MCTS 70-642 Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A Windows Server 2008 administrator must comply with PCI DSS Requirement 8, which mandates unique IDs for each person with computer access. Which policy enforces this?
- Rename the Administrator account and use shared service accounts
- Disable the Guest account and require individual user accounts via GPO (Correct answer)
- Enable BitLocker on all workstations
- Configure NAP with DHCP enforcement
Correct answer: Disable the Guest account and require individual user accounts via GPO
Disabling the Guest account and requiring individual user accounts ensures each person has a unique ID, directly satisfying PCI DSS Requirement 8.
Question 2: HIPAA's Minimum Necessary standard requires limiting access to the minimum data needed. Which Windows Server 2008 mechanism best implements this at the file level?
- Share-level permissions set to Everyone Read
- NTFS permissions scoped by security group and role (Correct answer)
- EFS encryption for all files on the server
- Shadow Copies enabled on the volume
Correct answer: NTFS permissions scoped by security group and role
NTFS permissions allow granular, role-based access control at the file and folder level, ensuring users can access only the minimum necessary data.
Question 3: An organization's security policy requires that all network communications between Windows Server 2008 servers use FIPS 140-2 validated cryptography. Where is this setting configured?
- In the Local Security Policy under System Cryptography (Correct answer)
- In Windows Firewall properties under IPsec settings
- In IIS Manager under SSL settings
- In Active Directory Sites and Services
Correct answer: In the Local Security Policy under System Cryptography
The 'System cryptography: Use FIPS compliant algorithms' setting in Local (or Group) Security Policy enforces FIPS 140-2 validated cryptographic modules across the server.
Question 4: A compliance officer requires that accounts inactive for 90 days be automatically disabled. Which tool in Windows Server 2008 automates this process?
- dsmod with a scheduled task or dsquery piped to dsmod (Correct answer)
- Network Policy Server health policies
- Active Directory Certificate Services revocation
- WSUS approval rules
Correct answer: dsmod with a scheduled task or dsquery piped to dsmod
Using dsquery to find inactive accounts and piping the results to dsmod to disable them, run via a scheduled task, automates the 90-day account deactivation requirement.
Question 5: Under ISO 27001 controls, password policies must enforce complexity and history. Which Windows Server 2008 feature allows different password policies for different user groups?
- Default Domain Policy password settings
- Fine-Grained Password Policies (PSO) in AD DS (Correct answer)
- Local Security Policy on each server
- RADIUS authentication via NPS
Correct answer: Fine-Grained Password Policies (PSO) in AD DS
Fine-Grained Password Policies allow administrators to apply different password complexity and history requirements to specific users or groups within the same domain.
Question 6: PCI DSS Requirement 10 mandates that audit logs be retained for at least one year. Which Windows Server 2008 feature helps meet log retention requirements?
- Increasing the maximum size of the Security event log and archiving logs (Correct answer)
- Enabling Windows Error Reporting
- Configuring System Restore points
- Using BranchCache for log replication
Correct answer: Increasing the maximum size of the Security event log and archiving logs
Configuring the Security event log maximum size and setting up archiving (overwrite as needed vs. archive) ensures logs are retained and accessible for the required one-year period.
Question 7: A FISMA audit requires that Windows Server 2008 systems have current security patches applied within 30 days of release. Which Microsoft service automates this compliance requirement?
- Microsoft Baseline Security Analyzer (MBSA)
- Windows Server Update Services (WSUS) with automatic approval rules (Correct answer)
- System Center Configuration Manager (SCCM) reports
- Windows Firewall automatic update rules
Correct answer: Windows Server Update Services (WSUS) with automatic approval rules
WSUS with automatic approval rules can deploy approved security patches automatically within defined timeframes, ensuring compliance with patch management requirements.
MCTS 70-642 Regulatory Frameworks & Compliance 3
A Windows Server 2008 administrator must comply with PCI DSS Requirement 8, which mandates unique IDs for each person with computer access.
Which policy enforces this?