Securing Windows Server 2016 — Question 5

Your network contains an Active Directory domain named contoso.com. The domain contains five file servers that run Windows Server 2016.
You have an organizational unit (OU) named Finance that contains all of the servers.
You create a Group Policy object (GPO) and link the GPO to the Finance OU.
You need to ensure that when a user in the finance department deletes a file from a file server, the event is logged. The solution must log only users who have a manager attribute of Ben Smith.
Which audit policy setting should you configure in the GPO?

Answer options

• A. File system in Global Object Access Auditing
• B. Audit Detailed File Share
• C. Audit Other Account Logon Events
• D. Audit File System in Object Access

Correct answer: D

Explanation

The correct answer is D, as configuring the Audit File System setting in Object Access allows for the tracking of file deletions specifically. Option A is incorrect because Global Object Access Auditing is broader and not specific to file deletions. Option B focuses on file shares but does not cover individual file operations. Option C is unrelated as it pertains to account logon events and not file access.