MCTS 70-640 Risk Assessment & Management 2

Question 1

Your organization's security policy requires that service accounts used by IIS application pools have minimal privileges. Which AD account option best enforces this principle of least privilege?

Accepted Answer

Use a Managed Service Account (MSA) scoped to a single server

Answer

Managed Service Accounts (MSAs) are scoped to a single computer, have automatic password management, and provide least-privilege access for services.

Question 2

A security audit reveals that users in a branch office can modify the membership of the Domain Admins group. Which ACL permission on the group object must be revoked to mitigate this risk?

Accepted Answer

Write Members permission on the group object

Answer

The Write Members permission on the group object allows principals to add or remove members, and must be removed to prevent unauthorized elevation of privilege.

Question 3

An attacker performs a pass-the-hash attack using stolen NTLM hashes from a workstation. Which Windows Server 2008 feature most directly reduces the risk of credential theft from memory?

Accepted Answer

Requiring Kerberos with Protected Users security group

Answer

The Protected Users security group prevents members from using NTLM authentication and caches credentials, mitigating pass-the-hash attacks.

Question 4

During a risk assessment, you find that AD replication traffic between sites is unencrypted. Which setting mitigates the risk of replication data interception?

Accepted Answer

Configure IPsec policies to encrypt LDAP replication traffic

Answer

IPsec policies can encrypt AD replication traffic between domain controllers, protecting against network interception of directory data.

Question 5

A risk assessment identifies that users can enumerate all objects in Active Directory via anonymous LDAP queries. Which setting eliminates this risk?

Accepted Answer

Set the 'dsHeuristics' attribute to disable anonymous LDAP operations

Answer

Setting the dsHeuristics attribute (specifically bit 7) disables anonymous LDAP searches, preventing unauthenticated enumeration of directory objects.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Risk Assessment & Management 2