Courseiva
← CISSP
Full test
hardMultiple Choice

CISSP Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

Windows Event Log entry:
Log Name: Security
Event ID: 4625
Account For Which Logon Failed:
  Security ID: S-1-5-18
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
Failure Information:
  Failure Reason: Account locked out.
  Sub Status: 0xc0000234

Refer to the exhibit. A security analyst reviews this event log entry. What does this event indicate?

Event Log Entry: Log Name: Security Source: Microsoft-Windows-Security-Auditing Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: SRV01 Description: An account failed to log on.

Subject: Security ID: SYSTEM Account Name: SRV01$ Account Domain: CORP Logon ID: 0x3E7

Logon Type: 3

Account For Which Logon Failed: Security ID: S-1-5-21-... Account Name: jdoe Account Domain: CORP

Failure Information: Failure Reason: Account locked out. Status: 0xC0000234 Sub Status: 0x0

⚠ Common exam trap

The trap here is that candidates see 'Logon Type 3' and assume it is a successful network logon, ignoring the failure status and lockout reason, or they misinterpret the lockout as a privilege escalation attempt.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A failed logon attempt due to account lockout

The event log entry shows Event ID 4625 (an account failed to log on) with Status 0xC0000234, which is the code for 'Account locked out.' This indicates a failed logon attempt because the account is locked out, not a successful logon and not a privilege escalation exploit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    A successful logon by the SYSTEM account

    Why it's wrong here

    Event ID 4625 specifically denotes a failed logon attempt, not a successful one. A successful logon, even by the SYSTEM account, would be logged under a different Event ID, such as 4624. Therefore, this event cannot represent a successful logon, regardless of the account type involved.

  • ✗

    A successful logon by a user account

    Why it's wrong here

    Event ID 4625 is exclusively generated for *failed* logon attempts, making this option incorrect. Successful logons by any user account are recorded under Event ID 4624, which provides details about the user, logon type, and source. Consequently, an event with ID 4625 fundamentally contradicts the notion of a successful logon.

  • ✗

    An attempted exploit of a privilege escalation vulnerability

    Why it's wrong here

    While a failed logon event (4625) might occur during an attack, this specific event alone does not provide direct evidence of an attempted privilege escalation vulnerability exploit. Privilege escalation typically involves a user or process attempting to gain higher access rights than they currently possess, often through exploiting software vulnerabilities or misconfigurations. A simple failed logon, even due to lockout, does not inherently indicate such an exploit without additional correlating events or specific exploit signatures.

  • ✓

    A failed logon attempt due to account lockout

    Why this is correct

    Event ID 4625 is the definitive Windows Security Event ID for a failed logon attempt. Within the event details, a specific 'Sub Status' or 'Failure Code' (e.g., 0xC0000234, which translates to `STATUS_ACCOUNT_LOCKED_OUT`) precisely indicates the reason for the logon failure. If the exhibit shows this particular sub-status, it directly confirms that the logon failed because the account was locked out, typically due to exceeding the maximum number of incorrect password attempts as defined by account lockout policy.

About these practice questions

Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.