MCTS 70-640 Risk Assessment & Management 3

Question 1

A penetration test reveals that an expired user account was used to authenticate to a file server three months after termination. Which AD control would have prevented this risk?

Accepted Answer

Enabling automatic account expiration and monitoring via audit logs

Answer

Setting the account expiration date at termination and monitoring audit events 4625/4768 ensures expired accounts cannot authenticate after the expiry date.

Question 2

Your organization wants to reduce the risk that a compromised read-only domain controller (RODC) exposes sensitive credentials. Which configuration should be applied?

Accepted Answer

Add highly privileged accounts to the RODC's Password Replication Policy denied list

Answer

Adding privileged accounts (e.g., Domain Admins) to the RODC's Denied List ensures their credentials are never cached on the potentially exposed RODC.

Question 3

A security assessment identifies that Group Policy is being applied to sensitive domain controller OUs without change control. Which AD feature provides a detective control for unauthorized GPO changes?

Accepted Answer

Enabling Advanced Audit Policy for DS Access — Audit Directory Service Changes

Answer

Enabling 'Audit Directory Service Changes' generates event 5136 whenever a Group Policy object is modified, providing a detective control for unauthorized changes.

Question 4

Your risk register identifies Kerberos ticket-granting ticket (TGT) theft as a critical threat. Which mitigation reduces the lifespan of stolen TGTs?

Accepted Answer

Decrease the maximum Kerberos ticket lifetime in the Default Domain Policy

Answer

Reducing the maximum Kerberos ticket lifetime shortens the window during which a stolen TGT can be replayed by an attacker.

Question 5

A risk assessment reveals that domain users can create computer accounts in the default Computers container, potentially introducing unmanaged machines. Which setting removes this risk?

Accepted Answer

Set the 'ms-DS-MachineAccountQuota' attribute to 0 on the domain object

Answer

Setting ms-DS-MachineAccountQuota to 0 prevents non-privileged users from joining computers to the domain, eliminating the risk of unmanaged machine account creation.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Risk Assessment & Management 3