AZ-802 Secure Windows Server Infrastructure Practice Question
To monitor for unauthorized access to sensitive files on a Windows Server 2022 file server, you decide to enable auditing. Which category of the Advanced Audit Policy must be configured to track when a user successfully opens a file on a monitored share?
⚠ Common exam trap
Candidates often confuse 'Object Access' with 'Privilege Use'. While 'Privilege Use' tracks the exercise of user rights, it does not track access to specific file system objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Object Access
Object Access auditing is used to track access to specific objects on a Windows system, such as files, folders, and registry keys. To track file access, you must enable the 'Audit File System' subcategory under 'Object Access' and then configure the System Access Control List (SACL) on the specific files or folders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Account Logon
Why it's wrong here
Account Logon events are generated when a domain controller validates a user's credentials. This tracks who is logging into the domain but does not provide any information about what those users do once they are authenticated, such as which files they access on a specific member server in the network.
- ✗
Privilege Use
Why it's wrong here
Privilege Use auditing tracks the exercise of specific user rights, such as changing the system time or taking ownership of files. While related to security, it does not track standard file access (read/write) events, which are handled by the Object Access category through the file system auditing subcategory.
- ✓
Object Access
Why this is correct
The Object Access category includes the 'Audit File System' subcategory, which is essential for monitoring file and folder access. When combined with a SACL on the file, this policy generates events in the Security log whenever the specified access (like 'Read' or 'Write') occurs, providing a detailed audit trail.
- ✗
Policy Change
Why it's wrong here
Policy Change auditing tracks modifications to important security policies on the system, such as changes to user rights assignments or audit policies themselves. While it is vital for ensuring the integrity of the security configuration, it is not the correct category for monitoring user interactions with data files and folders.
Visual reference
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.