Your network contains an Active Directory domain named contoso.com. You have a
management computer named Computer1 that runs Windows 7.
You need to forward the logon events of all the domain controllers in contoso.com to
Computer1.
All new domain controllers must be dynamically added to the subscription.
What should you do?

A.
From Computer1, configure source-initiated event subscriptions. From a Group Policy
object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event
Forwarding node.

B.
From Computer1, configure collector-initiated event subscriptions. From a Group Policy
object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event
Forwarding node.

C.
From Computer1, configure source-initiated event subscriptions. Install a server
authentication certificate on Computer1. Implement autoenrollment for the Domain
Controllers organizational unit (OU).

D.
From Computer1, configure collector-initiated event subscriptions. Install a server
authentication certificate on Computer1. Implement autoenrollment for the Domain
Controllers organizational unit (OU).

Explanation:
http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx
Setting up a Source Initiated Subscription
Source-initiated subscriptions allow you to define a subscription on an event collector
computer without defining the event source computers, and then multiple remote event
source computers can be set up (using a group policy setting) to forward events to the event
collector computer. This differs from a collector initiated subscription because in the collector
initiated subscription model, the event collector must define all the event sources in the
event subscription.