Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
exam questions

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam

Exam 312-49v10 topic 1 question 824 discussion

Actual exam question from ECCouncil's 312-49v10
Question #: 824
Topic #: 1
[All 312-49v10 Questions]

A CHFI professional is investigating a data breach in a Windows 10 system. The initial analysis revealed some alterations in the system event logs. As part of the investigation, the professional uses the ‘wevtutil’ command-line tool. The command ‘wevtutil gl Security’ was executed, but the results seemed abnormal. Which of the following could be a plausible reason for this outcome?

  • A. The command ‘wevtutil gl Security’ does not exist in the ‘wevtutil’ command set
  • B. The ‘wevtutil’ command cannot retrieve data from XML-based EVTX file format
  • C. The Event Log service was temporarily unresponsive or down
  • D. The EVTX file storing the Security log was corrupted or tampered with
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Elb
6 months ago
Selected Answer: D
Windows 10 store event logs in EVTX file format and are based on XML (Extension Markup Language) wevtutil command can be used to retrieve information about event logs and publishers that is not readily apparent via the Event Viewer user interface.
upvoted 1 times
...
Elb
7 months ago
D < https://www.gigasheet.com/post/online-evtx-parser-and-viewer#:~:text=What%20Are%20EVTX%20Files%20Anyway,format%20used%20in%20Windows%20XP.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...