Which tool dumps Windows event log records for analysis?

Which tool dumps Windows event log records for analysis?

• A. PsInfo
• B. GetNextRequest
• C. PsShutdown
• D. PsLogList

Answer: (D)

This item tests knowledge of a tool that exports Windows event log records for examination. Windows event logs capture a wide range of system, security, and application events, and to analyze them you need a utility that can pull those records out in a readable format. PsLogList is designed for this purpose: it reads the event logs from the local or a remote machine and dumps the entries to the screen or to a file, making it easy to review, filter, and analyze events like timestamps, event IDs, sources, and messages. This makes it the go-to choice for collecting logs for forensic analysis or incident response. The other options serve different tasks. PsInfo gathers general system information (hardware, OS version, uptime, installed software) rather than the actual event records. PsShutdown is for initiating a shutdown or restart. GetNextRequest is not a standard log-dumping utility and doesn’t provide event log exports, so it isn’t suited for this purpose.

This item tests knowledge of a tool that exports Windows event log records for examination. Windows event logs capture a wide range of system, security, and application events, and to analyze them you need a utility that can pull those records out in a readable format. PsLogList is designed for this purpose: it reads the event logs from the local or a remote machine and dumps the entries to the screen or to a file, making it easy to review, filter, and analyze events like timestamps, event IDs, sources, and messages. This makes it the go-to choice for collecting logs for forensic analysis or incident response.

The other options serve different tasks. PsInfo gathers general system information (hardware, OS version, uptime, installed software) rather than the actual event records. PsShutdown is for initiating a shutdown or restart. GetNextRequest is not a standard log-dumping utility and doesn’t provide event log exports, so it isn’t suited for this purpose.