Exam 312-49v10 topic 1 question 764 discussion

An investigator analyzes event logs from a Windows 10 system for a suspected security breach. The investigator needs to find the logs related to account management events. A peculiar set of actions observed is an account creation followed by a change in the account within a short span of time. Which Event IDs should the investigator look for in the logs?