Which statement about Windows Event Logs is noted in the material?

Which statement about Windows Event Logs is noted in the material?

• A. They are encrypted at rest
• B. They change rapidly
• C. They never change
• D. They are read-only

Answer: (B)

Windows Event Logs are dynamic records that capture events from the operating system, applications, and security subsystems as they happen. Because systems are always running and generating events—everything from routine operations to warnings and errors—the log is continually updated with new entries. That real-time flow means the contents change rapidly, which is why this statement fits the material. Other properties aren’t defining characteristics: encryption at rest isn’t a universal trait of the logs themselves (it can be configured in some environments but isn’t guaranteed); logs are not truly unchangeable since they can be cleared or rotated under retention policies; and while you can restrict who can write to or read the logs, the log service does perform writes, so they aren’t inherently read-only in all contexts.

Windows Event Logs are dynamic records that capture events from the operating system, applications, and security subsystems as they happen. Because systems are always running and generating events—everything from routine operations to warnings and errors—the log is continually updated with new entries. That real-time flow means the contents change rapidly, which is why this statement fits the material. Other properties aren’t defining characteristics: encryption at rest isn’t a universal trait of the logs themselves (it can be configured in some environments but isn’t guaranteed); logs are not truly unchangeable since they can be cleared or rotated under retention policies; and while you can restrict who can write to or read the logs, the log service does perform writes, so they aren’t inherently read-only in all contexts.