MENU
When a system is compromised, attackers often try to disable auditing, in Windows 7; modifications to the audit policy are recorded as entries of Event ID____________.
Suggested Answer: A
Get Premium CFA-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
33 comments · newest first
IN
In
10 months ago
Wait, are you sure? I always mix those up!
MA
Major
10 months ago
Agreed, 4902 is the right one!
EL
Elin
11 months ago
I thought it was 4904 for some reason.
VI
Vincenza
11 months ago
Nah, it's 4902. No doubt about it.
VI
Vicente
11 months ago
It's definitely Event ID 4902.
MI
Micaela
11 months ago
I definitely recall 4902 being tied to audit policy modifications. It’s one of those key IDs we went over in class.
LU
Lucina
11 months ago
I’m a bit confused. I thought it was 3902, but now that I think about it, that might be related to something else.
ER
Erinn
12 months ago
I remember practicing a question about Windows event logs, and I feel like 4904 was mentioned a lot. Maybe that's it?
LO
Louvenia
12 months ago
I think the Event ID for audit policy changes is 4902, but I'm not completely sure. It sounds familiar from the study materials.
WI
Willodean
1 year ago
I'm a little confused by this question. I know it's related to auditing in Windows 7, but I'm not sure which specific Event ID is used to record audit policy modifications. I'll have to review my study materials and try to eliminate the incorrect options.
JU
Jutta
1 year ago
Okay, let me think this through step-by-step. When a system is compromised, attackers often try to disable auditing to cover their tracks. In Windows 7, the audit policy changes are recorded as Event IDs. I believe the correct answer is Event ID 4902, but I'll double-check my notes to be sure.
JO
Johnna
1 year ago
Hmm, I'm a bit unsure about this. I know it has to do with auditing in Windows 7, but I'm not completely sure which Event ID is used to record audit policy changes. I'll have to think this through carefully.
JU
Julieta
1 year ago
I'm pretty confident on this one. The question is asking about the Event ID that records audit policy modifications in Windows 7, and the answer is clearly Event ID 4904.
EA
Earleen
1 year ago
Ah, the age-old battle between hackers and security nerds. I bet the right answer is 'Ctrl + Alt + Delete' - that's the universal fix-all, right?
MI
Milly
1 year ago
Wait, is this a trick question? What if the right answer is something totally unexpected, like 'All of the above'? Hmm, I'm going with B) 3902 just to be safe.
LE
Leatha
1 year ago
I'm going with D) 3904.
HA
Hannah
1 year ago
I'm pretty sure it's A) 4902.
BE
Benedict
1 year ago
I think it's C) 4904, actually.
BR
Brandon
1 year ago
Disabling auditing, huh? That's like trying to hide your tracks after robbing a bank. The answer's gotta be D) 3904 - it's just too perfect.
KA
Kayleigh
1 year ago
Oh man, I bet the hackers are hoping we'll all get this one wrong! But not on my watch. The answer is A) 4902, I'm certain of it.
GE
Gearldine
1 year ago
Thanks for the tip, I'll go with A) 4902 as well.
TO
Tonette
1 year ago
I agree, A) 4902 is the correct Event ID for modifications to the audit policy.
SH
Sherita
1 year ago
I think you're right, A) 4902 sounds like the correct answer.
ER
Ernie
1 year ago
Actually, Dyan, the correct answer is A) 4902 because that's the Event ID for modifications to the audit policy in Windows 7.
DY
Dyan
1 year ago
I'm not sure, but I think it might be C) 4904.
SH
Shawn
1 year ago
Hmm, this is a tricky one. Disabling auditing is a classic move by attackers, so we need to know the right Event ID to look for. I'm going with C) 4904 - it just sounds right to me.
LO
Lorrie
1 year ago
I agree with you, I'll keep an eye out for Event ID 4902 as well.
KI
Kip
1 year ago
I agree with you, C) 4904 seems like the right choice to track modifications to the audit policy.
TR
Tracey
1 year ago
I think it's A) 4902, that's the one to watch out for.
TY
Ty
1 year ago
I'm going with D) 3904, I have a feeling that's the correct Event ID.
HE
Helene
1 year ago
I think it's A) 4902, that's the one to watch out for.
ER
Erinn
1 year ago
I agree with Brandon, because modifications to the audit policy are recorded as entries of Event ID 4902.
BR
Brandon
1 year ago
I think the answer is A) 4902.