MCTS 70-640 Risk Assessment & Management 4

Question 1

Your organization's risk policy requires separation of duties between AD schema modifications and day-to-day domain administration. Which built-in group assignment enforces this?

Accepted Answer

Keep Schema Admins empty and add members only when schema changes are needed

Answer

Keeping Schema Admins empty by default and adding members only during planned changes enforces separation of duties and minimizes the risk window for schema modifications.

Question 2

A risk assessment identifies that BitLocker recovery keys stored in AD can be read by all Domain Admins. Which control limits access to only the security team?

Accepted Answer

Configure a DACL on the computer object to grant Read to the security group and deny all others

Answer

Configuring a DACL on computer objects to grant Read on ms-FVE-RecoveryInformation only to a specific security group restricts who can retrieve BitLocker recovery keys from AD.

Question 3

An assessment finds that users in the organization can read the dial-in properties of user accounts, potentially revealing remote access configurations. How should this be mitigated?

Accepted Answer

Remove the Read permission on the msNPAllowDialin attribute for Authenticated Users

Answer

Removing Read permission on msNPAllowDialin for Authenticated Users prevents regular users from enumerating remote access configuration of other accounts.

Question 4

During a risk review, you discover that the SYSVOL share permissions allow domain users to write GPO templates. Which risk does this create and how should it be remediated?

Accepted Answer

Risk of malicious script injection into logon scripts; fix by removing Write permission for non-admin users on SYSVOL

Answer

Writable SYSVOL permissions for domain users allow injection of malicious scripts into logon/startup scripts; Write access should be restricted to Group Policy creators and admins.

Question 5

A risk scenario involves an insider threat where a help desk technician resets passwords for executives and uses the credentials. Which AD control provides a detective control for this behavior?

Accepted Answer

Audit account management events to log password reset actions with the initiator's identity

Answer

Auditing account management events (event 4723/4724) records who reset a password, providing a detective control to identify insider abuse of password reset privileges.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Risk Assessment & Management 4