GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
An analyst suspects that an attacker used WMI (Windows Management Instrumentation) to execute code remotely. Which log file should be examined to confirm WMI-based process creation?
⚠ Common exam trap
Candidates often check general security logs (4688) which show the process but lack the context of the remote WMI invocation that triggered the execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WMI-Activity/Operational.evtx
The 'Microsoft-Windows-WMI-Activity/Operational' log is the primary source for tracking WMI interactions. WMI is frequently abused for lateral movement because it allows for stealthy, authenticated command execution. By reviewing these specific operational logs, analysts can correlate WMI provider activity with process creation events, confirming whether a remote actor utilized WMI to launch malicious processes on the target system without needing an interactive shell session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security.evtx
Why it's wrong here
While Security.evtx records process creation (Event ID 4688), it does not explicitly detail the WMI-specific context or the WMI provider activity. Relying solely on the Security log can miss the nuances of WMI-based execution, as the parent-child relationship might not clearly identify the WMI service as the source.
- ✗
System.evtx
Why it's wrong here
The System log records general OS and driver-related events, such as service status changes or hardware issues. It is not the correct log for tracking WMI service activity or specific remote execution events, as it lacks the fine-grained provider-level details found in the WMI-specific operational event logs.
- ✓
WMI-Activity/Operational.evtx
Why this is correct
This log file specifically captures WMI events, including requests, queries, and process creation triggered by the WMI service. It is the most direct artifact for identifying malicious WMI activity, providing the necessary evidence to confirm that an attacker utilized this specific management interface for remote code execution.
- ✗
Application.evtx
Why it's wrong here
The Application log records events from software applications installed on the system. It does not track core Windows management interfaces like WMI. Using this log would be ineffective, as the WMI-related activity is handled by specialized event providers that log to separate, dedicated event log files.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.