单项选择题 You perform a security audit of a server named CRM1. You want to build a list of all DNS requests that are initiated by the server. You install the Microsoft Network Monitor 3.0 application on CRM1. You capture all local traffic on CRM1 for 24hours. You save the capture file as data.cap. you find that the size of this file is more tahn 1GB. you need to create a file named DNSdata.cap from the existing capture file taht contains only dNS -related data  What should you do（）？

单项选择题 Your company has an active directory domain that has two domain controllers named DC1 and DC2. You prepare both servers to support event subscriptions. On DC1， you create a new default subscription for DC2. You need to review system events for DC2.  Which event log should you select（）？

多项选择题 Your company has a network that has an active directory domain. The domain has two servers named DC1 and DC2. You plan to collect events from DC2 and transfer them to DC1. You configure the required subscriptions by selecting the normal option for the event delivery optimiation setting and using the HTTP protocol. you discovere that none of the subscritpions work. You need to ensure that the servers support event collectiors.  which three actions should you perform（）？