MCTS 70-640 Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: An auditor requires evidence that privileged group membership changes are being tracked in Windows Server 2008 AD. Which built-in report source captures additions and removals from Domain Admins?
- Security event log with Audit Account Management enabled (Correct answer)
- Application event log
- Directory Service event log
- System event log
Correct answer: Security event log with Audit Account Management enabled
Enabling 'Audit Account Management' causes Windows to log event 4728/4729 whenever members are added or removed from security groups.
Question 2: A compliance officer needs to prove that the AD schema has not been modified since a specific date. Which approach provides the best forensic evidence?
- Check the schemaInfo attribute version number and compare to a known baseline (Correct answer)
- Run dcdiag /test:Schema
- Review the Application event log on the Schema Master
- Query the configuration partition for recent changes
Correct answer: Check the schemaInfo attribute version number and compare to a known baseline
The schemaInfo attribute in the schema NC root contains a version number that increments with each schema extension, providing a clear modification indicator.
Question 3: Which Windows Server 2008 feature allows administrators to configure different password complexity and lockout policies for different groups of users without creating multiple domains?
- Fine-Grained Password Policies (PSOs) (Correct answer)
- Group Policy Password Settings
- Security Templates
- Local Security Policy
Correct answer: Fine-Grained Password Policies (PSOs)
Fine-Grained Password Policies use Password Settings Objects (PSOs) stored in the Password Settings Container to apply different policies to specific users or groups.
Question 4: When gathering evidence of unauthorized LDAP queries against AD, which component should be configured to log search operations?
- LDAP Interface Events diagnostic logging on the domain controller (Correct answer)
- Network Monitor capture on port 389
- Security audit policy for Directory Service Access
- Netlogon debug logging
Correct answer: LDAP Interface Events diagnostic logging on the domain controller
Setting the 'LDAP Interface Events' registry value under NTDS\Diagnostics to level 5 logs all LDAP operations to the Directory Service event log.
Question 5: An AD DS recovery plan requires documenting the current tombstone lifetime. Where is this value stored in Active Directory?
- tombstoneLifetime attribute on the Directory Service object in the configuration partition (Correct answer)
- Schema partition root object
- Domain partition root object
- defaultNamingContext attribute on RootDSE
Correct answer: tombstoneLifetime attribute on the Directory Service object in the configuration partition
The tombstoneLifetime attribute is stored on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=... and defaults to 180 days in Windows Server 2008.
Question 6: To produce evidence that AD DS backups are occurring within the 60-day tombstone lifetime requirement, which event ID should be monitored in the Application log?
- Event ID 2089 (backup latency warning) (Correct answer)
- Event ID 1000 (backup complete)
- Event ID 4771 (Kerberos pre-auth failed)
- Event ID 517 (audit log cleared)
Correct answer: Event ID 2089 (backup latency warning)
Event ID 2089, logged by the AD DS database, warns that a naming context has not been backed up within a percentage of the tombstone lifetime.
Question 7: A Windows Server 2008 domain administrator needs to research which user last modified a specific AD object attribute. Which tool with which option retrieves this metadata?
- repadmin /showobjmeta (Correct answer)
- ldp.exe with a base search
- adsiedit.msc viewing object properties
- dsquery with -attr
Correct answer: repadmin /showobjmeta
repadmin /showobjmeta displays per-attribute replication metadata including the originating DC, USN, and timestamp of the last change for each attribute.
MCTS 70-640 Research & Evidence-Based Practice 3
An auditor requires evidence that privileged group membership changes are being tracked in Windows Server 2008 AD.
Which built-in report source captures additions and removals from Domain Admins?