6.5 Flashcards
Srv12 is a Windows Server 2012 R2 server that runs File and Print Services.
On Srv12, you are troubleshooting a problem that keeps occurring. When the problem happens, there are
several Warning and Error events logged to the Application log in Event Viewer.
While troubleshooting the problem, you create a filter for the log that shows only the Warning and Error
messages. Because you’ve been working on the problem for several days, you’d like to save the current filter
settings on the Application log so you don’t have to reconfigure the filter each time.
What should you do?
Right-click the Application log and choose Save Filter to Custom View….
Right-click the Application log and choose Clear Log… and save the log before clearing.
Right-click the Application log and choose Save Filtered Log File As….
Right-click the Application log and choose Create Custom View….
Right-click the Application log and choose Save Filter to Custom View….
Srv12 is a Windows Server 2012 R2 server that runs File and Print Services.
On Srv12, you are troubleshooting a problem that keeps occurring. When the problem happens, there are
several Warning and Error events logged to the Application log in Event Viewer.
You create a Custom View that shows only Warning and Error events. During troubleshooting, you filter the
Custom View to show only the Error messages.
You would like to create a new Custom View using the current filter settings.
What should you do?
Save the events in the Custom View.
Export the Custom View, then import it using a different name.
Copy the Custom View using a new name.
Save the filter to a Custom View.
Save the filter to a Custom View.
Srv12 is a Windows Server 2012 R2 server that runs File and Print Services.
On Srv12, you are troubleshooting a problem that keeps occurring. When the problem happens, there are
several Warning and Error events logged to the Application and System logs in Event Viewer.
You would like to be able to see only the Warning and Error events from both logs displayed at the same
time. You want to save this configuration so that you can check back each day to see any new errors.
What should you do?
On the Application log, filter the log to show only Warning and Error events. Save the filter to a Custom View, adding the System log as an additional filter.
On both logs, filter the log to show only Warning and Error events. Save both logs.
On both logs, filter the log to show only Warning and Error events. On both logs, save the filter to a
Custom View.
On both logs, create a Custom View.
On the Application log, filter the log to show only Warning and Error events. Save the filter to a Custom View, adding the System log as an additional filter.
Srv10 is a Windows Server 2012 R2 server that runs server core. Srv5 is a Windows Server 2012 R2 server
that runs with a graphical interface.
Over the next few days, you want to monitor Srv10. You would like to automatically save the contents of the
Application and System logs on Srle to Srv5. You will then use Event Viewer on Srv5 to view the contents of
the logs from Srv10.
Because you will be checking for events periodically throughout the day, you want to make sure that the
events saved on Srv5 are no more than 15 minutes old.
What should you do?
On Srv5, create a Scheduled Task that saves the Application and System logs to a network share.
Configure the schedule to run every 15 minutes.
On Srv5, Run Eventtriggers.exe to attach a task to the Application and System logs. Configure the
task to run a script that copies the logs to Srv10.
On Srv5 and Srv10, enable and configure Event Subscriptions. Configure Srle as a source, and Srv5 as
a collector.
On Srv10, open the Reliability and Performance Monitor and connect to Srv10. Create a data collector
set with event trace data.
On Srv5 and Srv10, enable and configure Event Subscriptions. Configure Srle as a source, and Srv5 as
a collector.
You manage three Windows Server 2012 R2 servers that run server core. Because you prefer to view events
inside of Event Viewer, you would like to configure event subscriptions so that you can view all events from
those servers on another server with a graphical interface.
You want to configure the subscription properties from only the collector server, and you want events from
the source servers to be sent to the collector server with a delay of up to 15 minutes.
How should you configure the subscription properties on the collector server? (Select two. Each choice is a
required part of the solution.)
For the subscription type, select Collector initiated.
For event delivery optimization, choose Minimize Bandwidth.
For event delivery optimization, choose Minimize latency.
For the subscription type, select Source computer initiated.
For event delivery optimization, choose Normal.
For the subscription type, select Collector initiated.
For event delivery optimization, choose Normal.
You manage three Windows Server 2012 R2 servers that run server core. Because you prefer to view events
inside of Event Viewer, you would like to configure event subscriptions so that you can view all events from
those servers on another server with a graphical interface.
You need to configure the three source computers and one collector computer. The subscription should be
collector initiated, and should use the Minimize Bandwidth optimization option.
What should you do? Select only the required tasks for each server. (Select two. Each choice is a required
part of the solution.)
On all four servers, run winrm quickconfig.
On all four servers, run winrm quickconfig. On the collector server, run wecutil qc.
On the collector server, configure the subscription.
On the source servers, run winrm quickconfig. On the collector server, run wecutil qc.
On all four servers, configure the subscription.
On all four servers, run winrm quickconfig. On the collector server, run wecutil qc.
On the collector server, configure the subscription.
Srv7 is an application server that will run an application that is currently under development. As part of the
development process, programmers, need to view events that will be logged to the Analytic and Debug logs
in Event Viewer.
You open Event Viewer on Srv7 and configure the View menu to show the two logs.
At the end of the day, you notice that there are no messages in those logs, even though the application
testing has been running on the server for several hours. You need to make sure that messages are sent to
the log and are visible.
What should you do?
Run winrm quickconfig on Srv7 and configure a subscription.
Create a Custom View that includes both logs.
Attach a task to both logs. Configure the task to display a message.
Run the wevtutil command with the /e:true switch for both logs.
Run the wevtutil command with the /e:true switch for both logs.
Srv12 is a Windows Server 2012 R2 server that runs File and Print Services.
On Srv12, you are troubleshooting a problem that keeps occurring. When the problem happens, there are
several Warning and Error events logged to the Application log in Event Viewer.
While troubleshooting the problem, you create a filter for the log that shows only the Warning and Error
messages.
You would like to save all messages in the Application log so you can copy them to another computer and
examine them there.
What should you do? (Select two. Each choice is a possible solution.)
[3 Save the filter to a Custom View. From the Custom View, export the Custom View.
D Save the filter to a Custom View. From the Custom View, save the events in the Custom View.
Clear the log, choosing to save the log before clearing.
E] Save the filtered log.
Clear the filter, then save the log.
Clear the log, choosing to save the log before clearing.
Clear the filter, then save the log.
Srv12 is a Windows Server 2012 R2 server that runs File and Print Services.
On Srv12, you are troubleshooting a problem that keeps occurring. When the problem happens, there are
several Warning and Error events logged to the Application and System logs in Event Viewer.
After several days, there are several events in the Custom View. You would like to clear the messages from
the view so that you only see messages starting from right now. You need to make sure that any messages in
the corresponding logs still exist.
What should you do?
Clear the Application and System logs.
Export the Custom View, then import it with a new name.
Clear the Custom View.
Edit the Custom View properties and create a custom range for the logged events, starting with today’s date.
Save the events in the Custom View.
Edit the Custom View properties and create a custom range for the logged events, starting with today’s date.
You manage a large number of servers running Windows Server 2012 R2 (Server Core).
You would like to standardize the event subscriptions for each of the servers. You have exported the desired
subscription information to an XML file. You would like to import these settings to each of your core servers.
Which tool should you use?
eventcreate
wevtutil
wecutil
evntcmd
wecutil
You manage a server running Windows Server 2012 R2 in a secure environment.
You are required to archive event logs on a weekly basis. You would like to create a scheduled task to
automatically archive the logs.
Which tool should you use?
evntcmd
wevtutil
eventcreate
wecutil
wevtutil
You are creating a new data collector set that will monitor processor utilization on a Windows Server 2012
system.
You want the collection task to run at 10:30 AM, Monday-Friday, when the system load is usually the
heaviest, and remain running for 30 minutes. The collection task should execute at the specified clay and time
for the the next two weeks and then stop.
Click the option you would use in the Create new Data Collector Set wizard to configure this.
Open properties for this data collector set.
