An organization wants to implement host-based intrusion detection on Windows servers. Which Windows logging capability, when enabled, provides visibility into command-line arguments used when processes are created?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because by default Event ID 4688 (Process Creation) does not include command-line arguments; enabling 'Include command line in process creation events' through Group Policy Computer Configuration > Administrative Templates captures the full command line, exposing PowerShell commands, encoded payloads, and tool arguments. A is wrong because Audit Logon Events captures authentication events, not process execution details.
Full explanation below image
Full Explanation
B is correct because by default Event ID 4688 (Process Creation) does not include command-line arguments; enabling 'Include command line in process creation events' through Group Policy Computer Configuration > Administrative Templates captures the full command line, exposing PowerShell commands, encoded payloads, and tool arguments. A is wrong because Audit Logon Events captures authentication events, not process execution details. C is wrong because Windows Firewall logging records network connections, not process creation with arguments. D is wrong because Audit Directory Service Access records AD object access, not process creation.