QuestionQ405
Logs and Network ForensicsDuring a service-manipulation investigation at a logistics company in Columbus, Ohio, an examiner examines the Windows System log from a compromised workstation. The timeline contains an entry showing that a request was sent to stop a critical service, but the service did not immediately enter the stopped state. To interpret this log entry correctly and differentiate intent from outcome, the examiner must understand what the recorded event represents.
What does Event ID 7035 indicate in this context?
- A A control request was sent to a service to start or stop
- B A remote-access connection recorded in the Application log
- C A custom application event written by logevent.exe
- D A Windows service successfully transitioned to a started or stopped state
Community Discussion