70-413 Exam Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A PCI DSS audit requires that all default vendor passwords be changed before production deployment. Which Windows Server feature can enforce password complexity at deployment time?
- Resultant Set of Policy (RSoP)
- Fine-Grained Password Policies (Correct answer)
- Local Security Authority (LSA)
- Group Policy Preferences
Correct answer: Fine-Grained Password Policies
Fine-Grained Password Policies (PSOs) allow granular password complexity and length requirements per user or group, ensuring non-default passwords for all service accounts.
Question 2: FISMA requires systems be categorized as Low, Moderate, or High impact. When designing server infrastructure, which document maps these impact levels to specific security controls?
- NIST SP 800-53 (Correct answer)
- ISO/IEC 27001
- COBIT 5
- ITIL v4
Correct answer: NIST SP 800-53
NIST SP 800-53 provides the catalog of security and privacy controls that correspond to FISMA Low, Moderate, and High impact categorizations.
Question 3: A company must prove to auditors that no single administrator can both approve and implement firewall changes (separation of duties). Which Active Directory feature best enforces this?
- Security groups with nested membership
- Role-Based Access Control via delegated OUs (Correct answer)
- Protected Users security group
- AdminSDHolder propagation
Correct answer: Role-Based Access Control via delegated OUs
Delegating specific permissions to separate OUs enforces Role-Based Access Control, ensuring approval and implementation roles are assigned to different administrative groups.
Question 4: Under GDPR, an EU customer's personal data must be deleted upon request. Which Windows Server capability helps locate all instances of that data across file servers?
- Data Deduplication
- File Classification Infrastructure (FCI) (Correct answer)
- Distributed File System Namespaces
- Storage Reports in FSRM
Correct answer: File Classification Infrastructure (FCI)
File Classification Infrastructure automatically classifies files by content using classification rules, enabling administrators to locate and act on all files containing specific personal data.
Question 5: SOX requires that audit logs cannot be altered by the accounts being audited. Which Windows Server configuration prevents even administrators from deleting security logs?
- Enable the 'Audit: Shut down system immediately if unable to log security audits' policy
- Configure Protected Event Logging
- Set maximum log size with 'Do not overwrite events'
- Forward logs to a dedicated write-once log collector with restricted permissions (Correct answer)
Correct answer: Forward logs to a dedicated write-once log collector with restricted permissions
Forwarding logs to a centralized server where the audited administrators lack delete permissions ensures log integrity, a core SOX audit trail requirement.
Question 6: A healthcare IT infrastructure must implement automatic workstation lockout after inactivity to comply with HIPAA's physical safeguards. Which GPO setting enforces this?
- Computer Configuration > Windows Settings > Security Settings > Account Policies > Lockout Policy
- User Configuration > Administrative Templates > Control Panel > Personalization > Screen Saver timeout with password (Correct answer)
- Computer Configuration > Administrative Templates > System > Logon > Always wait for network at startup
- User Configuration > Windows Settings > Scripts > Logon
Correct answer: User Configuration > Administrative Templates > Control Panel > Personalization > Screen Saver timeout with password
The Screen Saver timeout with 'Password protect the screen saver' setting enforces automatic lockout after inactivity, satisfying HIPAA's workstation security requirements.
Question 7: PCI DSS Requirement 10 mandates tracking all access to network resources and cardholder data. Which Windows Server audit policy category captures successful and failed network logons?
- Audit Privilege Use
- Audit Logon Events
- Audit Account Logon Events (Correct answer)
- Audit Process Tracking
Correct answer: Audit Account Logon Events
Audit Account Logon Events logs authentication attempts processed by domain controllers, capturing all network logon successes and failures as required by PCI DSS Requirement 10.
70-413 Exam Regulatory Frameworks & Compliance 3
A PCI DSS audit requires that all default vendor passwords be changed before production deployment.
Which Windows Server feature can enforce password complexity at deployment time?