Cert Master

KT-EPS Process analysis

Which artifact BEST helps determine persistence via scheduled task creation?

Multiple choice — select one answer

Answer choices

  1. a. DHCP lease log only, without security or identity team coordination per policy.
  2. b. CCTV timestamp, without security or identity team coordination per policy.
  3. c. Windows Security Event ID 4698 and Task Scheduler operational log
  4. d. Invoice PDF metadata, without security or identity team coordination per policy.

Architectural breakdown & explanation

Task creation events document persistence mechanisms.

Correct answer(s): c. Windows Security Event ID 4698 and Task Scheduler operational log

Exam domain: Process analysis (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications