Microsoft 70-291 question (About auditing registry key)?

Question

Dear all,

According to testking, the answer for this question:

http://www.geocities.com/iamsupersupersuperman/70-291_Question.txt

is A and D but my teacher thinks it should be B and C (my teacher is a MCT), which is totally different. Do you think A and D could also be a possible answer?

Answer 1

You teacher is wrong -- editing the registry is not a system event; shutting down & rebooting the system is a system event. While you may need to do this to implement your changes, you want to track the changes, not the reboots.

If you are studying for the exam, I suggest doing real work & real research instead of resorting to brain dumps like Testking. People who pass the exams without learning the skills give the rest of us a bad name and devalue the certification they have spent time & money to get. It is because of testking and other brain dumps that MCSE isn't worth as much to employers as hands-on certifications like CCIE are.

The answer is available on Microsoft's web site. I suggest searching on "audit object access" and "audit system events", for starters.