Windows Security Auditing Quiz

What you'll be asked

1. Which built-in Windows tool is the primary interface used to view and filter security audit logs stored on a local server?
2. When configuring security auditing, what is the primary benefit of using 'Advanced Audit Policy Configuration' instead of basic 'Audit Policy' settings?
3. To successfully audit who is accessing or deleting files in a specific folder, which two actions must be performed?
4. An administrator suspects a brute-force attack is occurring against a Windows Server. Which audit subcategory should be monitored for a high volume of 'Failure' events to confirm this?
5. If the Group Policy setting 'Audit: Force audit policy subcategory settings to override audit policy category settings' is enabled, how does the OS handle conflicting audit configurations?

Answers and explanations come after you submit.