MCTS 70-640 Research & Evidence-Based Practice 3

Question 1

An auditor requires evidence that privileged group membership changes are being tracked in Windows Server 2008 AD. Which built-in report source captures additions and removals from Domain Admins?

Accepted Answer

Security event log with Audit Account Management enabled

Answer

Enabling 'Audit Account Management' causes Windows to log event 4728/4729 whenever members are added or removed from security groups.

Question 2

A compliance officer needs to prove that the AD schema has not been modified since a specific date. Which approach provides the best forensic evidence?

Accepted Answer

Check the schemaInfo attribute version number and compare to a known baseline

Answer

The schemaInfo attribute in the schema NC root contains a version number that increments with each schema extension, providing a clear modification indicator.

Question 3

Which Windows Server 2008 feature allows administrators to configure different password complexity and lockout policies for different groups of users without creating multiple domains?

Accepted Answer

Fine-Grained Password Policies (PSOs)

Answer

Fine-Grained Password Policies use Password Settings Objects (PSOs) stored in the Password Settings Container to apply different policies to specific users or groups.

Question 4

When gathering evidence of unauthorized LDAP queries against AD, which component should be configured to log search operations?

Accepted Answer

LDAP Interface Events diagnostic logging on the domain controller

Answer

Setting the 'LDAP Interface Events' registry value under NTDS\Diagnostics to level 5 logs all LDAP operations to the Directory Service event log.

Question 5

An AD DS recovery plan requires documenting the current tombstone lifetime. Where is this value stored in Active Directory?

Accepted Answer

tombstoneLifetime attribute on the Directory Service object in the configuration partition

Answer

The tombstoneLifetime attribute is stored on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=... and defaults to 180 days in Windows Server 2008.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Research & Evidence-Based Practice 3