StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services

Practice question 391 of 506 · easy

An incident report lists event 1000 without its provider or timestamp. What additional evidence is most useful?

Choose the single best answer.

  1. A.Only the level value such as Error
  2. B.Only the exported filename without its event records
  3. C.Only the event ID repeated as a supposedly globally unique identifier
  4. D.Provider, full message, computer and occurrence time
Show the answer and explanation

✓ Correct answer

  • Provider, full message, computer and occurrence time

Provider/message/computer/time identify the event and incident context. IDs are provider-scoped, a level alone matches many events, and an export filename does not contain the relevant event semantics by itself.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.