AZ-802 Secure Windows Server Infrastructure Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Audit Account Management.

  Why it's wrong here

  While Audit Account Management logs changes to local user accounts, it is insufficient for tracking changes made to domain-level Active Directory objects. When dealing with domain environments, you must use the more specific Directory Service auditing categories to monitor changes made directly to the Active Directory database objects.

• ✓

  Audit Directory Service Changes.

  Why this is correct

  This specific subcategory tracks changes to Active Directory objects, including creation, deletion, and modification of users, groups, and computer accounts. It is the correct policy to enable for monitoring changes within the NTDS.dit database, providing detailed event IDs that capture exactly which attributes were modified and by whom.

• ✗

  Audit Object Access.

  Why it's wrong here

  Audit Object Access is primarily used for monitoring access to files, folders, and registry keys. While it can be used to audit access to AD objects, it is not the primary policy category for tracking modifications to directory attributes; that requires the Directory Service Changes category for proper logging.

• ✗

  Audit Logon/Logoff.

  Why it's wrong here

  This policy category logs user authentication events, such as logins and logoffs. It does not provide information regarding modifications made to account attributes. Monitoring identity management changes requires auditing the directory services themselves, as logon/logoff events do not capture configuration changes occurring within the Active Directory object database.