You need to generate an audit event whenever Admin1 is denied access to a file or folder

Your network contains and active Directory domain named contoso.com. The doman contains a server named
Server1 that runs Windows Server 2012. A local account named Admin1 is a member of the Administrators
group on Server1. You need to generate an audit event whenever Admin1 is denied access to a file or folder.
What should you run?

A.
auditpol.exe /set /user:admin1 /category:”detailed tracking” /failure:enable

B.
auditpol.exe /se t/user:admin1 /failure:enable

C.
auditpol.exe /resourcesacl /set /type:keyauditpol.exe /resourcesacl /set /type: /access:ga

D.
auditpol.exe /resourcesacl /set /type:file /user:admin1 /failure

Show Hint

← Previous question

Next question →

researcher

http://technet.microsoft.com/en-us/library/ff625687.aspx

Syntax: auditpol.exe /resourcesacl
Parameter: /set
Argument: /type /user /failure

Answer is D.

xxx

I am not sure, but I guess D is correct.

http://technet.microsoft.com/de-de/library/cc755264(v=ws.10).aspx
http://technet.microsoft.com/de-de/library/ff625687(v=ws.10).aspx

With [auditpol.exe /resourcesacl] you can audit only files & folders, and regkeys

>>
/type
The resource for which object access auditing is being configured. The supported argument values are File (for directories and files) and Key (for registry keys).
<<<

With [Auditpol /set … /category:”detailed tracking”] you would audit much more events (Answer A).
Answer B is the syntax incorrect. [/category] is missing.
Answer C is the [/type] incorrect. Only "File" and "Key" are accepted.

Answer D makes exactly what we want.

rookie

https://technet.microsoft.com/en-us/library/ff625687.aspx

There’s a note to the link Researcher posted that says Auditpol resourceSACL only applies to Windows 7 and Windows Server 2008 R2. Server 1 is WinServer2012…

With Answer A, the category chosen is an interesting choice. under Detailed Tracking in GPM Editor for Adv Audit Policy Config, there are are 4 subcategories, and none directly imply that when enabled, they will audit all files and folders, which is what we need to Audit with Admin1.

With B, category is missing as XXX pointed out.