70-413 Exam Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A company must implement network admission control to ensure only compliant (patched, AV-enabled) machines can access the internal network. Which Windows Server role provides this?
- Active Directory Federation Services (AD FS)
- Network Access Protection (NAP) (Correct answer)
- Network Policy Server (NPS) without NAP
- DirectAccess
Correct answer: Network Access Protection (NAP)
Network Access Protection evaluates client health against defined policies and restricts or remediates non-compliant machines before granting full network access.
Question 2: Under GDPR, personal data must not be transferred outside the EU without adequate protections. When designing a Windows Server infrastructure with Azure integration, which feature controls data residency?
- Azure Active Directory Conditional Access
- Azure region selection and data residency policies (Correct answer)
- Active Directory Sites and Services replication topology
- Azure ExpressRoute with private peering
Correct answer: Azure region selection and data residency policies
Selecting specific Azure regions and applying data residency policies ensures personal data remains within EU boundaries, satisfying GDPR's data transfer restrictions.
Question 3: An auditor requires proof that privileged account usage on domain controllers is monitored. Which audit policy logs when a user exercises a user right such as 'Act as part of the operating system'?
- Audit Account Management
- Audit Privilege Use (Correct answer)
- Audit Special Logon
- Audit Security State Change
Correct answer: Audit Privilege Use
Audit Privilege Use generates events when a user account exercises a user right, capturing privileged operations for compliance reporting on domain controller activity.
Question 4: CIS Controls require disabling unnecessary services on servers to reduce attack surface. Which Windows Server tool assesses which roles and services are needed and generates a security policy accordingly?
- Server Manager Role Assessment
- Security Configuration Wizard (SCW) (Correct answer)
- Microsoft Baseline Security Analyzer (MBSA)
- Attack Surface Analyzer
Correct answer: Security Configuration Wizard (SCW)
The Security Configuration Wizard guides administrators through role-based questions and generates a security policy that disables unneeded services and ports.
Question 5: PCI DSS requires that access to system components is assigned an individual ID so each user can be held accountable. What Active Directory practice directly supports this requirement?
- Using shared administrative accounts for efficiency
- Assigning individual user accounts and prohibiting shared accounts (Correct answer)
- Using group Managed Service Accounts (gMSA) for all users
- Enabling single sign-on with federation
Correct answer: Assigning individual user accounts and prohibiting shared accounts
Assigning unique individual accounts to every user ensures accountability and non-repudiation, which is a direct PCI DSS Requirement 8 mandate.
Question 6: A defense contractor must comply with CMMC (Cybersecurity Maturity Model Certification) Level 2, which maps to NIST SP 800-171. Which Windows Server capability addresses the requirement to limit unsuccessful logon attempts?
- Account Lockout Policy in Group Policy (Correct answer)
- Protected Users security group
- Credential Guard
- Microsoft Passport for Work
Correct answer: Account Lockout Policy in Group Policy
Account Lockout Policy settings (threshold, duration, and observation window) directly implement NIST SP 800-171 control 3.1.8 for limiting failed logon attempts.
Question 7: An ISO 27001-certified organization must perform regular internal audits of IT controls. Which Windows Server feature provides a detailed report of all Group Policy settings applied to a specific computer?
- Group Policy Management Console (GPMC) with Group Policy Results (Correct answer)
- Active Directory Administrative Center
- Event Viewer Group Policy operational log
- Dcdiag /test:netlogons
Correct answer: Group Policy Management Console (GPMC) with Group Policy Results
The Group Policy Results Wizard in GPMC generates an RSoP report showing every policy setting applied to a computer or user, providing evidence for ISO 27001 control audits.
70-413 Exam Regulatory Frameworks & Compliance 5
A company must implement network admission control to ensure only compliant (patched, AV-enabled) machines can access the internal network.
Which Windows Server role provides this?