Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A compliance auditor asks you to demonstrate that privileged access is monitored on Windows Server 2012. Which audit subcategory should be enabled to track use of sensitive privileges?
- Audit Logon Events
- Audit Privilege Use (Correct answer)
- Audit Process Tracking
- Audit Directory Service Access
Correct answer: Audit Privilege Use
Enabling 'Audit Privilege Use' records events whenever a user exercises a user right, satisfying privileged-access monitoring requirements.
Question 2: Your organization is subject to CJIS Security Policy and must enforce multi-factor authentication. Which Windows Server 2012 feature supports certificate-based smart card authentication?
- RADIUS via NPS
- Active Directory Certificate Services (AD CS) with smart card enrollment (Correct answer)
- Windows Biometric Framework only
- NTLM authentication
Correct answer: Active Directory Certificate Services (AD CS) with smart card enrollment
AD CS issues smart card certificates, enabling PKI-based MFA which meets CJIS requirements for advanced authentication.
Question 3: Under DISA STIG guidance, the default Administrator account should be renamed. How do you enforce this across all domain computers using Windows Server 2012?
- Manually rename it on each computer
- Use a Group Policy setting under Security Options: 'Accounts: Rename administrator account' (Correct answer)
- Delete the account and create a new one
- Use a startup script that renames only on first boot
Correct answer: Use a Group Policy setting under Security Options: 'Accounts: Rename administrator account'
The 'Accounts: Rename administrator account' GPO setting pushes the rename to all computers in the linked scope.
Question 4: PCI DSS requirement 10 requires time synchronization across all systems. Which Windows Server 2012 service ensures consistent timestamps for audit logs?
- Windows Time Service (W32tm) (Correct answer)
- DHCP lease timestamps
- DNS TTL values
- NTP configured only on clients manually
Correct answer: Windows Time Service (W32tm)
Windows Time Service synchronizes clocks across domain members using the domain controller as the authoritative time source.
Question 5: A SOC 2 Type II audit requires evidence that access is revoked promptly when employees leave. Which process in Windows Server 2012 Active Directory directly addresses this?
- Disabling and then deleting user accounts per the offboarding procedure (Correct answer)
- Changing the user's password only
- Moving the user to a different OU
- Removing the user from the Domain Users group
Correct answer: Disabling and then deleting user accounts per the offboarding procedure
Disabling the account immediately blocks access, and subsequent deletion removes the account, fulfilling prompt access revocation.
Question 6: HIPAA's Technical Safeguards require automatic logoff of idle sessions. Which Windows Server 2012 Group Policy setting enforces this?
- Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options: 'Interactive logon: Machine inactivity limit' (Correct answer)
- User Configuration > Preferences > Control Panel Settings > Power Options
- Computer Configuration > Administrative Templates > System > Logon > Display logon information
- Adjust screen saver timeout via Display settings only
Correct answer: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options: 'Interactive logon: Machine inactivity limit'
The 'Machine inactivity limit' security option locks the screen after a defined idle period, meeting HIPAA automatic logoff requirements.
Question 7: For FedRAMP compliance, you must ensure all remote administrative connections are encrypted. Which Windows Server 2012 feature should be used instead of Telnet or unencrypted RDP?
- Telnet Server role
- RDP with Network Level Authentication (NLA) and TLS encryption enforced (Correct answer)
- VNC without encryption
- HTTP-based management tools only
Correct answer: RDP with Network Level Authentication (NLA) and TLS encryption enforced
Enforcing NLA and TLS on RDP ensures credentials and sessions are encrypted, meeting FedRAMP encryption-in-transit requirements.
Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 4
A compliance auditor asks you to demonstrate that privileged access is monitored on Windows Server 2012.
Which audit subcategory should be enabled to track use of sensitive privileges?