hardMultiple Choice

CISM Practice Question: Refer to the exhibit

Exhibit

[Windows Event Log] Event ID 4688: A new process has been created.
Creator Subject: Security ID: S-1-5-21-...  Account Name: jdoe
Process Information: New Process ID: 0x1a2b  New Process Name: C:\Users\jdoe\AppData\Local\Temp\svchost.exe

Refer to the exhibit. What is most suspicious about this event?

⚠ Common exam trap

The trap here is that candidates focus on the Event ID or user account details, overlooking the critical path anomaly—ISACA often tests your ability to distinguish between legitimate system processes and masquerading malware by emphasizing that svchost.exe running from any non-standard location (especially Temp) is a red flag, regardless of other normal-looking attributes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The process name svchost.exe running from Temp folder

Svchost.exe is a critical Windows system process that should never run from the Temp folder. Running svchost.exe from %TEMP% is a classic indicator of malware masquerading as a legitimate process, often used to evade detection by security tools that trust the svchost.exe name. This event strongly suggests a malicious binary attempting to blend in with normal system activity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user jdoe is not an administrator
Why it's wrong here
A non-administrator user account is normal on workstations, so jdoe's lack of admin rights is not itself suspicious. It is tempting because privilege escalation by standard users is a common attack pattern, and would be the correct observation if the event showed jdoe performing administrative actions.
✗
Event ID 4688 is unusual
Why it's wrong here
Event ID 4688 (process creation) is routinely logged on Windows systems with audit process tracking enabled, so its presence alone is not anomalous. It is tempting because 4688 can reveal malicious process execution, and would be the correct focus when the event shows an unexpected binary or suspicious command line.
✗
The process ID is too low
Why it's wrong here
Process IDs are assigned sequentially and low PIDs simply indicate early-starting system or service processes, which is normal. It is tempting because a low PID can suggest a long-running or system-level process, and would be the correct concern if the process were masquerading as a system binary.
✓
The process name svchost.exe running from Temp folder
Why this is correct
Legitimate svchost.exe executes only from System32; running from a Temp folder indicates masquerading malware. The path, not the filename, is the anomaly, satisfying the stem's requirement to identify the most suspicious attribute of the event.

Go deeper

CISM Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question