hardMultiple ChoiceObjective-mapped

CISM Practice Question: Refer to the exhibit

Exhibit

[Windows Event Log] Event ID 4688: A new process has been created.
Creator Subject: Security ID: S-1-5-21-...  Account Name: jdoe
Process Information: New Process ID: 0x1a2b  New Process Name: C:\Users\jdoe\AppData\Local\Temp\svchost.exe

Refer to the exhibit. What is most suspicious about this event?

⚠ Common exam trap

The trap here is that candidates focus on the Event ID or user account details, overlooking the critical path anomaly—ISACA often tests your ability to distinguish between legitimate system processes and masquerading malware by emphasizing that svchost.exe running from any non-standard location (especially Temp) is a red flag, regardless of other normal-looking attributes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The process name svchost.exe running from Temp folder

Svchost.exe is a critical Windows system process that should never run from the Temp folder. Running svchost.exe from %TEMP% is a classic indicator of malware masquerading as a legitimate process, often used to evade detection by security tools that trust the svchost.exe name. This event strongly suggests a malicious binary attempting to blend in with normal system activity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user jdoe is not an administrator
Why it's wrong here
Even non-admin users can launch processes.
✗
Event ID 4688 is unusual
Why it's wrong here
Event ID 4688 is a standard process creation event.
✗
The process ID is too low
Why it's wrong here
Process IDs can vary; low ID is not indicative of malicious activity.
✓
The process name svchost.exe running from Temp folder
Why this is correct
Correct: svchost.exe is a Windows system process and should not run from Temp.

Go deeper

CISM Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question