Administering Windows Server 2012 Professional Standards & Competencies 5 — Questions and Answers
Question 1: A new Windows Server 2012 administrator joins the team. Which professional onboarding practice ensures they can manage servers effectively while maintaining security standards?
- Provide role-specific access using RBAC principles and document their account creation in the change log (Correct answer)
- Give them full domain admin rights immediately for maximum productivity
- Share the outgoing admin's credentials temporarily until their account is configured
- Create a single shared admin account for the entire team to simplify management
Correct answer: Provide role-specific access using RBAC principles and document their account creation in the change log
Role-based access control ensures new admins have only the permissions needed for their role, and change documentation maintains accountability.
Question 2: A Windows Server 2012 administrator is asked to validate that Group Policy settings are being applied correctly to client machines. Which tool provides the most accurate report of applied policies on a specific computer?
- gpresult /h report.html (Correct answer)
- gpupdate /force
- gpedit.msc
- netlogon.log
Correct answer: gpresult /h report.html
gpresult /h generates an HTML report showing all Group Policy Objects applied to the user and computer, including which settings are active and why others were filtered.
Question 3: During a routine server audit, an administrator discovers an unauthorized scheduled task created on a Windows Server 2012 machine. What is the most appropriate immediate action?
- Disable the task, preserve evidence by exporting task details, and escalate to the security team (Correct answer)
- Delete the task immediately to prevent further execution
- Run the task in a safe environment to understand what it does before reporting
- Ignore it if the server is performing normally to avoid unnecessary disruption
Correct answer: Disable the task, preserve evidence by exporting task details, and escalate to the security team
Disabling stops execution while evidence preservation supports forensic investigation, and escalation ensures the incident receives appropriate security response.
Question 4: An administrator is configuring Windows Server 2012 to support a PCI-DSS compliance requirement for strong authentication. Which feature helps enforce multi-factor authentication for administrative access?
- Smart card authentication integrated with Active Directory Certificate Services (Correct answer)
- Basic password authentication with complexity requirements only
- NTLM authentication with long passwords
- Anonymous authentication for administrative consoles
Correct answer: Smart card authentication integrated with Active Directory Certificate Services
Smart card authentication requires both a physical card (something you have) and a PIN (something you know), satisfying MFA requirements for PCI-DSS compliance.
Question 5: A Windows Server 2012 administrator is preparing for a disaster recovery drill. Which document should be verified and tested as part of professional DR preparedness?
- A documented runbook with step-by-step recovery procedures, contact lists, and RTO/RPO targets (Correct answer)
- A list of all installed software licenses
- The server hardware warranty information
- A chart of the network topology diagram only
Correct answer: A documented runbook with step-by-step recovery procedures, contact lists, and RTO/RPO targets
A runbook with tested procedures, escalation contacts, and defined RTO/RPO targets is the foundation of effective disaster recovery preparedness.
Question 6: When a Windows Server 2012 administrator identifies a critical vulnerability in a production system, which communication approach follows professional standards?
- Document the vulnerability, assess risk severity, and report to management with a remediation timeline before public disclosure (Correct answer)
- Immediately post details on a public forum to get community help fixing it
- Fix the vulnerability silently without informing management to avoid concern
- Wait until the next scheduled maintenance window without notifying stakeholders of the risk
Correct answer: Document the vulnerability, assess risk severity, and report to management with a remediation timeline before public disclosure
Responsible disclosure involves documenting, risk-assessing, informing management, and remediating before any external communication.
Question 7: An administrator is reviewing Windows Server 2012 logs after a failed login spike. Which event ID in the Security log indicates a failed logon attempt on a domain controller?
- 4625 (Correct answer)
- 4624
- 4648
- 4720
Correct answer: 4625
Event ID 4625 'An account failed to log on' is logged for all failed authentication attempts and is the primary indicator for investigating brute-force or credential-stuffing attacks.
Administering Windows Server 2012 Professional Standards & Competencies 5
A new Windows Server 2012 administrator joins the team.
Which professional onboarding practice ensures they can manage servers effectively while maintaining security standards?