Which of the following reasons justifies why you should audit failed events?

A.
To log resource access for reporting and billing

B.
To monitor for malicious attempts to access a resource which has been denied

C.
None of these

D.
To monitor access that would suggest users are performing actions greater than you had planned

Explanation:
http://technet.microsoft.com/en-us/library/cc778162%28v=ws.10%29.aspx
Auditing Security Events Best practices
If you decide to audit failure events in the policy change event category, you can see if unauthorized
users or attackers are trying to change policy settings, including security policy settings. Although this
can be helpful for intrusion detection, the increase in resources that is required and the possibility of a
denial-of-service attack usually outweigh the benefits.