Microsoft 70-411 Exam – Q80

Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2012 R2.
You need to audit successful and failed attempts to read data from USB drives on the servers.

Which two objects should you configure? To answer, select the appropriate two objects in the answer area.
Hot Area:
80a

Correct Answer:
80b

Explanation:
To configure settings to monitor removable storage devices

1. Sign in to your domain controller by using domain administrator credentials.

2. In Server Manager, point to Tools, and then click Group Policy Management.

3. In the console tree, right-click the flexible access Group Policy Object on the domain controller, and then click Edit.

4. Double-click Computer Configuration, double-click Security Settings, double-click Advanced Audit Policy Configuration, double-click Object Access, and then double-click Audit Removable Storage.

5. Select the Configure the following audit events check box, select the Success check box (and the Failure check box, if desired), and then click OK.

6. If you selected the Failure check box, double-click Audit Handle Manipulation, select the Configure the following audit events check box, and then select Failure.

7. Click OK, and then close the Group Policy Management Editor.

https://technet.microsoft.com/en-us/library/jj574128.aspx