MCTS 70-640 Risk Assessment & Management 5 — Questions and Answers
Question 1: A penetration test demonstrates that an attacker can use DCSync to extract all password hashes from the domain without logging into a DC. Which AD permission grants this capability?
- Write permission on the domain's AdminSDHolder object
- Replicating Directory Changes All permission on the domain naming context (Correct answer)
- Manage Auditing and Security Log permission on the domain root
- Full Control on the Domain Controllers OU
Correct answer: Replicating Directory Changes All permission on the domain naming context
The 'Replicating Directory Changes All' extended right allows any account to request replication of all attribute data including password hashes via DCSync.
Question 2: Your risk management framework requires periodic attestation that privileged group memberships are still authorized. Which built-in Windows Server 2008 R2 feature supports this process?
- Active Directory Administrative Center — group membership history view
- Fine-grained password policy membership reports in GPMC
- Temporary Group Membership using Dynamic Access Control time-based claims
- Audit account management events and generate periodic membership reports from Security logs (Correct answer)
Correct answer: Audit account management events and generate periodic membership reports from Security logs
Auditing account management events and exporting Security log data provides a record of membership changes that can be reviewed periodically for attestation purposes.
Question 3: A risk review finds that the AdminSDHolder object has been modified to grant a non-privileged group full control, which propagates to all protected accounts. How should this be remediated?
- Run 'ldifde' to export and re-import the AdminSDHolder ACL from a known-good state
- Remove the unauthorized ACE from AdminSDHolder and run SDProp immediately using 'repadmin /syncall' (Correct answer)
- Force the SDProp process by changing the AdminSDHolder replication interval to 1 minute
- Restore the AdminSDHolder permissions to default and trigger SDProp by restarting the NETLOGON service
Correct answer: Remove the unauthorized ACE from AdminSDHolder and run SDProp immediately using 'repadmin /syncall'
Removing the unauthorized ACE from AdminSDHolder and triggering the SDProp process (via FixUpInheritance registry key or restarting the KDC) propagates the corrected ACL to all protected accounts.
Question 4: During a risk assessment, you determine that delegated OUs allow OU admins to reset the password of Domain Admins accounts within their OU. Which mechanism prevents this privilege escalation?
- Move all Domain Admins accounts to the default Users container, which blocks OU admin delegation
- Enable AdminSDHolder protection, which overrides explicit delegation ACEs on protected accounts (Correct answer)
- Deny Write Property on pwdLastSet for the OU Admins group via a GPO
- Add Domain Admins to the Protected Users security group to block password resets
Correct answer: Enable AdminSDHolder protection, which overrides explicit delegation ACEs on protected accounts
AdminSDHolder protection automatically overwrites ACEs on privileged account objects every 60 minutes, removing delegated permissions that could allow OU admins to reset privileged passwords.
Question 5: A compliance requirement mandates that all failed authentication attempts against the domain be logged with source IP addresses. Which setting captures this information in Windows Server 2008?
- Enable 'Audit account logon events' on all member servers via Default Domain Policy
- Enable 'Audit logon events' on domain controllers and configure NPS to log authentication failures
- Enable Advanced Audit Policy 'Audit Credential Validation' on domain controllers (Correct answer)
- Configure RADIUS accounting on NPS and forward events to a syslog server
Correct answer: Enable Advanced Audit Policy 'Audit Credential Validation' on domain controllers
The Advanced Audit Policy subcategory 'Audit Credential Validation' on domain controllers logs event 4776 for NTLM and captures source workstation information for failed authentications.
Question 6: Your organization needs to assess the blast radius if the Enterprise Admins group is compromised. Which AD objects would be directly affected?
- Only the forest root domain's objects and GPOs
- All domains in the forest, including schema, configuration, and all domain partitions (Correct answer)
- Only the domain where the Enterprise Admins group resides
- All member servers in all domains but not domain controllers
Correct answer: All domains in the forest, including schema, configuration, and all domain partitions
Enterprise Admins have full control over all domains in the Active Directory forest, including the schema, configuration partition, and all domain naming contexts.
Question 7: A risk mitigation plan requires that certificate templates in Active Directory Certificate Services cannot be modified by domain users to enable certificate-based privilege escalation (ESC1). Which control prevents this?
- Remove Enroll permission from Authenticated Users on all certificate templates
- Disable the 'Supply in the request' subject name option and remove overly permissive enrollment ACLs from sensitive templates (Correct answer)
- Configure CRL Distribution Points to require OCSP checking before certificate use
- Enable the ADCS Web Enrollment role service to require multi-factor authentication
Correct answer: Disable the 'Supply in the request' subject name option and remove overly permissive enrollment ACLs from sensitive templates
Disabling 'Supply in the request' on certificate templates and restricting enrollment to authorized groups prevents the ESC1 attack where users request certificates with arbitrary SANs for privilege escalation.
MCTS 70-640 Risk Assessment & Management 5
A penetration test demonstrates that an attacker can use DCSync to extract all password hashes from the domain without logging into a DC.
Which AD permission grants this capability?