AZ-802 Practice Question: Monitor and Troubleshoot Windows Server Environments

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a Custom View filtered by 'Error' level and both 'System' and 'Application' logs.

  Why this is correct

  Custom Views are designed for this exact purpose. By selecting the desired event levels and source logs, you create a persistent, auto-updating shortcut in the Event Viewer console that consolidates relevant data, making it the most efficient method for ongoing monitoring of specific server issues.

• ✗

  Export both logs to a CSV file and merge them in Microsoft Excel.

  Why it's wrong here

  Exporting logs is a manual process that creates a static snapshot of the data. It does not provide a real-time or easily repeatable view within the management console. This method is inefficient for daily monitoring and makes it difficult to react quickly to new errors as they occur.

• ✗

  Use the 'Find' feature in the System log to search for the word 'Error'.

  Why it's wrong here

  The 'Find' feature is a basic search tool that only works within the currently selected log. It does not consolidate data from multiple logs, and it requires the administrator to manually search every time they open the console, which is inefficient compared to a saved Custom View.

• ✗

  Enable 'Filter Current Log' on the System log and then repeat on the Application log.

  Why it's wrong here

  Filtering the current log is useful for a one-time investigation, but it does not combine the logs into a single view. The administrator would still need to switch back and forth between the two logs, which does not meet the requirement of viewing all errors in one place.