MCTS 70-640 Risk Assessment & Management 2 — Questions and Answers
Question 1: Your organization's security policy requires that service accounts used by IIS application pools have minimal privileges. Which AD account option best enforces this principle of least privilege?
- Add service accounts to the Domain Admins group for full access
- Use a Managed Service Account (MSA) scoped to a single server (Correct answer)
- Use a shared domain user account with a never-expiring password
- Create service accounts in the Users container with default permissions
Correct answer: Use a Managed Service Account (MSA) scoped to a single server
Managed Service Accounts (MSAs) are scoped to a single computer, have automatic password management, and provide least-privilege access for services.
Question 2: A security audit reveals that users in a branch office can modify the membership of the Domain Admins group. Which ACL permission on the group object must be revoked to mitigate this risk?
- Read permission on the group object
- Write Members permission on the group object (Correct answer)
- List Contents permission on the group object
- Read Group Policy Options permission
Correct answer: Write Members permission on the group object
The Write Members permission on the group object allows principals to add or remove members, and must be removed to prevent unauthorized elevation of privilege.
Question 3: An attacker performs a pass-the-hash attack using stolen NTLM hashes from a workstation. Which Windows Server 2008 feature most directly reduces the risk of credential theft from memory?
- Enabling NTLM authentication on all domain controllers
- Configuring Restricted Groups via Group Policy
- Enabling Credential Guard through BitLocker Drive Encryption policies
- Requiring Kerberos with Protected Users security group (Correct answer)
Correct answer: Requiring Kerberos with Protected Users security group
The Protected Users security group prevents members from using NTLM authentication and caches credentials, mitigating pass-the-hash attacks.
Question 4: During a risk assessment, you find that AD replication traffic between sites is unencrypted. Which setting mitigates the risk of replication data interception?
- Enable SMTP replication between site links
- Configure IPsec policies to encrypt LDAP replication traffic (Correct answer)
- Require Kerberos pre-authentication on the NTDS Settings object
- Enable replication compression in AD Sites and Services
Correct answer: Configure IPsec policies to encrypt LDAP replication traffic
IPsec policies can encrypt AD replication traffic between domain controllers, protecting against network interception of directory data.
Question 5: A risk assessment identifies that users can enumerate all objects in Active Directory via anonymous LDAP queries. Which setting eliminates this risk?
- Set the 'dsHeuristics' attribute to disable anonymous LDAP operations (Correct answer)
- Disable the LDAP service on all domain controllers
- Configure LDAP signing to require signing only
- Enable LDAP over SSL (LDAPS) on port 636
Correct answer: Set the 'dsHeuristics' attribute to disable anonymous LDAP operations
Setting the dsHeuristics attribute (specifically bit 7) disables anonymous LDAP searches, preventing unauthenticated enumeration of directory objects.
Question 6: Your security team determines that the risk of a rogue domain controller joining the domain is high. Which AD feature can prevent unauthorized computers from becoming domain controllers?
- Configuring the Default Domain Policy to deny logon locally for computers
- Using the 'Allow dcpromo only on pre-staged accounts' option via the Default Domain Controllers Policy (Correct answer)
- Adding all authorized DC computer accounts to the Cert Publishers group
- Restricting the 'Add workstations to domain' right in the Default Domain Policy
Correct answer: Using the 'Allow dcpromo only on pre-staged accounts' option via the Default Domain Controllers Policy
Pre-staging DC computer accounts and requiring that dcpromo use existing accounts prevents unauthorized machines from being promoted to domain controllers.
Question 7: A risk review finds that domain users can read the password hint attribute of all other users in AD. Which approach mitigates this information disclosure risk?
- Remove the Read permission on userParameters for Authenticated Users
- Use AD delegation to restrict Read access to the pwdLastSet attribute
- Configure a SACL audit entry on the ms-DS-Password-Hint attribute
- Apply a Deny Read ACE on the user password hint attribute for Authenticated Users (Correct answer)
Correct answer: Apply a Deny Read ACE on the user password hint attribute for Authenticated Users
Applying a Deny Read ACE on the ms-DS-Password-Hint attribute for Authenticated Users prevents other domain users from reading password hints.
MCTS 70-640 Risk Assessment & Management 2
Your organization's security policy requires that service accounts used by IIS application pools have minimal privileges.
Which AD account option best enforces this principle of least privilege?