MCTS 70-640 Risk Assessment & Management 4 — Questions and Answers
Question 1: Your organization's risk policy requires separation of duties between AD schema modifications and day-to-day domain administration. Which built-in group assignment enforces this?
- Assign day-to-day admins to the Schema Admins group with time-limited membership
- Keep Schema Admins empty and add members only when schema changes are needed (Correct answer)
- Assign Schema Admins to a sub-OU with a restricted GPO
- Use AGPM to require two approvals for schema modification requests
Correct answer: Keep Schema Admins empty and add members only when schema changes are needed
Keeping Schema Admins empty by default and adding members only during planned changes enforces separation of duties and minimizes the risk window for schema modifications.
Question 2: A risk assessment identifies that BitLocker recovery keys stored in AD can be read by all Domain Admins. Which control limits access to only the security team?
- Encrypt BitLocker recovery keys using a domain CA before storing them in AD
- Delegate Read access on the ms-FVE-RecoveryInformation object only to the security team OU
- Store BitLocker recovery keys in a separate forest controlled by the security team
- Configure a DACL on the computer object to grant Read to the security group and deny all others (Correct answer)
Correct answer: Configure a DACL on the computer object to grant Read to the security group and deny all others
Configuring a DACL on computer objects to grant Read on ms-FVE-RecoveryInformation only to a specific security group restricts who can retrieve BitLocker recovery keys from AD.
Question 3: An assessment finds that users in the organization can read the dial-in properties of user accounts, potentially revealing remote access configurations. How should this be mitigated?
- Remove the Read permission on the msNPAllowDialin attribute for Authenticated Users (Correct answer)
- Configure NPS policies to override dial-in settings stored in AD
- Move all remote access users to a separate OU with inherited permission blocking
- Enable auditing on the Remote Access Policies container in AD
Correct answer: Remove the Read permission on the msNPAllowDialin attribute for Authenticated Users
Removing Read permission on msNPAllowDialin for Authenticated Users prevents regular users from enumerating remote access configuration of other accounts.
Question 4: During a risk review, you discover that the SYSVOL share permissions allow domain users to write GPO templates. Which risk does this create and how should it be remediated?
- Risk of GPO version mismatch; fix by enabling DFS-R for SYSVOL replication
- Risk of malicious script injection into logon scripts; fix by removing Write permission for non-admin users on SYSVOL (Correct answer)
- Risk of GPO corruption; fix by enabling Group Policy Modeling in GPMC
- Risk of SYSVOL replication failure; fix by increasing SYSVOL replication interval
Correct answer: Risk of malicious script injection into logon scripts; fix by removing Write permission for non-admin users on SYSVOL
Writable SYSVOL permissions for domain users allow injection of malicious scripts into logon/startup scripts; Write access should be restricted to Group Policy creators and admins.
Question 5: A risk scenario involves an insider threat where a help desk technician resets passwords for executives and uses the credentials. Which AD control provides a detective control for this behavior?
- Audit account management events to log password reset actions with the initiator's identity (Correct answer)
- Configure fine-grained password policies to require executives to change passwords immediately
- Use Protected Users group to prevent help desk from resetting executive passwords
- Enable Kerberos armoring (FAST) for executive accounts
Correct answer: Audit account management events to log password reset actions with the initiator's identity
Auditing account management events (event 4723/4724) records who reset a password, providing a detective control to identify insider abuse of password reset privileges.
Question 6: Your disaster recovery risk assessment requires that the AD database can be restored if all domain controllers fail simultaneously. Which backup strategy satisfies this requirement?
- Back up SYSVOL only, since it contains all Group Policy data
- Perform regular authoritative restores of the domain partition on a spare server
- Perform System State backups of at least one domain controller regularly and store offline (Correct answer)
- Use AD Recycle Bin to recover deleted objects without a backup
Correct answer: Perform System State backups of at least one domain controller regularly and store offline
Regular System State backups (which include the AD database, SYSVOL, registry, and boot files) stored offline allow full AD recovery if all domain controllers are lost.
Question 7: A risk assessment finds that LDAP traffic between applications and domain controllers is unsigned, allowing man-in-the-middle injection of forged LDAP responses. Which Group Policy setting mitigates this?
- Set 'Domain controller: LDAP server signing requirements' to 'Require signing' (Correct answer)
- Enable LDAP over SSL (LDAPS) by installing a web server certificate on all DCs
- Configure 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to Deny All
- Set 'Network access: Do not allow anonymous enumeration of SAM accounts' to Enabled
Correct answer: Set 'Domain controller: LDAP server signing requirements' to 'Require signing'
Setting 'Domain controller: LDAP server signing requirements' to 'Require signing' forces clients to sign all LDAP traffic, preventing man-in-the-middle tampering.
MCTS 70-640 Risk Assessment & Management 4
Your organization's risk policy requires separation of duties between AD schema modifications and day-to-day domain administration.
Which built-in group assignment enforces this?