MCTS 70-640 Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A security auditor needs to review which users have the 'Manage auditing and security log' right in your domain. Where is this right configured by default?
- Default Domain Policy
- Default Domain Controllers Policy (Correct answer)
- Local Security Policy on each DC
- AD Administrative Center > Security Settings
Correct answer: Default Domain Controllers Policy
The 'Manage auditing and security log' user right is defined in the Default Domain Controllers Policy GPO, which applies only to domain controllers.
Question 2: Your organization is implementing AD RMS to comply with data classification requirements. Which AD RMS role service issues use licenses that allow users to consume protected content?
- AD RMS Certification
- AD RMS Licensing (Correct answer)
- AD RMS Enrollment
- AD RMS Identity Federation
Correct answer: AD RMS Licensing
The AD RMS Licensing role service issues use licenses that grant authenticated users the rights to open and interact with RMS-protected content.
Question 3: Which certificate template setting prevents a user from exporting their issued certificate's private key, meeting compliance requirements for non-exportable keys?
- Mark private key as exportable = unchecked in the Key Archival tab
- Do not allow private key to be exported = enabled in the Request Handling tab (Correct answer)
- Key usage = Digital Signature only
- Publish certificate in Active Directory = disabled
Correct answer: Do not allow private key to be exported = enabled in the Request Handling tab
In the certificate template's Request Handling tab, clearing 'Allow private key to be exported' ensures issued private keys cannot be exported from the machine.
Question 4: An internal audit reveals that several service accounts have 'Password never expires' set, violating your compliance policy. Which PowerShell cmdlet would identify all such accounts in bulk?
- Get-ADUser -Filter {PasswordNeverExpires -eq $true}
- Search-ADAccount -PasswordNeverExpires
- Get-ADServiceAccount -Filter {PasswordNeverExpires -eq $true}
- Both A and B return the same results for user accounts (Correct answer)
Correct answer: Both A and B return the same results for user accounts
Both Get-ADUser with a PasswordNeverExpires filter and Search-ADAccount -PasswordNeverExpires identify user accounts where the password never expires.
Question 5: For compliance with NIST SP 800-53, you must ensure that domain computers apply a minimum set of security settings regardless of their OU. Which approach is most appropriate?
- Link a GPO at the site level
- Link a GPO at the domain level (Correct answer)
- Link a GPO to each individual OU
- Use WMI filters on each OU-level GPO
Correct answer: Link a GPO at the domain level
Linking a baseline security GPO at the domain level ensures it applies to all computer objects in the domain regardless of which OU they reside in.
Question 6: A compliance policy requires that the built-in Administrator account be renamed on all domain computers. Which Group Policy setting accomplishes this?
- Security Options: Accounts: Rename administrator account (Correct answer)
- Restricted Groups: Rename built-in admin
- Preferences: Local Users and Groups
- Both A and C can accomplish this
Correct answer: Security Options: Accounts: Rename administrator account
'Accounts: Rename administrator account' under Security Options directly renames the built-in Administrator account to the specified name on all machines where the GPO applies.
Question 7: Your organization uses AD CS to issue certificates for compliance. Which CA type should be used for issuing certificates to external partners while keeping the root CA offline?
- Standalone Root CA online
- Enterprise Root CA with Web Enrollment
- Standalone Subordinate CA (Correct answer)
- Enterprise Subordinate CA
Correct answer: Standalone Subordinate CA
A Standalone Subordinate CA can issue certificates to external entities without AD integration, while the root CA remains offline for security.
MCTS 70-640 Regulatory Frameworks & Compliance 4
A security auditor needs to review which users have the 'Manage auditing and security log' right in your domain.
Where is this right configured by default?