Correct: The Audit Account Logon Events policy records logon events authenticated by a domain controller. Forwarding these events to the server SRV-Records from all domain controllers will allow you to get a full picture of account logon activity at the site.

Incorrect: Account management relates to the creation or modification of user accounts or groups. It does not relate to recording domain authentication events.

Incorrect: Audit Logon Events writes only local logon events to the event log. If instituted, it would provide data about people logging on to the domain controller, rather than logon events authenticated by the domain controller when they log on using another computer in the domain.