GSEC · Question #406
Which Windows event log would you look in if you wanted information about whether or not a specific diver was running at start up?
The correct answer is B. System. The Windows System event log records OS and driver-level events, making it the correct location to verify whether a specific driver loaded at startup.
Question
Which Windows event log would you look in if you wanted information about whether or not a specific diver was running at start up?
Options
- AApplication
- BSystem
- CStartup
- DSecurity
How the community answered
(57 responses)- A9% (5)
- B84% (48)
- C2% (1)
- D5% (3)
Why each option
The Windows System event log records OS and driver-level events, making it the correct location to verify whether a specific driver loaded at startup.
The Application log records events generated by user-mode applications and installed programs, not by OS components or device drivers.
The System log in Windows Event Viewer captures events generated by the Windows operating system itself and its core components, including device drivers and system services. Driver load successes or failures at startup are written here by the kernel and Service Control Manager, making it the authoritative source for driver initialization status.
There is no built-in 'Startup' log in Windows Event Viewer - this is not a valid Windows event log category.
The Security log records audit events such as logon attempts and privilege use, not hardware or driver initialization events.
Concept tested: Windows Event Viewer System log for driver startup events
Source: https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
Topics
Community Discussion
No community discussion yet for this question.