Your network contains an Active Directory domain named contoso.com. The domain contains a
server named Server1 that runs Windows Server 2012 R2.
A local account named Admin1 is a member of the Administrators group on Server1.
You need to generate an audit event whenever Admin1 is denied access to a file or folder.
What should you run?

A.
auditpol.exe /set /userradmin1 /failure: enable

B.
auditpol.exe /set /user: admin1 /category: “detailed tracking” /failure: enable

C.
auditpol.exe /resourcesacl /set /type: file /user: admin1 /failure

D.
auditpol.exe /resourcesacl /set /type: key /user: admin1 /failure /access: ga

Explanation:
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687.aspx#_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687.aspx#_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687.aspx#_blank”. com/enus/library/ff625687HYPERLINK “http://technet.microsoft.com/en-us/library/ff625687.aspx#_blank”.
aspx
To set a global resource SACL to audit successful and failed attempts by a user to perform generic
read and write functions on files or folders:
auditpol /resourceSACL /set /type: File /user: MYDOMAINmyuser /success /failure /access: FRFW
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx#_blank”:
//technetHYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx#_blank”microsoftHYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx#_blank”com/en-us/library/ff625687%28v=wsHYPERLINK
“http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx#_blank”10%29HYPERLINK
“http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx#_blank”aspx
Syntax
auditpol /resourceSACL
[/set /type: <resource> [/success] [/failure] /user: <user> [/access: <access flags>]]
[/remove /type: <resource> /user: <user> [/type: <resource>]]
[/clear [/type: <resource>]]
[/view [/user: <user>] [/type: <resource>]]
References:
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
com/en-us/library/ff625687%28v=wsHYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. 10%29HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. aspx
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.

com/en-us/library/ff625687%28v=wsHYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. 10%29HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. aspx
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
com/en-us/library/ff625687HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. aspx
httpHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/ff625687(v=ws.10).aspx #_blank”.
com/en-us/library/ff625687%28v=wsHYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. 10%29HYPERLINK “http://technet.microsoft.com/enus/library/ff625687(v=ws.10).aspx #_blank”. aspx