4624 and 4625 give you successful and failed logons with logon type and source; 4768, 4769 and 4771 cover Kerberos ticket activity and carry your Kerberoasting and password spray signals; 4648 shows explicit credential use; 4672 flags privileged logons; 4720 and 4732 cover account and group changes; 7045 and 4698 catch remote execution and persistence. Correlate them by account, source host and time.
Why interviewers ask this
The interviewer is checking hands on log familiarity that cannot be faked by reading a summary page. They want to see that you know which fields inside those events matter (logon type, ticket encryption type, source network address), and that you correlate rather than read events in isolation. Naming the audit policy settings required to generate them shows you have configured this and not only queried it.
How to structure your answer
- Group the IDs by what they prove: authentication, privilege, execution, persistence.
- Name the specific fields you read inside each event.
- Describe how you correlate them into one timeline.
- Mention the audit policy that must be enabled first.
Example answer
I group them by what they prove. Authentication: 4624 and 4625, and I care less about the ID than about logon type and source network address, because a type 3 from an unexpected host is the story. Kerberos: 4769 with RC4 encryption against a service account is my Kerberoasting signal, and a flood of 4771s across many accounts is spraying. Privilege: 4672 tells me the logon carried administrative rights. Credential use: 4648 catches runas style explicit credentials, which is common when somebody is testing stolen passwords. Then execution and persistence: 7045 service installs and 4698 scheduled tasks. I pull all of those into a single timeline keyed on account and source host, because one 4624 means nothing and the sequence means everything. Before any of that I check the audit policy, because on one engagement we had almost no 4769s at all: Kerberos auditing had never been turned on, which was its own finding in the report.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you spot a forged Kerberos ticket in those logs?
- What do you lose if the attacker clears the security log?
- How long do you retain these logs and why?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions