You are the newly appointed enterprise administrator at Domain.com. The Domain.com network consists of a single Active Directory domain named Domain.com. All servers on the Domain.com network run Windows Server 2008.
Domain.com has its headquarters in Chicago and a branch office in Dallas. The Dallas branch office contains three server named CERTKILLER-SR11, CERTKILLER-SR12 and CERTKILLER- SR13 that is running a Server Core installation of Windows Server 2008. You have received instructions from the CIO to configure the Event Logs subscription on CERTKILLER-SR11 to monitor CERTKILLER-SR12 and CERTKILLER-SR13.
What should you do? (Choose TWO. Each answers forms part of the solution)

A.
The best option is to run the wecutil cs subscription.xml command on CERTKILLER-SR11.

B.
The best option is to create an event collector subscription configuration file called subscription.xml on CERTKILLER-SR11.

C.
The best option is to create a custom view and export the custom view to subscription.xml file, by using the Event Viewer on CERTKILLER-SR11.

D.
The best option is to run the wevtutil im subscription.xml command on CERTKILLER-SR11.

Explanation:
You need to create an event collector subscription configuration file and name the file subscription.xml. this will allow you to configure a subscription on CERTKILLER-SR11. You need to then run the wecutil cs subscription.xml command on CERTKILLER-SR11. The wecutil cs subscription.xml command will allow you to create and manage subscriptions to events that are forwarded from remote computers, which support WS-Management protocol. Furthermore the wecutil cs subscription.xml command will create a subscription to forward events from a Windows Vista Application event log of a remote computer at Domain.com to the ForwardedEvents log
Reference : Wecutil
http://technet2.microsoft.com/windowsserver2008/en/library/0c82a6cb-d652-429c-9c3d-
0f568c78d54b1033.mspx?mfr=true
Section 3, Configure custom application directory partitions (12 Questions)