Installation, Storage, and Compute with Windows Server 2016 — Question 274

You have a file server named Server1 that runs Windows Server 2016.
Object access auditing is configured on Server1.
You need to filter the Security event log to show all log entries that relate to a user named User1.
What should you do?

Answer options

• A. Right-click the Security log, and then click Filter Current Log"¦ On the Filter tab, type a value in the User box.
• B. Right-click the Security log, and then click Filter Current Log"¦ On the Filter tab, select a value from the Event sources box.
• C. Right-click the Security log, and then click Create Custom View"¦ On the Filter tab, type a value in the User box.
• D. Right-click the Security log, and then click Filter Current Log"¦ On the XML tab, modify the QueryList entry and set an EventData tag.

Correct answer: A

Explanation

The correct answer is A because filtering the Security log and entering a user name in the User box directly targets log entries related to that user. Option B is incorrect as it does not pertain to user-specific filtering. Option C is not suitable since creating a custom view is not necessary for this task. Option D involves XML modification, which is more complex and not needed for simple user filtering.