Your supervisor suspects that someone is attempting to gain access to a Windows computer by guessing user account IDs and passwords. The supervisor asks you to use the Windows Event Viewer security…

The correct answer is B. Account logon failure C. Account lockout success. The Account logon failure event indicates that an authentication attempt has failed, which may suggest incorrect credentials were used. Multiple such events in a short time frame can indicate a brute-force attack. The Account lockout success event confirms that an account has…

Endpoint Security Concepts

Question

Your supervisor suspects that someone is attempting to gain access to a Windows computer by guessing user account IDs and passwords. The supervisor asks you to use the Windows Event Viewer security logs to verify the attempts. Which two audit policy events provide information to determine whether someone is using invalid credentials to attempt to log in to the computer? (Choose two.) Note: You will receive partial credit for each correct selection.

Options

AObject access failure
BAccount logon failure
CAccount lockout success
DAccount logoff success

How the community answered

(27 responses)

A
7% (2)
B
78% (21)
D
15% (4)

Explanation

The Account logon failure event indicates that an authentication attempt has failed, which may suggest incorrect credentials were used. Multiple such events in a short time frame can indicate a brute-force attack. The Account lockout success event confirms that an account has been locked due to repeated failed logon attempts, which further supports the suspicion of password-guessing

Topics

#Windows Event Viewer#audit policy#account logon failure#account lockout

Community Discussion

Fatima Z.Mar 11, 2026

Pick B and C, and here is your hook to lock it in forever: think "FAIL then JAIL." Account logon failure (B) is the FAIL, catching every bad password guess as it happens, and account lockout success (C) is the JAIL, firing the moment Windows slams the door on the attacker after too many strikes. Object access failure (A) tracks file and folder snooping, not login attempts, and account logoff success (D) just waves goodbye to a valid session, so neither one helps you catch a password guesser.

Nina C.Mar 12, 2026

Good mnemonic, though just a heads-up for anyone on a domain environment question: those account lockout events (4740) get written to the domain controller that processed the bad credential, not to the member server the user was trying to reach, which is a gotcha I have seen show up in practice questions.

Grace U.Mar 2, 2026

Does "account lockout success" logging feel counterintuitive to you, or does the lockout piece make sense?

Nina C.Mar 22, 2026

I actually picked A at first because "object access failure" sounds like it fits when someone is blocked from getting in, but then I remembered that object access is more about files and folders, not login attempts. What clicked for me was that account logon failure directly captures bad credentials, and account lockout success tells you the system actually locked someone out, which only happens after repeated failed tries.

Fatima Z.Mar 24, 2026

Nail that distinction, and here is the sticky hook to keep it cemented: 4625 lives under Audit Logon Events while 4740 lives under Audit Account Management, so picture two security guards at two different checkpoints, and if you only enable one audit policy you will catch the knocking but miss the deadbolt clicking.

Dimitris E.Mar 18, 2026

First pass I circled B and D, figuring logoff events would tell me something about incomplete sessions, but D is noise, it just means the session closed cleanly and tells you nothing about whether bad credentials were used getting in. What snapped me back was thinking about what actually happens in sequence when someone is hammering a box with wrong passwords: you see Account logon failure events stacking up in the Security log under Event ID 4625, and then if the account threshold trips, you get the Account lockout success event, ID 4740, which is the system confirming the lockout fired. Those two together are your smoking gun, logon failures show the repeated bad attempts, and the lockout success shows the policy responded. Object access failure, option A, is for auditing file and folder access, completely different audit category, wrong tree entirely.

Mateus R.Mar 25, 2026

When someone gets locked out or kicked off the system, that logoff success event is your paper trail showing the machine ended a session, and back-to-back logoff successes with no matching logon activity in between is a dead giveaway that something fishy is going on with credentials. Think of it like a revolving door at a bank, if the door keeps spinning out but nobody is signing the guest book coming in, you know people are being turned away, and D captures that pattern right there in the log.

Grace U.Mar 26, 2026

Mateus, that revolving door analogy is creative, but logoff events just tell you a session ended, they do not capture failed or suspicious credential attempts the way logon failure and success events do. B and C are the pair examiners are looking for because together they let you correlate repeated failures against eventual successes, which is the actual signature of a credential attack.

Full 100-160 Practice