SSCP Systems and Application Security Practice Question
A forensic analyst needs to review security events from multiple Windows servers. To ensure that logs are centrally collected and resistant to tampering, which of the following should be implemented?
⚠ Common exam trap
The trap is that candidates equate 'enable auditing' (Option D) with 'centralize and protect logs' — auditing generates events but does nothing to aggregate or harden them, which is the actual requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Windows Event Forwarding to a central event collector
Windows Event Forwarding (WEF) uses the WS-Management/WinRM protocol to push selected event logs from source servers to a central Windows Event Collector (WEC) server. Because events are forwarded in near real time to a separate host, an attacker who compromises a source server cannot easily erase the already-forwarded copies, satisfying the tamper-resistance requirement. It also centralizes review, which is what the forensic analyst needs across multiple servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Windows Event Forwarding to a central event collector
Why this is correct
Windows Event Forwarding uses the WS-Management protocol to push events from source servers to a central collector, where they are stored on a separate host. This centralisation means an attacker compromising one server cannot alter or delete the forwarded copies.
- ✗
Store logs only on the local server and back them up weekly
Why it's wrong here
Local storage with weekly backups leaves logs exposed to tampering on the compromised host and delays central review, failing the requirement for centralised, tamper-resistant collection. It is tempting because local logging with backups suits small environments where no central infrastructure exists and retention, not integrity, is the goal.
- ✗
Configure Event Viewer on each server to overwrite events as needed
Why it's wrong here
Overwriting events discards the oldest records once the log fills, destroying evidence and providing no central collection. Event forwarding to a collector, such as a SIEM or Windows Event Collector, achieves both centralisation and tamper resistance.
- ✗
Enable auditing of account logon events
Why it's wrong here
Account logon auditing only generates local Security log entries on each server; it provides no central forwarding or tamper resistance. It would be the right control when the requirement is merely to capture authentication success and failure events for later local review.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.