SK0-003 · Question #237
A user reports that each day some files are deleted from the department share. The administrator needs to find who deleted these files. Which of the following actions should the administrator perform?
The correct answer is C. Enable audit object access and specify files and folders to monitor using Windows Explorer. To identify who deleted files from a shared folder, an administrator must enable object access auditing and then configure specific audit settings on the relevant files or folders.
Question
A user reports that each day some files are deleted from the department share. The administrator needs to find who deleted these files. Which of the following actions should the administrator perform?
Options
- AEnable audit object access and specify files and folders to monitor using Task Manager.
- BEnable audit policy change and specify files and folders to monitor using Windows Explorer.
- CEnable audit object access and specify files and folders to monitor using Windows Explorer.
- DOpen Performance Monitor and monitor folder activity.
How the community answered
(64 responses)- A6% (4)
- B17% (11)
- C73% (47)
- D3% (2)
Why each option
To identify who deleted files from a shared folder, an administrator must enable object access auditing and then configure specific audit settings on the relevant files or folders.
Task Manager is used for managing running processes and services, not for configuring audit policies or file system auditing settings.
'Audit policy change' tracks modifications to audit policies themselves, not user actions on objects like files, and Windows Explorer is not the tool to enable audit policy changes.
Enabling 'Audit object access' is the correct audit policy category for tracking user actions on specific files and folders, such as deletions. The specific files and folders to monitor are then configured by modifying their security properties in Windows Explorer.
Performance Monitor tracks system performance metrics and resource usage, but it does not record user-specific actions like who deleted a file.
Concept tested: Windows file system auditing and security logging
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-object-access
Topics
Community Discussion
No community discussion yet for this question.