Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: You need to meet NIST SP 800-53 requirements for patch management. Which Windows Server 2012 role/feature automates patch distribution across your domain?
- Windows Server Update Services (WSUS) (Correct answer)
- Windows Deployment Services (WDS)
- System Center Configuration Manager only
- Microsoft Update website manually
Correct answer: Windows Server Update Services (WSUS)
WSUS is the built-in Windows Server role that centrally manages and distributes approved patches to domain-joined computers.
Question 2: FERPA requires protecting student education records. A Windows Server 2012 administrator should configure which setting to prevent unauthorized users from viewing sensitive shared folders?
- Enable the Guest account on file servers
- Apply NTFS permissions and Share permissions following least privilege (Correct answer)
- Store data in the Public share
- Disable auditing to reduce overhead
Correct answer: Apply NTFS permissions and Share permissions following least privilege
Combining restrictive NTFS and Share permissions with least privilege ensures only authorized users access student records.
Question 3: Under ISO 27001, you must demonstrate a formal risk assessment process. Which Windows Server 2012 built-in feature helps document security baselines as part of this process?
- Security Configuration Wizard (SCW) (Correct answer)
- Disk Management
- DHCP Server role
- DNS Manager
Correct answer: Security Configuration Wizard (SCW)
SCW guides administrators through role-based security configuration and produces XML policy files that document the baseline.
Question 4: A PCI DSS requirement mandates that a unique ID be assigned to each person with computer access. How is this enforced in Windows Server 2012 Active Directory?
- By sharing a single service account among all staff
- By creating individual user accounts in AD with no shared credentials (Correct answer)
- By using a single local Administrator account
- By enabling anonymous access on all services
Correct answer: By creating individual user accounts in AD with no shared credentials
Individual AD user accounts provide unique identifiers and enable per-user accountability required by PCI DSS requirement 8.
Question 5: Which Windows Server 2012 feature allows you to enforce that USB storage devices cannot be used on servers, supporting data loss prevention (DLP) compliance?
- AppLocker
- Group Policy Device Installation Restrictions (Correct answer)
- Windows Firewall
- BitLocker To Go
Correct answer: Group Policy Device Installation Restrictions
Group Policy Device Installation Restrictions can block installation of removable storage devices, preventing unauthorized data exfiltration.
Question 6: For HIPAA compliance, audit logs must be retained for six years. Where in Windows Server 2012 do you configure Event Log retention settings?
- Event Viewer > Log Properties (maximum log size and retention method) (Correct answer)
- Task Scheduler
- Server Manager > Dashboard
- Windows Update settings
Correct answer: Event Viewer > Log Properties (maximum log size and retention method)
Each event log's Properties dialog in Event Viewer lets you set the maximum size and whether to overwrite or archive logs.
Question 7: NERC CIP standards require physical and logical access controls for critical infrastructure. Which Active Directory feature in Windows Server 2012 helps restrict which computers privileged accounts can log on to?
- Account tab 'Log On To' restrictions in AD user properties (Correct answer)
- Password Policy settings
- DNS conditional forwarders
- DHCP reservations
Correct answer: Account tab 'Log On To' restrictions in AD user properties
The 'Log On To' setting in an AD user account restricts which workstations or servers that account can authenticate to.
Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 3
You need to meet NIST SP 800-53 requirements for patch management.
Which Windows Server 2012 role/feature automates patch distribution across your domain?