SK0-003 · Question #660
An administrator is troubleshooting issues on an application server. After a root cause analysis, the administrator has determined that there were some unauthorized logins to the server. Which of…
The correct answer is C. Security logs. To investigate unauthorized logins on an application server, the security logs provide the most detailed information about login attempts and related security events.
Question
An administrator is troubleshooting issues on an application server. After a root cause analysis, the administrator has determined that there were some unauthorized logins to the server. Which of the following locations would BEST help to determine details about the unauthorized logins?
Options
- AActive Directory
- BDHCP logs
- CSecurity logs
- DSystem logs
How the community answered
(54 responses)- A7% (4)
- B2% (1)
- C89% (48)
- D2% (1)
Why each option
To investigate unauthorized logins on an application server, the security logs provide the most detailed information about login attempts and related security events.
Active Directory stores user accounts and authentication policies but does not directly log individual server-specific login attempts in the same detail as the local server's security logs.
DHCP logs record IP address assignments and lease information but do not track user login activity to servers.
The Security logs (accessible via Event Viewer) on a Windows server specifically record login attempts, successful and failed authentications, account lockouts, and other security-related events. Details like the source IP address, username, time, and type of login are typically found here, making it the best resource for investigating unauthorized logins.
System logs record general system events, driver issues, and service startup/shutdown, but they do not contain the detailed login attempt information found in the Security logs.
Concept tested: Investigating unauthorized access using security logs
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logon-events
Topics
Community Discussion
No community discussion yet for this question.