SAL2 Practice Questions - TryHackMe Security Analyst Level 2 (SAL2) Exam

Access More Questions

When performing DFIR on a Windows system, an analyst wants to determine what processes were running at the time of a suspected compromise. Which artifact provides process creation history including command-line arguments?

Windows Security Event Log — Event ID 4688 $$MFT (Master File Table) NTUSER.DAT registry hive VSS (Volume Shadow Copy) metadata

Correct Answer:

Windows Security Event Log — Event ID 4688

Access more questions from this quiz

Continue to SAL2 Practice Questions - TryHackMe Security Analyst Level 2 (SAL2) Exam for more practice questions and the full quiz experience.

Access More Questions