GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
An analyst is investigating a Windows 10 system and wants to determine the last time a specific user logged on interactively. The analyst has access to the Security event log. Which event ID should the analyst examine to find this information?
⚠ Common exam trap
Candidates often confuse logon events with logoff events or failed logon events; only 4624 records successful logons, and the logon type must be considered to isolate interactive sessions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
4624
Event ID 4624 is the primary event for successful logons. It contains detailed information including the logon type, which distinguishes interactive (type 2 or 10) from network (type 3) or other logons. By filtering for the specific user account and logon types 2 and 10, the analyst can identify the most recent interactive logon. This is a standard technique in Windows forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
4625
Why it's wrong here
Event ID 4625 indicates a failed logon attempt. It does not record successful logons. Examining 4625 would show unsuccessful attempts, not the last successful interactive logon. Therefore, it is not the correct event to determine when a user last logged on successfully.
- ✗
4647
Why it's wrong here
Event ID 4647 is logged when a user initiates a logoff. It is similar to 4634 but is generated when the logoff is initiated by the user. It does not provide the logon time. The analyst should look for logon events to find the last interactive logon.
- ✓
4624
Why this is correct
Event ID 4624 is logged when a logon attempt succeeds. It includes the logon type, which indicates the type of logon (e.g., interactive, network, batch). For interactive logons, the logon type is 2 (Interactive) or 10 (RemoteInteractive). By filtering for these logon types and the specific user, the analyst can determine the last interactive logon time.
- ✗
4634
Why it's wrong here
Event ID 4634 is logged when a logon session is destroyed (logoff). It indicates when a user logged off, not when they logged on. While it can help correlate session duration, it does not directly provide the logon time. The analyst needs the logon event to determine the start of the session.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.