You must audit the following in your domain: new user creations (4720), account lockouts (4740), and failed logons (4625). Additionally, you need to detect attempts to modify objects within the ‘Service Accounts’ OU. All domain controllers run Windows Server 2019. Which two configurations should you implement?

To audit new user creations (4720) and account lockouts (4740), you need to enable "Audit Account Management (Success)" under Advanced Audit Policy Configuration on the Default Domain Controllers Policy. Failed logons (4625) are captured by enabling "Audit Logon (Failure)." These settings apply to all domain controllers. To detect modifications to objects within the 'Service Accounts' OU, a System Access Control List (SACL) is required. This SACL should be configured on the OU to audit "Write all properties" and "Create/Delete child objects" for "Directory Service Access" events, as these actions indicate object modification. "Enable only the ‘Directory Service Changes’ audit subcategory" is insufficient as it won't capture all required events like failed logons. "Enable legacy Audit Policy" is outdated and less granular than advanced policies, and disabling advanced processing is counterproductive. "Enable Object Access auditing only on member servers" is incorrect because object modifications within Active Directory occur on domain controllers, not typically on member servers.