If Sysmon is installed, what types of events provide high-fidelity system activity for investigations?

• A. Only login events.
• B. Detailed events such as process creation, network connections, and file creations.
• C. Only firewall events.
• D. Only disk errors.

Answer: (B)

Sysmon provides high-fidelity system activity by logging detailed telemetry that ties actions to specific processes. This includes process creation (who started what and with which arguments), network connections (which process opened sockets and to where), and file creation events (files created or modified by processes). Together, these event types give a rich, actionable picture of what’s happening on a system, enabling precise root-cause analysis, timelines, and process-to-network-to-file correlations during investigations. The other options capture far narrower slices of activity and would miss the broader, continuous visibility Sysmon offers.