Question 1
A Windows security log entry with Event ID 4624 indicates which event?
Correct Answer:
A successful logon
Question 2
Which Sysmon event ID corresponds to 'Process Create' and is central to execution-tactic detection?
Correct Answer:
Event ID 1
Question 3
Which MITRE ATT&CK tactic is associated with technique T1059 Command and Scripting Interpreter (e.g., PowerShell)?
Correct Answer:
Execution
Question 4
Which Windows Event ID shows that a Windows event log was cleared — a common Defense Evasion indicator?
Correct Answer:
Event ID 1102
Question 5
Which PowerShell logging event ID captures the actual script block content executed (including deobfuscated content)?
Correct Answer:
4104
Question 1
Exam overview

About this Exam

Prepare with the OSDA Practice Questions - OffSec Defense Analyst (OSDA) Exam practice quiz. This question bank includes 100 questions covering windows, event, detection, technique, and powershell. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

OSDA Practice Questions - OffSec Defense Analyst (OSDA) Exam

This practice set contains 100 questions from the matching question bank and focuses on windows, event, detection, technique, and powershell. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions