The SOC department in a multinational organization has collected logs of a security event as "Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder…

The correct answer is C. 10.10.1.16. The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The…

Submitted by lucia.co· Mar 6, 2026Cloud Security Operations & Incident Response

Question

The SOC department in a multinational organization has collected logs of a security event as "Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder of the "Attacker Maehine-1" and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is 4625.)

Options

A10.10.1.12
B10.10.1.10
C10.10.1.16
D10.10.1.19

How the community answered

(25 responses)

A
4% (1)
B
4% (1)
C
84% (21)
D
8% (2)

Explanation

The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The logs show that the source network address of the failed logon attempts is 10.10.1.16, which is the IP address of the attacker.

Topics

#log analysis#Windows events#audit logs#IP address

Community Discussion

No community discussion yet for this question.

Full 212-82 Practice