CND Endpoint Protection Practice Question
An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events)
WMI persistence involves permanent event subscriptions (filters, consumers, and bindings) logged in specific WMI namespaces and event channels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events)
Why this is correct
WMI operational logs track activity, queries, and failures useful for detecting malicious WMI scripting.
- ✓
PowerShell script block logging (Event ID 4104) capturing WMI class instantiations (e.g., [wmiclass])
Why this is correct
Scripts interacting with WMI via PowerShell are recorded in script block logs.
- ✗
The Master Boot Record (MBR) partition table sectors
Why it's wrong here
The MBR stores disk partition information, not WMI script persistence objects.
- ✗
The system HOSTS file in \Windows\System32\drivers\etc\
Why it's wrong here
The HOSTS file is used for local static DNS name resolution mapping.
- ✓
WMI permanent event subscriptions located in the \root\subscription namespace (EventFilters, EventConsumers, FilterToConsumerBindings)
Why this is correct
Attackers use permanent WMI subscriptions for fileless persistence; these objects reside in the subscription namespace.
About these practice questions
Courseiva writes every CND question from scratch — 323 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.