[&] Which Event ID corresponds to a successful logon in Windows?
- 4625
- 4688
- 4689
- 4624

[&] Where are Windows Event Logs typically stored in a Windows operating system?
- Within the Users directory under C: drive
- Directly in the root of the C: drive
- Inside the Program Files folder
- In the System32\winevt\logs folder

[&] Why is it important to enable process creation logging in Windows Event Logs?
- It allows tracking of unauthorized software installations
- It helps identify when a process is terminated
- It provides insight into which processes are executed
- It logs every system reboot for analysis

[&] How can Windows Event Logs be viewed on a different system?
- By exporting logs through Control Panel settings
- By copying the .evtx files and using the Event Viewer
- By creating a shared drive containing the logs
- By accessing them through a web interface on another machine

[&] What does a Logon Type of '2' indicate in a Windows Event Log?
- A batch logon for scheduled tasks
- A network-based logon
- An interactive user logon
- A remote desktop session

[&] What file extension is associated with Windows Event Log files?
- .log
- .txt
- .evtx
- .dat