GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
An analyst is reviewing a Windows 10 system and wants to determine the last time the system was shut down. Which Windows event log and event ID should the analyst examine?
⚠ Common exam trap
It's easy for candidates to confuse user logoff events or periodic uptime events with the actual system shutdown event, which is specifically recorded as event ID 6006 in the System log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System log, event ID 6006
The System event log records event ID 6006 when the event log service is stopped during a clean shutdown. This event is a definitive indicator that the system was shut down gracefully. By examining the timestamp of event 6006, the analyst can determine the last shutdown time. Other events like 6013 provide uptime but not shutdown time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System log, event ID 6006
Why this is correct
Event ID 6006 in the System log indicates that the event log service was stopped, which occurs during a clean shutdown. It is a reliable indicator of a graceful system shutdown. The timestamp of this event provides the time the shutdown process completed. This is the standard event used to determine shutdown time.
- ✗
Security log, event ID 4647
Why it's wrong here
Event ID 4647 in the Security log indicates that a user initiated a logoff. This is a user-level event and does not necessarily correspond to a system shutdown. It could occur when a user logs off without shutting down the system. Therefore, it is not the correct event to determine system shutdown time.
- ✗
Application log, event ID 1001
Why it's wrong here
Event ID 1001 in the Application log is often used by Windows Error Reporting for crash reports. It is not a standard event for system shutdown. While some applications may log shutdown events, the Application log is not the authoritative source for system shutdown time.
- ✗
System log, event ID 6013
Why it's wrong here
Event ID 6013 in the System log is logged periodically (typically every 24 hours) and reports system uptime. It does not indicate a shutdown; instead, it provides a periodic uptime report. It can be used to estimate when the system started, but not when it shut down.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.