Administering Windows Server 2012 Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which Windows Server 2012 feature allows administrators to delegate specific AD management tasks without granting full Domain Admin rights, supporting least-privilege compliance?
- Group Policy Filtering
- Active Directory Delegation of Control (Correct answer)
- PowerShell Constrained Endpoints
- File Server Resource Manager
Correct answer: Active Directory Delegation of Control
Active Directory Delegation of Control allows specific administrative tasks to be assigned to users or groups without granting full Domain Admin privileges.
Question 2: A compliance requirement mandates that service accounts cannot interactively log on to servers. Which Group Policy User Rights Assignment enforces this?
- Deny log on locally (Correct answer)
- Deny access to this computer from the network
- Account is sensitive and cannot be delegated
- Log on as a service
Correct answer: Deny log on locally
The 'Deny log on locally' user right prevents specified accounts from opening interactive desktop sessions on a server.
Question 3: Which Windows Server 2012 auditing policy should be enabled to capture when members are added to privileged groups such as Domain Admins?
- Audit Account Management (Correct answer)
- Audit Logon Events
- Audit Object Access
- Audit Policy Change
Correct answer: Audit Account Management
Audit Account Management records group membership changes including additions and removals from security groups.
Question 4: An organization must demonstrate to auditors that Windows Server 2012 systems conform to a published security baseline. Which Microsoft tool provides these baselines as importable GPOs?
- Windows Assessment and Deployment Kit (ADK)
- Microsoft Security Compliance Manager (SCM) (Correct answer)
- System Center Configuration Manager
- Windows Server Migration Tools
Correct answer: Microsoft Security Compliance Manager (SCM)
Microsoft Security Compliance Manager provides pre-built Group Policy baselines aligned to CIS, NIST, and Microsoft security recommendations.
Question 5: Which Windows Server 2012 feature controls which applications users can run, using rules based on publisher signature, file path, or hash to support application control compliance?
- BitLocker
- Windows Defender
- AppLocker (Correct answer)
- Windows Resource Protection
Correct answer: AppLocker
AppLocker uses publisher, path, or hash rules to restrict which applications users can execute, supporting application whitelisting compliance requirements.
Question 6: A PCI DSS audit requires evidence that default vendor accounts were addressed on Windows Server 2012. Which built-in account must be renamed or disabled per PCI DSS Requirement 2.1?
- Network Service
- Local Service
- Administrator (Correct answer)
- Guest
Correct answer: Administrator
The built-in Administrator account has a well-known name and should be renamed or disabled per PCI DSS Requirement 2.1 to prevent targeted brute force attacks.
Question 7: For SOX IT general controls, an auditor requests evidence of access reviews. Which Windows Server 2012 feature can generate a report of all members of the Domain Admins group?
- Active Directory Administrative Center (ADAC) with PowerShell history
- Get-ADGroupMember PowerShell cmdlet output (Correct answer)
- Windows Event Viewer Security log
- Group Policy Results Wizard
Correct answer: Get-ADGroupMember PowerShell cmdlet output
The Get-ADGroupMember cmdlet retrieves all members of a specified AD group, providing auditor-ready evidence of privileged group membership.
Administering Windows Server 2012 Regulatory Frameworks & Compliance 4
Which Windows Server 2012 feature allows administrators to delegate specific AD management tasks without granting full Domain Admin rights, supporting least-privilege compliance?