StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services

Practice question 393 of 506 · medium

Security failures are expected but absent from the queried log. What should be checked first?

Choose the single best answer.

  1. A.Audit policy, log retention, access and the correct time range
  2. B.Assume the failures never occurred
  3. C.Assume querying System always includes every Security event
  4. D.Only increase the log size and assume this enables missing auditing
Show the answer and explanation

✓ Correct answer

  • Audit policy, log retention, access and the correct time range

Generation policy and retained accessible records must be checked in the correct log and period. No rows does not prove no event. System and Security are distinct logs, and increasing capacity alone does not enable an absent audit policy.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.