Security Pro Section Win Logging 12.4.6 quiz

Which two types of service accounts must you use to set up event subscriptions?

• Specific user service account

• Default machine account

• Collector computer account

• Network server machine account

By default, events received from the source computers in Event Subscription are saved in which log?

• Application log

• System log

• Security log

• Forwarded Events log

You set up Event Subscription, but you are getting an overwhelming amount of events recorded. What should you do?

• Choose the correct subscription type

• Define a filter

• Use the Runtime Status link

• Use the default machine account

Which of the following are required to configure Event Subscription for event forwarding? (Select three.)

• Create a Windows firewall exception for HTTP or HTTPS on all source computers.

• Start Windows Event Collector service on collector computer.

• Start Windows Remote Management service on both the source and collector computers.

You are configuring a source-initiated subscription on the collector computer in Event Viewer. Which of the following do you need to specify?

• computer group is for a source-initiated subscription.

• Selecting a computer would be for the collector-initiated subscription.

• The Forwarded Events log is selected, not the System log.

• Content filtering is a strategy to keep employees from accessing unauthorized content on the web.

For some reason, your source computers are not communicating properly with the collector. Which tool would you use to verify communications?

• Runtime Status to verify communications after you have created a subscription

• wecutil qc command would simply run the Windows Event Collector service.

• winrm qc -q command would initiate the Windows Remote Management service

• Event Viewer System log would not verify current communications

For source-initiated subscriptions, which tool do you use to configure event forwarding?

• Group Policy

• service account only provides permissions to run properly

• Event forwarding settings for source-initiated subscriptions are unavailable in Event Viewer

• Filters define what is collected. They do not enable and configure event forwarding.

You have a large number of source computers in your IT environment. Which subscription type would be most efficient to employ?

• Source-initiated

• Collector-initiated is more efficient if you have a limited number of source computers

• Event forwarding uses HTTP to transfer the events from the source to the collector

You wish to configure collector-initiated event subscriptions. On the collector computer, in which program do you configure a subscription?

• Event Viewer is used to configure collector-initiated subscriptions

• Collector-initiated event subscriptions are not configured using Group Policy

• Device Manager offers no settings to configure event subscription

• Computer Management offers no settings to configure event subscriptions