MCSE MSCE Security Protocols & Compliance Standards 4

Question 1

A company must comply with SOC 2 Type II. What distinguishes a Type II report from a Type I report?

Accepted Answer

Type II evaluates design and operating effectiveness over a period, Type I only evaluates design at a point in time

Answer

Type II covers more trust service criteria than Type I

Answer

Type II is performed by internal auditors while Type I requires external auditors

Answer

Type II applies only to cloud providers while Type I applies to on-premises systems

Question 2

Which Windows feature encrypts the LSA secrets and cached credentials in memory to protect against tools like Mimikatz that perform pass-the-hash attacks?

Accepted Answer

Windows Defender Credential Guard

Answer

Secure Boot

Answer

Device Guard

Answer

AppLocker

Question 3

Under GDPR, what is the maximum time frame an organization has to notify the supervisory authority after discovering a personal data breach that is likely to result in a risk to individuals?

Accepted Answer

72 hours

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 4

An MCSE candidate must configure certificate auto-enrollment for domain computers. Which combination of settings is required?

Accepted Answer

Enterprise CA + certificate template with autoenroll permission + GPO enabling autoenrollment

Answer

Standalone CA + default web enrollment + manual import script

Answer

Third-party CA + OCSP responder + manual GPO script

Answer

Enterprise CA + manual MMC snap-in enrollment for each machine

Question 5

Which protocol does Windows Remote Management (WinRM) use by default for secure communication when connecting to a remote host over HTTPS?

Accepted Answer

SOAP over TLS on port 5986

Answer

RPC over SMB on port 445

Answer

SSH on port 22

Answer

LDAP over TLS on port 636

Question 6

A financial institution's Windows servers must enforce the principle of least privilege for service accounts. Which Active Directory feature allows service accounts to automatically manage their own passwords without storing them in plaintext?

Accepted Answer

Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs)

Answer

Default service account with Password Never Expires flag

Answer

Credential Manager with stored Windows credentials

Answer

Virtual accounts created per-service

Question 7

Which attack does DNSSEC primarily protect against by providing cryptographic origin authentication of DNS data?

Accepted Answer

DNS cache poisoning attacks

Answer

DNS amplification DDoS attacks

Answer

DNS tunneling exfiltration

Answer

DNS sinkholing