MCTS 70-640 Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: An auditor requires proof that no unauthorized changes were made to Group Policy Objects. Which tool generates a report comparing current GPO settings against a baseline?
- Group Policy Results Wizard
- Group Policy Modeling Wizard
- GPMC backup comparison
- Security Configuration and Analysis snap-in (Correct answer)
Correct answer: Security Configuration and Analysis snap-in
The Security Configuration and Analysis snap-in compares current system security settings against a saved baseline (.inf template) and highlights discrepancies.
Question 2: For FISMA compliance, all AD objects must have their changes tracked. Which audit policy must be enabled to log changes to AD object attributes?
- Audit Account Logon Events
- Audit Directory Service Changes (Correct answer)
- Audit Object Access
- Audit System Events
Correct answer: Audit Directory Service Changes
Audit Directory Service Changes logs when attributes of AD objects are modified, created, moved, or deleted, meeting FISMA change-tracking requirements.
Question 3: A compliance framework requires that all domain user accounts be set to expire after 90 days of inactivity. Which AD Users and Computers attribute controls account expiration?
- Account expires (Correct answer)
- Password must change at next logon
- Account is disabled
- Logon hours restriction
Correct answer: Account expires
The 'Account expires' attribute sets a hard expiration date on the account, after which it cannot be used to authenticate.
Question 4: Which Windows Server 2008 R2 AD DS tool helps you identify stale user and computer accounts that have not logged in within a specified number of days for compliance cleanup?
- dsquery (Correct answer)
- Active Directory Administrative Center
- ntdsutil
- repadmin
Correct answer: dsquery
The 'dsquery user -inactive <weeks>' command identifies accounts that have not logged on within the specified number of weeks.
Question 5: Your organization's compliance policy requires Kerberos tickets to expire within 8 hours. Where in Group Policy do you configure the maximum lifetime for a service ticket?
- Computer Configuration > Windows Settings > Security Settings > Account Policies > Kerberos Policy (Correct answer)
- Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
- User Configuration > Windows Settings > Security Settings > Account Policies
- Computer Configuration > Administrative Templates > System > Kerberos
Correct answer: Computer Configuration > Windows Settings > Security Settings > Account Policies > Kerberos Policy
Kerberos ticket lifetime settings are found under Account Policies > Kerberos Policy in the Computer Configuration section of Group Policy.
Question 6: A compliance requirement states that failed logon attempts must be limited to 5 before lockout. After investigation, accounts are locking out after only 3 failures. What is the most likely cause?
- A fine-grained password policy with stricter settings is applied to the affected group (Correct answer)
- The Default Domain Policy has not been refreshed
- Kerberos pre-authentication is disabled
- The PDC emulator is offline
Correct answer: A fine-grained password policy with stricter settings is applied to the affected group
Fine-grained password policies (PSOs) applied to a user's group take precedence over the Default Domain Policy if the PSO has a lower precedence value (higher priority).
Question 7: For SOX IT controls, you must demonstrate segregation of duties by preventing members of the 'Finance Admins' group from modifying AD group membership for 'Auditors'. How do you accomplish this?
- Remove Finance Admins from the Domain Admins group
- Use AD Delegation of Control to explicitly deny Finance Admins permission on the Auditors group object
- Apply a Deny Write Members ACE on the Auditors group object for Finance Admins
- Both B and C achieve the same result through the same mechanism (Correct answer)
Correct answer: Both B and C achieve the same result through the same mechanism
Delegation of Control and manually setting a Deny ACE on the group object accomplish the same thing — both apply a Deny permission to the specific AD object.
MCTS 70-640 Regulatory Frameworks & Compliance 3
An auditor requires proof that no unauthorized changes were made to Group Policy Objects.
Which tool generates a report comparing current GPO settings against a baseline?