You are the network administrator for your company. The network consists of a single Active Directory domain. The company has a main office in San Francisco and branch offices in Paris and Bogota. Each branch office contains a Windows Server 2003 domain controller.

All client computers run Windows XP Professional. Users in the Bogota office report intermittent problems authenticating to the domain.
You suspect that a specific client computer is causing the problem.

You need to capture the authentication event details on the domain controller in the Bogota office so that you can find out the IP address of the client computer that is the source of the problem.

What should you do?

A.
Configure Network Monitor to record the authentication events.

B.
Configure System Monitor to monitor the authentication events.

C.
Configure Performance Logs and Alerts with a counter log to record the authentication events.

D.
Configure Performance Logs and Alerts with an alert to trigger on authentication events.

Explanation:
The question states that you find out the IP address of the client computer that is the source of the problem. Using Network Monitor to capture traffic is the only way to do this.

Reference:

http://support.microsoft.com/default.aspx?scid=kb;en-us;175062

Martin Grasdal, Laura E. Hunter, Michael Cross, Laura Hunter, Debra Littlejohn Shinder, and Dr. Thomas W. Shinder, Planning and Maintaining a Windows Server 2003 Network Infrastructur* Exam 70-293 Study Guide & DVD Training System, Syngress Publishing, Inc., Rockland, MA, Chapter 11, p. 826