GCFA Windows Artifact Analysis Practice Question
An investigator is analyzing the Windows Event Logs and finds Event ID 4697. What is the primary significance of this event in the context of forensic analysis?
⚠ Common exam trap
Candidates frequently confuse Event ID 4697 with general service start events, failing to realize it specifically logs the installation of a new service, a common persistence indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It signals the installation of a new service on the system.
Event ID 4697 indicates that a new service was installed on the system. This is a common technique for attackers to establish persistence. By monitoring this event, analysts can identify when malicious binaries were registered as services to run automatically upon system boot. This is critical for uncovering hidden persistence mechanisms and identifying the service name, binary path, and account used to execute the potentially malicious code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It records the deletion of a user account from the local database.
Why it's wrong here
Event ID 4726 is the indicator for user account deletion. 4697 is strictly related to service installation. Confusing these events would lead to an investigation of user management rather than identifying malicious persistence, causing the analyst to overlook the actual method used by the attacker to maintain access.
- ✗
It logs that a system service was started by the Service Control Manager.
Why it's wrong here
Event ID 7045 is often associated with service installation, but Event ID 4697 specifically tracks the creation of a new service entry in the security audit logs. Confusing these can lead to missed evidence regarding how the service was initially introduced to the system environment by the attacker.
- ✓
It signals the installation of a new service on the system.
Why this is correct
Event 4697 tracks service installation. Attackers often install services to maintain persistence, ensuring their malware runs with high privileges after a reboot. Detecting this event allows the investigator to extract the service path and identify the malicious binary that was dropped and registered for automatic execution.
- ✗
It documents a failed attempt to modify an existing service.
Why it's wrong here
Service modification events are tracked under different IDs depending on the specific change. Event 4697 focuses on the creation of a new service rather than modifying an existing one. Incorrectly identifying this event prevents an analyst from seeing the creation of new backdoors within the system.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.