Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Windows Server 2012 feature allows you to create a Just Enough Administration (JEA) model by restricting what cmdlets a delegated admin can run in PowerShell?
- PowerShell Constrained Language Mode via Group Policy AppLocker rules (Correct answer)
- Remote Desktop Gateway policies
- Network Policy Server conditions
- WMI filters on GPOs
Correct answer: PowerShell Constrained Language Mode via Group Policy AppLocker rules
AppLocker can restrict PowerShell to Constrained Language Mode, limiting available cmdlets to only what is needed for a role.
Question 2: A compliance requirement mandates that all DNS queries from domain clients be logged for forensic purposes. Which Windows Server 2012 DNS feature supports this?
- DNS Debug Logging (DNS server diagnostic logging) (Correct answer)
- DHCP audit logging
- Event ID 4624 in Security log
- Netlogon logging
Correct answer: DNS Debug Logging (DNS server diagnostic logging)
DNS debug logging records all queries and responses to a log file, enabling forensic review of DNS activity.
Question 3: Under NIST 800-171, CUI must be protected with FIPS 140-2 validated encryption. How do you enable FIPS compliance mode in Windows Server 2012?
- Enable the 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' policy setting (Correct answer)
- Install an additional encryption driver from a third party
- Change the registry key HKLM\System\CurrentControlSet\Services\LanManServer only
- Enable BitLocker without any additional policy change
Correct answer: Enable the 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' policy setting
The FIPS policy setting in Security Options forces Windows components to use only FIPS 140-2 validated cryptographic modules.
Question 4: An auditor requires proof that your Windows Server 2012 servers have no unnecessary services running, per CIS Benchmark guidance. Which tool quickly identifies and disables unneeded roles and services?
- Security Configuration Wizard (SCW) (Correct answer)
- Control Panel > Programs and Features
- Disk Cleanup utility
- System Configuration (msconfig.exe)
Correct answer: Security Configuration Wizard (SCW)
SCW analyzes the server's role and disables services, ports, and features not required, aligning with CIS attack-surface reduction guidance.
Question 5: GDPR requires that personal data breaches be detected and reported within 72 hours. Which Windows Server 2012 component helps detect unauthorized data access in near real-time?
- File Server Resource Manager (FSRM) with file screen alerts (Correct answer)
- Disk Defragmenter schedules
- DHCP lease expiry events
- Print Spooler service logs
Correct answer: File Server Resource Manager (FSRM) with file screen alerts
FSRM file screens can trigger email alerts when unauthorized file types or access patterns are detected on file servers.
Question 6: Which Windows Server 2012 Active Directory feature lets you apply a stricter password policy to a subset of privileged users without changing the domain-wide Default Domain Policy?
- Fine-Grained Password Policies (Password Settings Objects) (Correct answer)
- Organizational Unit (OU) redirection only
- Local Security Policy override
- Kerberos policy changes in Default Domain Policy
Correct answer: Fine-Grained Password Policies (Password Settings Objects)
Fine-Grained Password Policies use Password Settings Objects (PSOs) linked to users or global security groups to apply different policies within the same domain.
Question 7: For compliance with US Executive Order 13556 on CUI, which Windows Server 2012 capability helps classify and label sensitive files stored on file servers?
- Dynamic Access Control (DAC) with File Classification Infrastructure (FCI) (Correct answer)
- Simple file renaming conventions
- NTFS compression attributes
- Shadow Copies for version history only
Correct answer: Dynamic Access Control (DAC) with File Classification Infrastructure (FCI)
DAC with FCI automatically classifies files based on content or properties and can apply access policies based on those classifications.
Installing and Configuring Windows Server 2012 Exam Regulatory Frameworks & Compliance 5
Which Windows Server 2012 feature allows you to create a Just Enough Administration (JEA) model by restricting what cmdlets a delegated admin can run in PowerShell?