MCTS 70-640 Regulatory Frameworks & Compliance 5

Question 1

A regulatory requirement mandates that all removable storage be blocked on workstations in the finance OU. Which Group Policy area contains device installation restriction settings?

Accepted Answer

Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

Answer

Device Installation Restrictions under System > Device Installation in Administrative Templates allows you to prevent installation of removable storage devices.

Question 2

Under GLBA compliance, your organization must encrypt all data on mobile devices. Which Windows Server 2008 feature, managed through AD, enforces BitLocker encryption on domain-joined laptops?

Accepted Answer

BitLocker Drive Encryption GPO settings

Answer

Group Policy BitLocker Drive Encryption settings can require BitLocker on fixed and removable drives, enforcing encryption compliance on domain-joined machines.

Question 3

Which AD DS feature allows you to prove to auditors that no unauthorized changes were made to the AD schema by comparing against a known-good state?

Accepted Answer

AD Snapshot (ntdsutil snapshot)

Answer

AD snapshots created with ntdsutil allow you to mount and compare a point-in-time copy of the AD database against the current state without impacting production.

Question 4

A compliance framework requires that smart card logon be mandatory for all privileged administrators. Which setting enforces this at the account level in AD?

Accepted Answer

Both A and B are required together

Answer

The account-level flag forces the user's password to change to a random value, while the GPO Security Option prevents non-smart-card logons at the machine level — both are needed for full enforcement.

Question 5

Your compliance officer requires a quarterly report of all AD group membership changes for privileged groups. Which event ID in the Security log records when a member is added to a security-enabled global group?

Accepted Answer

Event ID 4728

Answer

Event ID 4728 is logged when a member is added to a security-enabled global group, which covers most privileged AD groups like Domain Admins.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Regulatory Frameworks & Compliance 5