The question number 4 is wrong. It asks " On December 6, 2023, between 15:00 and 20:00, how many logon failures did Winston generate on Server3?" Now if you do as it says the answer is 0, as Winston did not try to logon to Server3, Winston tried to logon to Server2, which when I tried the number of times Winston failed to logon on Server2 it told me the answer was correct. I will add 2 screenshots, one with just the question and one with the answer so you can delete the one with the answer.
Sorry, I misunderstood what data.win.system.computer was.
All good - thanks for flagging this. We’ll look at adding some clarification around which fields align to the source and destination. The previous example only includes references to server3, which makes things a bit confusing.