MCSE MSCE Security Protocols & Compliance Standards 3 — Questions and Answers
Question 1: A healthcare organization must comply with HIPAA Security Rule. Which of the following is classified as an 'Addressable' implementation specification rather than 'Required'?
- Unique user identification
- Emergency access procedure
- Automatic logoff (Correct answer)
- Audit controls
Correct answer: Automatic logoff
Automatic logoff is an Addressable implementation specification under HIPAA, meaning organizations must implement it if reasonable and appropriate or document why not.
Question 2: Which Active Directory feature allows administrators to define fine-grained password policies for specific users or groups without affecting the Default Domain Policy?
- Account Lockout Policy GPO
- Password Settings Objects (PSOs) (Correct answer)
- Kerberos Policy settings
- Local Security Authority settings
Correct answer: Password Settings Objects (PSOs)
Password Settings Objects (PSOs) in Active Directory allow fine-grained password and lockout policies to be applied to specific users or groups, overriding the domain-level policy.
Question 3: A penetration test reveals that an attacker can relay NTLM authentication from one server to another to gain unauthorized access. Which mitigation directly prevents NTLM relay attacks?
- Enabling SMB signing on all servers (Correct answer)
- Disabling IPv6
- Enabling NetBIOS over TCP/IP
- Configuring DNS suffixes
Correct answer: Enabling SMB signing on all servers
SMB signing ensures that SMB packets are digitally signed, preventing an attacker from relaying captured NTLM authentication to another server.
Question 4: Under ISO/IEC 27001, which clause specifically requires organizations to determine the context of the organization and identify interested parties?
- Clause 5 — Leadership
- Clause 4 — Context of the Organization (Correct answer)
- Clause 6 — Planning
- Clause 8 — Operation
Correct answer: Clause 4 — Context of the Organization
ISO 27001 Clause 4 requires organizations to understand their internal and external context and identify the needs and expectations of interested parties.
Question 5: Which Windows Server role service provides a centralized policy engine for authenticating and authorizing network access based on RADIUS?
- Routing and Remote Access Service (RRAS)
- Network Policy Server (NPS) (Correct answer)
- Web Application Proxy (WAP)
- Active Directory Federation Services (AD FS)
Correct answer: Network Policy Server (NPS)
Network Policy Server (NPS) is the Microsoft implementation of RADIUS, providing centralized authentication, authorization, and accounting for network access.
Question 6: An organization wants to ensure that keys used for encrypting sensitive data are never exposed in plaintext outside of a hardware boundary. Which Azure service fulfills this requirement?
- Azure Key Vault Standard tier
- Azure Key Vault Managed HSM (Correct answer)
- Azure Information Protection labels
- BitLocker with TPM only
Correct answer: Azure Key Vault Managed HSM
Azure Key Vault Managed HSM uses FIPS 140-2 Level 3 validated hardware security modules where private keys never leave the HSM boundary in plaintext.
Question 7: Which Kerberos delegation type allows a service to impersonate a user to any service in the domain, posing the highest security risk?
- Resource-Based Constrained Delegation
- Constrained Delegation with Protocol Transition
- Unconstrained Delegation (Correct answer)
- S4U2Proxy only
Correct answer: Unconstrained Delegation
Unconstrained Delegation allows a service to forward the user's TGT to any service in the domain, making it the most dangerous delegation type if the server is compromised.
MCSE MSCE Security Protocols & Compliance Standards 3
A healthcare organization must comply with HIPAA Security Rule.
Which of the following is classified as an 'Addressable' implementation specification rather than 'Required'?