100-160 Question 160
Select 2A system administrator notices unexpected activity on a server and decides to investigate using the Event Viewer. Which of the following types of logs should the administrator review to identify potential security anomalies, such as unauthorized access attempts?
- A
Security logs
- B
System logs
- C
Application logs
- D
Setup logs
- E
Forwarded events logs
Show answer and explanation
Correct answers: A, B
Explanation
When investigating unauthorized access attempts, the administrator should review the Security logs for login attempts and other security-specific actions, as well as the System logs for potential anomalies affecting critical system components. These two logs provide the most relevant information for identifying security-related issues.
- A. Correct.
Security logs in the Event Viewer record events related to login attempts, policy changes, and other security-related actions. These logs are crucial for identifying potential unauthorized access attempts.
- B. Correct.
System logs provide information about events generated by the operating system, such as driver failures, hardware issues, or service start/stop events. While not directly security-focused, anomalies here can indicate malicious activity affecting critical system components.
- C. Incorrect.
Application logs track events for individual applications running on the system. While useful for application-level troubleshooting, they are less relevant for investigating unauthorized access attempts unless a specific application's behavior is suspect.
- D. Incorrect.
Setup logs primarily contain information about Windows installation and updates. These are not typically relevant when investigating unauthorized access attempts.
- E. Incorrect.
Forwarded events logs collect events from other systems. While they can provide additional insight into network-wide issues, they are not the primary source for reviewing local unauthorized access attempts.