Tenda, a network specialist at an organization, was examining logged data using Windows Event Viewer to identify attempted or successful unauthorized activities. The logs analyzed by Tenda include events related to Windows security; specifically, log-on/log-off activities, resource access, and also information based on Windows system's audit policies.
Event Viewer
Windows Event Viewer Simulation
Windows Logs › Security
Event ID
Level
Source
Description
Time
Security logs record logon/logoff, resource access, and audit policy events
Assessment
Identify the type of event logs analyzed by Tenda in the above scenario.
A Application event log
B Setup event log
C Security event log
D System event log
💡 This log type tracks logon/logoff events, resource access, and audit policy results.
Knowledge Base
Mini Lesson
1
Definition: The Windows Security event log records security-related events such as logon attempts, resource access, and actions governed by audit policies. It is one of the core logs accessible through Windows Event Viewer.
2
How it works: Windows generates security events whenever an audited action occurs — such as a user logging on, accessing a file, or changing permissions. These events are written to the Security log with unique Event IDs (e.g., 4624 for successful logon, 4625 for failed logon).
3
Why it matters: Security logs are essential for detecting unauthorized access attempts, investigating breaches, and meeting compliance requirements. They are a primary source for forensic analysis and threat hunting.
4
Real-world example: A security analyst notices multiple Event ID 4625 (failed logon) entries from a single IP address at 3:00 AM, indicating a potential brute-force attack against a domain account.
5
Key takeaway: Security event logs specifically track logon/logoff, resource access, and audit policy events — distinguishing them from Application logs (software errors), System logs (hardware/driver events), and Setup logs (installation events).