MCTS 70-640 Risk Assessment & Management 5

Question 1

A penetration test demonstrates that an attacker can use DCSync to extract all password hashes from the domain without logging into a DC. Which AD permission grants this capability?

Accepted Answer

Replicating Directory Changes All permission on the domain naming context

Answer

The 'Replicating Directory Changes All' extended right allows any account to request replication of all attribute data including password hashes via DCSync.

Question 2

Your risk management framework requires periodic attestation that privileged group memberships are still authorized. Which built-in Windows Server 2008 R2 feature supports this process?

Accepted Answer

Audit account management events and generate periodic membership reports from Security logs

Answer

Auditing account management events and exporting Security log data provides a record of membership changes that can be reviewed periodically for attestation purposes.

Question 3

A risk review finds that the AdminSDHolder object has been modified to grant a non-privileged group full control, which propagates to all protected accounts. How should this be remediated?

Accepted Answer

Remove the unauthorized ACE from AdminSDHolder and run SDProp immediately using 'repadmin /syncall'

Answer

Removing the unauthorized ACE from AdminSDHolder and triggering the SDProp process (via FixUpInheritance registry key or restarting the KDC) propagates the corrected ACL to all protected accounts.

Question 4

During a risk assessment, you determine that delegated OUs allow OU admins to reset the password of Domain Admins accounts within their OU. Which mechanism prevents this privilege escalation?

Accepted Answer

Enable AdminSDHolder protection, which overrides explicit delegation ACEs on protected accounts

Answer

AdminSDHolder protection automatically overwrites ACEs on privileged account objects every 60 minutes, removing delegated permissions that could allow OU admins to reset privileged passwords.

Question 5

A compliance requirement mandates that all failed authentication attempts against the domain be logged with source IP addresses. Which setting captures this information in Windows Server 2008?

Accepted Answer

Enable Advanced Audit Policy 'Audit Credential Validation' on domain controllers

Answer

The Advanced Audit Policy subcategory 'Audit Credential Validation' on domain controllers logs event 4776 for NTLM and captures source workstation information for failed authentications.

MCTS 70-640 Exam Practice Test

MCTS 70-640 Exam Practice Test

MCTS 70-640 Risk Assessment & Management 5