Certified SOC Analyst (CSA) — Question 66

What does Windows event ID 4740 indicate?

Answer options

• A. A user account was locked out.
• B. A user account was disabled.
• C. A user account was enabled.
• D. A user account was created.

Correct answer: A

Explanation

Windows event ID 4740 specifically indicates that a user account has been locked out due to failed login attempts. The other options refer to different account states such as being disabled (B), enabled (C), or created (D), which are not represented by this specific event ID.