In Windows Server 2008, which statement about filtering security events in Event Viewer is true?

• A. Event Viewer can display only the System log; security events are never shown.
• B. Event Viewer cannot filter events by event IDs.
• C. Event Viewer can filter events only by date; this is limited.
• D. Event Viewer can filter security events by log name and event IDs.

Answer: (D)

Filtering in Event Viewer works by letting you target exactly the events you care about using multiple criteria. For security events, you can specify the log name (the Security log) and narrow down to specific event IDs that correspond to the activity you’re investigating. In Windows Server 2008, you can open Filter Current Log or create a Custom View, choose the Security log, and enter one or more event IDs (for example, logon success or failure IDs). You can also layer on other filters like date range, level, source, or keywords, but the key point is that you’re not limited to a single log or a single criterion—you can filter security events by log name and by event IDs to focus on precisely those events of interest.

That ability to combine log name with event IDs is what makes this option correct. The other statements are inaccurate because you can view the Security log, you can filter by event IDs, and you’re not limited to filtering only by date.