Exam 70-744 topic 1 question 86 discussion

Actual exam question from Microsoft's 70-744

Question #: 86
Topic #: 1

Your network contains an Active Directory domain named contoso.com. The domain contains two servers named Server1 and Server2. The domain has Dynamic
Access Control enabled.
Server1 contains a folder named C:\Folder1. Folder1 is shared as Share1.
You need to audit all access to the contents of Folder1 from Server2. The solution must minimize the number of event log entries.
Which two audit policies should you enable on Server1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Global Object Access- File System
B. Object Access "" Audit Detailed File Share
C. Object Access "" Audit Other Object Access Events
D. Object Access "" Audit File System
E. Object Access "" Audit File Share

Show Suggested Answer

Suggested Answer: BE 🗳️
References:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-detailed-file-share https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-share

by Kamikazekiller at Aug. 9, 2020, 3:01 p.m.

Comments

Submit Cancel

SamsOtro

4 years, 6 months ago

Agree with B and D. E just produces a subset of B. D allows SACLs to determine auditing of access by a specific account.

upvoted 3 times

Beitran

4 years, 5 months ago

"The solution must minimize the number of event log entries."

upvoted 1 times

...

morlu

4 years, 8 months ago

Answer is incorrect, should be B D E is redundant at best with B, and only shows an event when a user connects to a share, not specific files. Additionally the question doesn't just say access to the share, but the "contents" which could also mean local access. Thus D covers and audits local access as well.

upvoted 2 times

henryhan

4 years, 7 months ago

You need to audit all access to the contents of Folder1 from Server2, which means access to the share, so the answer is correct.

upvoted 6 times

Beitran

4 years, 5 months ago

Agreed: "The solution must minimize the number of event log entries."

upvoted 1 times

...