70-210 Installing, Configuring and Administering Microsoft Windows 2000 Professional Training Course

Demo Question 7.

You are the administrator of EliteCertify 's Windows 2000 network. Carlos, a user in the development department, has configured a shared folder named Technical_Data on his Windows 2000 Professional computer. The information in the Technical_Data shared folder is crucial for the everyday work and Carlos wants to audit access to the Technical_Data folder and track any attempts to delete files. Carlos configures auditing for Technical_Data, as shown in the exhibit. The Security Log on Carlos's computer is set to a maximum log file size of 512 KB and to overwrite events as needed. The next day Carlos reports that files were deleted from the Folder. However, no events were generated in his computer's Security Log. Carlos needs to discover who is deleting files on his computer. What should you do?

A. Restart the Security Accounts Manager Service.
B. Modify the Security Log size settings to set the file size to 2,048 K
C. In the Local Security Policy setting for Audit Object Access, select the Success and Failure check boxes.
D. In the Auditing Entry dial box for Technical_Data, select the Change button and change Everyone to Authenticated Users.


Display Answer

Answer: C

Explanation: Enabling auditing is a two-step procedure. First we define an Audit Policy and then we configure the objects that we want to audit. In this scenario we should Audit Object Access for Success and Failure. Incorrect