HOTSPOT
Your network contains an Active Directory domain named contoso.com. All servers run Windows Server 2012
R2.
You need to audit successful and failed attempts to read data from USB drives on the servers.
Which two objects should you configure?
To answer, select the appropriate two objects in the answer area.
Answer: 
Audit Handle Manipulation
Audit Removable storage
https://technet.microsoft.com/en-us/library/jj574128.aspx
is this question for the 70-410?
There may be some overlap, which is typical. I have this question on my Troytec study materials for 411 that I got Oct 5, 2015.