
- ✗
4625
Why it's wrong here
4625: An account failed to log on.
- ✗
7045
Why it's wrong here
7045: A service was installed in the system.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.