Computer Hacking Forensic Investigator (CHFI v10) — Question 520

In Windows Security Event Log, what does an event id of 530 imply?

Answer options

• A. Logon Failure ג€" Unknown user name or bad password
• B. Logon Failure ג€" User not allowed to logon at this computer
• C. Logon Failure ג€" Account logon time restriction violation
• D. Logon Failure ג€" Account currently disabled

Correct answer: C

Explanation

An event ID of 530 specifically indicates that a user attempted to log on but violated account logon time restrictions. The other options refer to different types of logon failures, such as incorrect credentials or account status issues, which do not relate to time restrictions.