Which elective exam should I choose?

Much really depends on your needs and the needs of your company.

If your company doesn't use either Exchange or SQL server, then (preparing for and) taking these exams may not be immediately beneficial to you (or your company). Yes, the Exchangeexam can be difficult (especially if you don't have experience with Exchange), but the same can probably be said of the SQL exam.

I took a Win2K Bootcamp and asked the instructor specifically why 70-220 wasn't part of his curriculum. His reasoning was that he felt the exam focused more on PKI, encryption, and IPSec (which most organizations don?t use), than the standard security features. He felt that other subject areas had more bearing on everyday life as an administrator.

I would suggest 70-221 as it complements both 70-218 and 70-219 very nicely.

Good Luck.

I agree with Tim Walsh on that the elective exams you take really depend on your environment and the needs of your company.
For myself, I did not take an Exchange exam, since my company uses Lotus Domino (not my idea, but that is what I am stuck with here!)
For my MCSE track, I took 70-220 since 1) I love security concerns (including PKI infrastructure) and 2)I am the de-facto Security officer. So, security was a natural for me, due to my environment. This exam was my Design exam. It was not too hard (easier than the Network Infrastructure exam!! I HATED 70-216)
Next, I took 70-228, because I am an old database guy who, over the past 5 years, made the switch fully to networking. I have used SQL 6.5, 7.0 and now SQL2K. So, taking 228 was also a natural. I handle all SQL Server duties here, and the exam was just right. It was difficult (if you take this exam, take a month and READ the SQL SERVER BOOKS ONLINE help file. Really! Read it from start to end! I had to, and I still only scored 720 on it!).

I guess what I am suggesting is for you to look at your duties and what about Windows you like. YOu have taken 6 Win2K exams, so taking something like 70-244 (the NT4 support exam, which was my last elective) makes no sense for you. If you work with Exchange or SQL Server on a daily basis, then I think taking the exam for it would be a good thing.
My personal feeling is that your full MCSE exam history should NOT entirely focus on just Win2K. I think you need at least 1 application exam, just for some rounding. But, if you want to stick with Win2K exams only, then go ahead and take 70-220. The Security exam was as close to a cakewalk as there is (not as easy as 70-215, but close!)

IMHO.
hope this helps