Windows Security Event ID 4624 records a successful logon session. Therefore, querying the Security log for event 4624 provides the analyst with historical evidence of successful logins to the affected workstation.
Get-WinEvent is the appropriate PowerShell cmdlet for retrieving Windows event records. The FilterHashtable parameter allows efficient server-side filtering using attributes such as LogName and ID, rather than retrieving an entire event log and filtering the results afterward. Microsoft specifically documents LogName and ID as valid FilterHashtable keys and recommends this approach for efficient event-log querying.
The command then uses Sort-Object TimeCreated -Descending so the newest login events appear first, and Export-Csv preserves the resulting records for investigation.
Option A does not use the correct PowerShell event-query syntax shown. Options C and D search inappropriate log channels and unrelated event IDs. The evidence needed is authentication history, making the Windows Security log and successful-logon identifier 4624 the correct combination.
Study Guide Reference: Incident Response and Management # Evidence Collection # Windows Event Logs
# PowerShell # Get-WinEvent # Security Event ID 4624 # Timeline Reconstruction.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.
Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.
Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.
The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .
Study Guide Reference: Incident Response and Management # Evidence Acquisition # Legal Hold # Evidence Preservation # Chain of Custody # Timeline Analysis # Regulatory/Legal Considerations.

The Pyramid of Pain illustrates the increasing operational difficulty imposed on an adversary when defenders successfully detect and deny progressively more behavioral indicators. At the lower levels are artifacts that attackers can replace relatively easily, such as hash values and IP addresses. Higher levels include domain names, network or host artifacts, tools, and ultimately tactics, techniques, and procedures (TTPs) .
Its central defensive lesson is that not all indicators impose equal cost on an attacker. Blocking one IP address may require the attacker only to obtain another server. Detecting a specific malware hash can often be defeated by recompiling or modifying the file. Detecting the attacker's established behaviors and operational methods creates substantially greater difficulty because the adversary may need to redesign procedures, change tooling, retrain operators, or alter an established intrusion methodology.
The Pyramid of Pain was developed specifically to describe this relationship between indicators and the amount of operational "pain" defenders impose when those indicators are denied.
Option B describes impact measurement, not indicator durability. Option C concerns intelligence-source classification. Option D resembles threat-modeling approaches such as STRIDE rather than the Pyramid of Pain.
Study Guide Reference: Security Operations # Threat Intelligence # Pyramid of Pain # Indicators of Compromise # Tools # TTPs # Behavioral Detection.

An after-action report (AAR) is the most comprehensive document associated with a closed incident because it consolidates the incident itself, the response activities performed, recovery actions, outcomes, deficiencies, and lessons identified during the event. NIST Cybersecurity Framework guidance specifically calls for preparing an after-action report that documents the incident, response and recovery activities, and lessons learned.
A lessons-learned document focuses primarily on what worked, what failed, and what should be improved.
Those observations are important, but they represent only one component of a complete post-incident record.
Root cause analysis has a narrower technical purpose: determining the fundamental condition that permitted the incident to occur or progress. A situation report is generally produced while an incident is ongoing to communicate current status, impact, actions, and outstanding issues.
An AAR is broader because it can incorporate the timeline, technical findings, containment and eradication actions, recovery results, stakeholder performance, root cause, lessons learned, and assigned corrective actions. NIST exercise guidance likewise treats lessons learned as information that becomes part of an after- action report.
Study Guide Reference: Reporting and Communication # Post-Incident Reporting # After-Action Reports
# Lessons Learned # Root Cause Analysis # Corrective Actions.