MCTS 70-640 Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Your organization must comply with SOX requirements and needs to ensure that all privileged AD account activity is logged. Which audit policy subcategory should you enable?
- Audit Account Management
- Audit Directory Service Access
- Audit Privilege Use (Correct answer)
- Audit Policy Change
Correct answer: Audit Privilege Use
Audit Privilege Use tracks when a user exercises a user right, which is required to log privileged account activity for SOX compliance.
Question 2: A compliance officer requires that all domain controllers retain security event logs for at least 90 days without overwriting. Which Group Policy setting controls this?
- Maximum security log size
- Retention method for security log (Correct answer)
- Audit object access
- Event log service startup
Correct answer: Retention method for security log
The 'Retention method for security log' policy set to 'Do not overwrite events' ensures logs are preserved until manually cleared.
Question 3: Under HIPAA compliance, your AD environment must enforce automatic workstation lockout after a period of inactivity. Which GPO setting accomplishes this?
- Account lockout threshold
- Interactive logon: Machine inactivity limit (Correct answer)
- Screen saver timeout with password protection
- Force logoff when logon hours expire
Correct answer: Interactive logon: Machine inactivity limit
'Interactive logon: Machine inactivity limit' is the Windows Server 2008 security policy that locks the workstation after a set idle period.
Question 4: Which Windows Server 2008 feature allows you to apply different password complexity and length requirements to specific AD security groups rather than the entire domain?
- Group Policy password filtering
- Password Settings Objects (PSOs) (Correct answer)
- Security Configuration Wizard
- Local Security Policy override
Correct answer: Password Settings Objects (PSOs)
Password Settings Objects (PSOs) implement fine-grained password policies, allowing different password requirements for specific users or groups.
Question 5: For PCI-DSS compliance, an administrator must ensure that service accounts cannot be used for interactive logon. Which setting should be applied?
- Deny log on locally (Correct answer)
- Account is sensitive and cannot be delegated
- Log on as a service right only
- Disable the account when not in use
Correct answer: Deny log on locally
'Deny log on locally' user right prevents the specified accounts from interactively logging on to any machine where the GPO applies.
Question 6: A regulatory audit finds that your domain lacks a legal warning banner before logon. Which Group Policy setting displays a logon message to users?
- Interactive logon: Message title for users attempting to log on
- Interactive logon: Do not display last user name
- Legal Notice Caption and Text
- Both A and C together (Correct answer)
Correct answer: Both A and C together
Both 'Interactive logon: Message title for users attempting to log on' (caption) and the corresponding text setting must be configured together to display a legal banner.
Question 7: Your security policy mandates that cached credentials must be disabled on laptops to meet compliance requirements. Which Group Policy setting should be configured to 0?
- Interactive logon: Number of previous logons to cache (Correct answer)
- Accounts: Limit local account use of blank passwords
- Network access: Number of simultaneous connections
- Interactive logon: Require smart card
Correct answer: Interactive logon: Number of previous logons to cache
Setting 'Interactive logon: Number of previous logons to cache' to 0 prevents Windows from caching domain credentials locally.
MCTS 70-640 Regulatory Frameworks & Compliance 2
Your organization must comply with SOX requirements and needs to ensure that all privileged AD account activity is logged.
Which audit policy subcategory should you enable?