GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
An analyst is examining a Windows 10 system and wants to determine the last time a specific user logged on interactively. Which Windows Event Log should be examined to find the most recent interactive logon event?
⚠ Common exam trap
Many exam-takers confuse logon and logoff events or looking in the wrong log; interactive logons are recorded as Event ID 4624 with Logon Type 2 in the Security log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Event Log, Event ID 4624 with Logon Type 2
Security Event ID 4624 with Logon Type 2 records interactive logons at the console. By examining the most recent such event, an analyst can determine when a user last logged on interactively. System Event ID 6005 relates to service startup, Application Event ID 1000 to application crashes, and Security Event ID 4634 to logoffs, none of which answer the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application Event Log, Event ID 1000
Why it's wrong here
Event ID 1000 in the Application log is typically generated when an application crashes. It provides details about application errors but has no relation to user logon events. Thus, it is irrelevant to determining interactive logon times and is incorrect.
- ✓
Security Event Log, Event ID 4624 with Logon Type 2
Why this is correct
Event ID 4624 in the Security log records successful logon attempts. Logon Type 2 indicates an interactive logon at the console. By filtering for Event ID 4624 and Logon Type 2, an analyst can identify the most recent interactive logon. This is the correct source for determining when a user last logged on interactively.
- ✗
Security Event Log, Event ID 4634
Why it's wrong here
Event ID 4634 in the Security log indicates a logoff event. While it can help determine session duration when paired with a logon event, it does not indicate when a logon occurred. The question asks for the last time a user logged on interactively, so a logoff event is not the correct source.
- ✗
System Event Log, Event ID 6005
Why it's wrong here
Event ID 6005 in the System log indicates that the Event Log service was started, which occurs at system boot. It does not record user logon events. While it can help establish system uptime, it does not provide information about interactive user logons. Therefore, it is not the correct choice.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.