Regulatory Frameworks & Compliance Flashcards

Which Windows Server 2012 feature allows administrators to delegate specific AD management tasks without granting full Domain Admin rights, supporting least-privilege compliance?

Answer: Active Directory Delegation of Control

Active Directory Delegation of Control allows specific administrative tasks to be assigned to users or groups without granting full Domain Admin privileges.

A compliance requirement mandates that service accounts cannot interactively log on to servers. Which Group Policy User Rights Assignment enforces this?

Answer: Deny log on locally

The 'Deny log on locally' user right prevents specified accounts from opening interactive desktop sessions on a server.

Which Windows Server 2012 auditing policy should be enabled to capture when members are added to privileged groups such as Domain Admins?

Answer: Audit Account Management

Audit Account Management records group membership changes including additions and removals from security groups.

An organization must demonstrate to auditors that Windows Server 2012 systems conform to a published security baseline. Which Microsoft tool provides these baselines as importable GPOs?

Answer: Microsoft Security Compliance Manager (SCM)

Microsoft Security Compliance Manager provides pre-built Group Policy baselines aligned to CIS, NIST, and Microsoft security recommendations.

Which Windows Server 2012 feature controls which applications users can run, using rules based on publisher signature, file path, or hash to support application control compliance?

Answer: AppLocker

AppLocker uses publisher, path, or hash rules to restrict which applications users can execute, supporting application whitelisting compliance requirements.

A PCI DSS audit requires evidence that default vendor accounts were addressed on Windows Server 2012. Which built-in account must be renamed or disabled per PCI DSS Requirement 2.1?

Answer: Administrator

The built-in Administrator account has a well-known name and should be renamed or disabled per PCI DSS Requirement 2.1 to prevent targeted brute force attacks.

For SOX IT general controls, an auditor requests evidence of access reviews. Which Windows Server 2012 feature can generate a report of all members of the Domain Admins group?

Answer: Get-ADGroupMember PowerShell cmdlet output

The Get-ADGroupMember cmdlet retrieves all members of a specified AD group, providing auditor-ready evidence of privileged group membership.