MCTS 70-640 Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A regulatory requirement mandates that all removable storage be blocked on workstations in the finance OU. Which Group Policy area contains device installation restriction settings?
- Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions (Correct answer)
- Computer Configuration > Windows Settings > Security Settings > System Services
- User Configuration > Administrative Templates > Control Panel > Hardware
- Computer Configuration > Administrative Templates > Windows Components > BitLocker
Correct answer: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions
Device Installation Restrictions under System > Device Installation in Administrative Templates allows you to prevent installation of removable storage devices.
Question 2: Under GLBA compliance, your organization must encrypt all data on mobile devices. Which Windows Server 2008 feature, managed through AD, enforces BitLocker encryption on domain-joined laptops?
- BitLocker Network Unlock
- BitLocker Drive Encryption GPO settings (Correct answer)
- EFS with domain recovery agent
- Windows Defender policy enforcement
Correct answer: BitLocker Drive Encryption GPO settings
Group Policy BitLocker Drive Encryption settings can require BitLocker on fixed and removable drives, enforcing encryption compliance on domain-joined machines.
Question 3: Which AD DS feature allows you to prove to auditors that no unauthorized changes were made to the AD schema by comparing against a known-good state?
- AD Recycle Bin
- AD Snapshot (ntdsutil snapshot) (Correct answer)
- AD Audit Policy with directory service changes
- Replication metadata (repadmin /showobjmeta)
Correct answer: AD Snapshot (ntdsutil snapshot)
AD snapshots created with ntdsutil allow you to mount and compare a point-in-time copy of the AD database against the current state without impacting production.
Question 4: A compliance framework requires that smart card logon be mandatory for all privileged administrators. Which setting enforces this at the account level in AD?
- Smart card is required for interactive logon (account property)
- Interactive logon: Require smart card (Security Option GPO)
- Enforce smart card use in Kerberos Policy
- Both A and B are required together (Correct answer)
Correct answer: Both A and B are required together
The account-level flag forces the user's password to change to a random value, while the GPO Security Option prevents non-smart-card logons at the machine level — both are needed for full enforcement.
Question 5: Your compliance officer requires a quarterly report of all AD group membership changes for privileged groups. Which event ID in the Security log records when a member is added to a security-enabled global group?
- Event ID 4728 (Correct answer)
- Event ID 4732
- Event ID 4756
- Event ID 4648
Correct answer: Event ID 4728
Event ID 4728 is logged when a member is added to a security-enabled global group, which covers most privileged AD groups like Domain Admins.
Question 6: To meet compliance requirements, you must ensure that when a user's AD account is disabled, their Kerberos tickets are immediately invalidated. What is the maximum Kerberos ticket lifetime you should configure?
- 10 minutes
- 10 hours
- Maximum user ticket lifetime matches account check interval
- Tickets cannot be revoked before expiry; minimize lifetime to reduce window (Correct answer)
Correct answer: Tickets cannot be revoked before expiry; minimize lifetime to reduce window
Kerberos tickets cannot be revoked mid-lifetime; minimizing the ticket lifetime (e.g., 1-2 hours) reduces the window during which a disabled account's tickets remain valid.
Question 7: A PCI-DSS audit requires that all DNS zone transfers be restricted to authorized secondary DNS servers only. In Windows DNS, which setting controls this?
- Zone transfer settings: Only to servers listed on the Name Servers tab (Correct answer)
- DNSSEC signing policy
- DNS server forwarder list restriction
- Active Directory-integrated zone replication scope
Correct answer: Zone transfer settings: Only to servers listed on the Name Servers tab
In DNS zone properties, configuring 'Allow zone transfers' to 'Only to servers listed on the Name Servers tab' restricts zone transfers to authorized secondaries only.
MCTS 70-640 Regulatory Frameworks & Compliance 5
A regulatory requirement mandates that all removable storage be blocked on workstations in the finance OU.
Which Group Policy area contains device installation restriction settings?