You have developed an application that simplifies hard drive management for Domain.com’s administrators.
The application that you created logs all modifications made to physical hard drives on an hourly basis.
You now need to create an EventQuery object for this application.
What should you do?

A.
Use the following code:
EventQuery query = new EventQuery ();
query.QueryString = “SELECT InstanceModificationEvent FROM ‘Win32_DiskDrive’ WITHIN 3600”;

B.
Use the following code:
EventQuery query = new EventQuery ();
query.QueryString = “SELECT * FROM _InstanceModificationEvent WITHIN 3600 ” + “WHERE TargetInstance ISA ‘Win32_DiskDrive'”;

C.
Use the following code:
EventQuery query = new EventQuery ();
query.QueryString = “SELECT * FROM ‘Win32_DiskDrive’ WITHIN 3600” + “WHERE TargetInstance ISA_InstanceModificationEvent”;

D.
Use the following code:
EventQuery query = new EventQuery ();
query.QueryString = “SELECT * FROM_InstanceModificationEvent WITHIN 3600” + “WHERE Instance = ‘Win32_DiskDrive'”;

Explanation:
This code creates a new EventQueryobject that queries all disk drive events every hour.
The QueryString property contains a string that follows the syntax of WQL. WQL is a subset of SQL, and it is specifically designed for WMI. The SELECT clause indicates retrieval, where the asterisk (*) represents all properties associated with the event.
The FROM clause indicates the event, which in this case is _InstanceModificationEvent. The WITHIN clause specifies the polling interval in seconds. The WHERE clause specifies the condition that must be met. In this scenario, the TargetInstance filed is compared to the value Win32_DiskDrive. This limits the _InstanceModificationEvent events to only those that modify hard drives.
Incorrect Answers:
A: InstanceModificationEvent is not a valid event property and Win32_DiskDrive is not a valid event.
C: The FROM clause should specify the event InstanceModificationEvent and the ISA operator should use the Win32_DiskDrive class.
D: Instance is not a valid field name and the equal sign (=) is not valid for class comparisons.