MCTS 70-640 Risk Assessment & Management 3 — Questions and Answers
Question 1: A penetration test reveals that an expired user account was used to authenticate to a file server three months after termination. Which AD control would have prevented this risk?
- Configuring a fine-grained password policy with a maximum password age
- Enabling automatic account expiration and monitoring via audit logs (Correct answer)
- Adding terminated user accounts to a Deny Logon GPO
- Moving terminated accounts to a disabled OU with restricted permissions
Correct answer: Enabling automatic account expiration and monitoring via audit logs
Setting the account expiration date at termination and monitoring audit events 4625/4768 ensures expired accounts cannot authenticate after the expiry date.
Question 2: Your organization wants to reduce the risk that a compromised read-only domain controller (RODC) exposes sensitive credentials. Which configuration should be applied?
- Add all domain users to the RODC's Password Replication Policy allowed list
- Add highly privileged accounts to the RODC's Password Replication Policy denied list (Correct answer)
- Configure the RODC to use NTLM fallback for all authentication
- Place the RODC in the same site as a writable domain controller
Correct answer: Add highly privileged accounts to the RODC's Password Replication Policy denied list
Adding privileged accounts (e.g., Domain Admins) to the RODC's Denied List ensures their credentials are never cached on the potentially exposed RODC.
Question 3: A security assessment identifies that Group Policy is being applied to sensitive domain controller OUs without change control. Which AD feature provides a detective control for unauthorized GPO changes?
- Enabling Advanced Audit Policy for DS Access — Audit Directory Service Changes (Correct answer)
- Configuring AGPM (Advanced Group Policy Management) in read-only mode
- Enabling the Default Domain Controllers Policy backup via GPO Preferences
- Using Restricted Groups to lock down SYSVOL permissions
Correct answer: Enabling Advanced Audit Policy for DS Access — Audit Directory Service Changes
Enabling 'Audit Directory Service Changes' generates event 5136 whenever a Group Policy object is modified, providing a detective control for unauthorized changes.
Question 4: Your risk register identifies Kerberos ticket-granting ticket (TGT) theft as a critical threat. Which mitigation reduces the lifespan of stolen TGTs?
- Increase the maximum Kerberos ticket lifetime to 24 hours
- Decrease the maximum Kerberos ticket lifetime in the Default Domain Policy (Correct answer)
- Disable Kerberos pre-authentication for all service accounts
- Enable NTLM auditing to detect TGT replay attempts
Correct answer: Decrease the maximum Kerberos ticket lifetime in the Default Domain Policy
Reducing the maximum Kerberos ticket lifetime shortens the window during which a stolen TGT can be replayed by an attacker.
Question 5: A risk assessment reveals that domain users can create computer accounts in the default Computers container, potentially introducing unmanaged machines. Which setting removes this risk?
- Set the 'ms-DS-MachineAccountQuota' attribute to 0 on the domain object (Correct answer)
- Move the default Computers container to a restricted OU
- Configure a GPO to deny logon locally on the Computers container
- Enable AD Recycle Bin to recover accidentally deleted computer accounts
Correct answer: Set the 'ms-DS-MachineAccountQuota' attribute to 0 on the domain object
Setting ms-DS-MachineAccountQuota to 0 prevents non-privileged users from joining computers to the domain, eliminating the risk of unmanaged machine account creation.
Question 6: During risk analysis, you determine that a trust relationship with a partner domain increases your attack surface. Which trust configuration minimizes the risk while maintaining necessary access?
- Create a two-way transitive forest trust with SID filtering disabled
- Create a one-way external trust with SID filtering enabled (Correct answer)
- Create a shortcut trust to improve Kerberos referral performance
- Configure a realm trust to allow cross-platform Kerberos authentication
Correct answer: Create a one-way external trust with SID filtering enabled
A one-way external trust with SID filtering enabled limits access to only what is needed and prevents SID history-based privilege escalation from the partner domain.
Question 7: A compliance audit requires that all privileged AD changes be traceable to an individual. Which combination of controls satisfies this requirement?
- Enable auditing of account logon events and configure event forwarding to a SIEM
- Enable Advanced Audit Policy for Audit Directory Service Changes and require individual named accounts for all admin tasks (Correct answer)
- Configure NTLM auditing and restrict anonymous access to LDAP
- Enable object-level auditing on the domain root and archive Security logs weekly
Correct answer: Enable Advanced Audit Policy for Audit Directory Service Changes and require individual named accounts for all admin tasks
Combining directory service change auditing with named individual admin accounts ensures every privileged AD modification is logged with a specific identity.
MCTS 70-640 Risk Assessment & Management 3
A penetration test reveals that an expired user account was used to authenticate to a file server three months after termination.
Which AD control would have prevented this risk?