MSCE Security Protocols & Compliance Standards Flashcards
7 cards from real MCSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 MSCE Security Protocols & Compliance Standards flashcards as text
A company must comply with SOC 2 Type II. What distinguishes a Type II report from a Type I report?
Answer: Type II evaluates design and operating effectiveness over a period, Type I only evaluates design at a point in time
SOC 2 Type II assesses whether controls were suitably designed AND operated effectively over an observation period (typically 6–12 months), whereas Type I only evaluates design at a single point in time.
Which Windows feature encrypts the LSA secrets and cached credentials in memory to protect against tools like Mimikatz that perform pass-the-hash attacks?
Answer: Windows Defender Credential Guard
Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a protected container, preventing credential theft tools from accessing them.
Under GDPR, what is the maximum time frame an organization has to notify the supervisory authority after discovering a personal data breach that is likely to result in a risk to individuals?
Answer: 72 hours
GDPR Article 33 requires controllers to notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it.
An MCSE candidate must configure certificate auto-enrollment for domain computers. Which combination of settings is required?
Answer: Enterprise CA + certificate template with autoenroll permission + GPO enabling autoenrollment
Auto-enrollment requires an Enterprise CA, a certificate template that grants the Autoenroll permission to the target security group, and a Group Policy setting that enables certificate autoenrollment.
Which protocol does Windows Remote Management (WinRM) use by default for secure communication when connecting to a remote host over HTTPS?
Answer: SOAP over TLS on port 5986
WinRM uses SOAP (WS-Management protocol) over TLS on port 5986 when HTTPS transport is configured for secure remote management.
A financial institution's Windows servers must enforce the principle of least privilege for service accounts. Which Active Directory feature allows service accounts to automatically manage their own passwords without storing them in plaintext?
Answer: Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs)
Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) allow Windows to automatically manage complex passwords for service accounts, eliminating plaintext password storage.
Which attack does DNSSEC primarily protect against by providing cryptographic origin authentication of DNS data?
Answer: DNS cache poisoning attacks
DNSSEC protects against DNS cache poisoning (Kaminsky-style attacks) by allowing resolvers to cryptographically verify that DNS responses come from the authoritative source and have not been tampered with.