to enable or disable security auditing on local or remote systems, and to adjust the audit criteria for different categories of security events.

to enable or disable security auditing on local or remote systems, and to adjust the audit criteria for different categories of security events.

• A. Auditpol
• B. Wevtutil
• C. Clear-EventLog
• D. Cipher.exe

Answer: (A)

Configuring security auditing across local and remote systems is done with the auditpol tool. This utility is built to manage which security events are audited and how the auditing is applied, at both broad categories and fine-grained subcategories. You can enable or disable auditing and tailor the exact categories you want to monitor, such as Logon/Logoff, Account Management, and Policy Change, giving you precise control over what gets recorded. It also supports targeting a remote machine, so you can centralize auditing configuration from one place, which is especially useful in larger environments. You can query current settings to see what's being audited and then apply changes incrementally as needed, which is important for maintaining compliance and simplifying incident response. Other tools mentioned have different purposes: one focuses on interacting with event logs themselves rather than configuring which events are audited, another clears event logs, and the last is used for file encryption and decryption. Those do not adjust auditing policies.

Configuring security auditing across local and remote systems is done with the auditpol tool. This utility is built to manage which security events are audited and how the auditing is applied, at both broad categories and fine-grained subcategories. You can enable or disable auditing and tailor the exact categories you want to monitor, such as Logon/Logoff, Account Management, and Policy Change, giving you precise control over what gets recorded. It also supports targeting a remote machine, so you can centralize auditing configuration from one place, which is especially useful in larger environments. You can query current settings to see what's being audited and then apply changes incrementally as needed, which is important for maintaining compliance and simplifying incident response.

Other tools mentioned have different purposes: one focuses on interacting with event logs themselves rather than configuring which events are audited, another clears event logs, and the last is used for file encryption and decryption. Those do not adjust auditing policies.