70-413 Exam Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A federal agency deploying a cloud-hosted server infrastructure must obtain which authorization before processing government data under FedRAMP?
- Authority to Connect (ATC)
- Authority to Operate (ATO) (Correct answer)
- Certification and Accreditation (C&A)
- Risk Acceptance Letter (RAL)
Correct answer: Authority to Operate (ATO)
FedRAMP requires cloud service providers to obtain an Authority to Operate (ATO) from a federal agency or a JAB Provisional ATO before processing federal data.
Question 2: An organization must restrict which users can install software on servers to comply with CIS Benchmark hardening standards. Which Group Policy setting achieves this most effectively?
- Enable UAC for all users
- Configure Software Restriction Policies or AppLocker (Correct answer)
- Disable the Windows Installer
- Set 'Prevent access to registry editing tools'
Correct answer: Configure Software Restriction Policies or AppLocker
AppLocker (or Software Restriction Policies) allows administrators to define exactly which applications are permitted to run, blocking unauthorized software installation.
Question 3: A company undergoing an ISO 27001 audit must demonstrate a formal risk assessment process. Which Windows Server tool helps quantify risk by showing the effective permissions a user has?
- Active Directory Users and Computers
- Effective Access tab in Advanced Security Settings (Correct answer)
- Group Policy Results Wizard
- Security Configuration Wizard (SCW)
Correct answer: Effective Access tab in Advanced Security Settings
The Effective Access tab in Advanced Security Settings shows the cumulative permissions a specific user or group has on an object, supporting ISO 27001 access rights review requirements.
Question 4: HIPAA requires covered entities to have a contingency plan, including data backup. Which Windows Server role provides automated, policy-driven backup to meet this requirement?
- Windows Server Backup (Correct answer)
- Data Deduplication
- Storage Spaces Direct
- Distributed File System Replication (DFSR)
Correct answer: Windows Server Backup
Windows Server Backup provides scheduled, policy-driven backup of server data and system state, fulfilling HIPAA's contingency plan data backup requirement.
Question 5: Under PCI DSS Requirement 1, only authorized traffic may access the cardholder data environment. Which Windows Server feature enforces host-based traffic filtering at the server level?
- Network Access Protection (NAP)
- Windows Firewall with Advanced Security (WFAS) (Correct answer)
- Routing and Remote Access Service (RRAS)
- DNS Security Extensions (DNSSEC)
Correct answer: Windows Firewall with Advanced Security (WFAS)
Windows Firewall with Advanced Security enforces inbound and outbound traffic rules at the host level, controlling which traffic can reach the cardholder data environment.
Question 6: An organization must prove to FISMA auditors that its servers are configured to a defined baseline. Which Windows Server tool compares current configuration against a Security Template?
- Security Configuration and Analysis snap-in (Correct answer)
- Best Practices Analyzer (BPA)
- Resultant Set of Policy (RSoP)
- System Center Configuration Manager (SCCM) Compliance
Correct answer: Security Configuration and Analysis snap-in
The Security Configuration and Analysis snap-in imports a security template and compares it against the current system configuration, identifying deviations from the baseline.
Question 7: A SOX compliance officer requires that financial server administrator accounts have their password reset every 30 days. What is the most scalable way to enforce this using Active Directory?
- Manually remind admins to change passwords
- Apply a Fine-Grained Password Policy (PSO) with MaxPasswordAge=30 to the admin group (Correct answer)
- Enable the default domain policy with a 30-day maximum password age for all users
- Use a logon script to check and force password changes
Correct answer: Apply a Fine-Grained Password Policy (PSO) with MaxPasswordAge=30 to the admin group
A Fine-Grained Password Policy applied to the admin security group enforces the 30-day maximum without affecting password policies for all other domain users.
70-413 Exam Regulatory Frameworks & Compliance 4
A federal agency deploying a cloud-hosted server infrastructure must obtain which authorization before processing government data under FedRAMP?