312-39 practice question 9 of 35

Which of the following fields in Windows logs defines the type of event occurred, such as Correlation Hint, Response Time, SQM, WDI Context, and so on?

Full set: 100 questions

Answer options

A: Keywords Correct answer

B: Task Category

C: Level

D: Source

Correct Answer:

A. Keywords

Explanation

In the Windows Event Log XML schema, the Keywords field is a 64-bit mask where each bit represents a specific category or property of the event. These keywords are defined by the event provider and are used for filtering and classifying events beyond the standard Level or Task Category. The examples given, such as "Response Time" (keyword win:ResponseTime), "SQM," and "WDI Context," are standard keywords used by Windows components to tag events with specific contextual information, allowing for more granular analysis and correlation by SOC analysts.

Why Incorrect

B. Task Category: This is a numeric value that defines a subcategory for an event source, not a container for descriptive strings like those listed.
C. Level: This field indicates the event's severity (e.g., Information, Warning, Error) and not its functional type or context.
D. Source: This field identifies the application or component that generated the log entry, not the specific type of event data.

References

- Microsoft. (2021, January 7). "Event Schema." Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/windows/win32/wes/eventmanifestschema-keywords-complextype (This official documentation explicitly defines the Keywords element and its purpose for event categorization).

- Microsoft. (2018, May 31). "Event Schema Elements." Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/windows/win32/wes/event-schema-elements (Provides the full schema, showing the role of Keywords in relation to other elements like Level and Task).

Question breakdown

Tests: Interpret Windows event log fields
Difficulty: Medium

Key idea: The Keywords field in a Windows event holds tags that categorize the event, such as Audit Success, Audit Failure, Correlation Hint, Response Time, SQM and WDI Context.

How to reach the answer

Clue: the listed values Correlation Hint, Response Time, SQM and WDI Context are standard Windows event keywords.
Level holds severity (Critical, Error, Warning, Information, Verbose), so it does not fit.
Source names the provider that logged the event, and Task Category is a provider-defined subcategory.
Only Keywords uses these specific tag values.

Each option

ACorrect. Keywords holds category tags like Correlation Hint, Response Time, SQM and WDI Context, as well as Audit Success/Failure.
BIncorrect. Task Category is a provider-specific subcategory (for example, Logon) rather than these standard keyword tags.
CIncorrect. Level indicates severity such as Error or Warning, not these type tags.
DIncorrect. Source identifies the software or provider that generated the event.

Common trap: The phrase 'type of event' makes Task Category or Level sound right, but the listed values are keyword names.

In practice: Analysts filter Security logs by keywords such as Audit Failure to isolate failed logon attempts during investigations.

Remember: Audit Success/Failure, Correlation Hint, SQM and WDI Context all live in the Keywords field.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test