You enable controlled folder access in audit mode for several computers that run Windows 10. You need to review the events audited by controlled folder access. Which Event Viewer log should you view?

The correct answer is A. Applications and Services\Microsoft\Windows\Windows Defender\Operational. Review controlled folder access events in Windows Event Viewer Controlled folder access events appear in Windows Event Viewer under Microsoft/Windows/Windows Defender/Operational folder…

Submitted by obi.ng· Apr 18, 2026Protect devices

Question

Options

AApplications and Services\Microsoft\Windows\Windows Defender\Operational
BWindows\Security
CApplications and Services\Microsoft\Windows\Known Folders\Operational

How the community answered

(48 responses)

A
90% (43)
B
8% (4)
C
2% (1)

Explanation

Review controlled folder access events in Windows Event Viewer Controlled folder access events appear in Windows Event Viewer under Microsoft/Windows/Windows Defender/Operational folder. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/evaluate-controlled- folder-access?view=o365-worldwide

Topics

#Controlled folder access#Windows Defender#Event Viewer#Audit logging

Community Discussion

No community discussion yet for this question.

Full MD-102 Practice