Sysmon provides detailed information about which of the following?

• A. DNS lookups only
• B. User logon attempts only
• C. Process creations, network connections, and changes to file creation time
• D. CPU usage and memory allocations

Answer: (C)

Sysmon is designed to give deep telemetry about what happens on a Windows host, focusing on three core areas that are highly useful for threat detection and incident response. First, it records process creations, including which executable started, its full command line, and the user or process that launched it. This lets you see when something new begins execution, which can reveal stealthy or unexpected programs starting up.

Next, it logs network connections associated with those processes—where they’re connecting to, what ports and protocols are used, and which process initiated the connection. This helps you trace outward activity to external destinations, identify suspicious beaconing, and map potential C2 communications or data exfiltration attempts back to the exact process responsible.

Finally, Sysmon tracks changes to file creation times, catching tampering or suspicious file activity such as new or modified files in sensitive locations, which can indicate payload staging, artifact creation, or disruption attempts.

Because of these three kinds of data, Sysmon provides far more than just DNS information or CPU/memory metrics. It gives a rich view of process behavior, network actions, and file system changes, which is why it’s a powerful tool for detecting and investigating security incidents.