70-291 Real Exam Prep DEMO

Question 18: You are the network administrator for your company.The network contains a Windows Server 2003
computer named Server1.
Three administrators are members of the Administrators local group on Server1. Twelve other
administrators are members of the Domain Admins group.The Domain Admins group is also a member of
the Administrators local group on Server1.
Someone makes an unauthorized change to the HKEY_LOCAL_MACHINE\SYSTEM key in the registry
on
Server1, which causes the computer to fail.You fix the problem.
You need to log all attempts to access the HKEY_LOCAL_MACHINE\SYSTEM key in the registry on
Server1.
You decide to enable auditing in the local security policy on Server1.
Which two actions should you perform? (Each correct answer presents part of the solution.Choose two.)
A.Enable auditing in the local security policy on Server1. Select the Audit object access (success and
failure) option in the audit policy.
B.Enable auditing in the local security policy on Server1. Select the Audit privilege use (success and
failure) option in the audit policy.
C.Enable auditing in the local security policy on Server1. Select the Audit system events (success and
failure) option in the audit policy.
D.Configure the SACL on the HKEY_LOCAL_MACHINE\SYSTEM key in the registry.Specify auditing of
the Full Control permission for Everyone.
E.Configure the SACL on the HKEY_LOCAL_MACHINE\SYSTEM key in the registry.Specify auditing of
the Set Value permission for Everyone.
Correct Answer: D A