MCTS 70-642 Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A Windows Server 2008 network must comply with SOX by ensuring that no single administrator can both make and approve changes to financial systems. This is an example of which control principle?
- Least Privilege
- Defense in Depth
- Separation of Duties (Correct answer)
- Need to Know
Correct answer: Separation of Duties
Separation of Duties ensures that critical tasks require multiple individuals, preventing any single person from making unauthorized changes to financial systems without oversight.
Question 2: An administrator must demonstrate compliance with CIS Benchmarks for Windows Server 2008. Which built-in tool analyzes the server's security configuration against a defined baseline?
- Event Viewer
- Microsoft Baseline Security Analyzer (MBSA) (Correct answer)
- Server Manager
- Windows Update
Correct answer: Microsoft Baseline Security Analyzer (MBSA)
MBSA scans Windows servers for missing security updates and common security misconfigurations, making it the primary built-in tool for baseline security compliance analysis.
Question 3: Under HIPAA Security Rule, covered entities must implement automatic logoff for workstations. Which Group Policy setting enforces this on Windows Server 2008 member servers?
- Account Lockout Policy threshold
- Interactive logon: Machine inactivity limit (Correct answer)
- Network security: Force logoff when logon hours expire
- Shut down system immediately if unable to log security audits
Correct answer: Interactive logon: Machine inactivity limit
The 'Machine inactivity limit' Group Policy setting automatically locks or logs off a workstation after a defined period of inactivity, satisfying the HIPAA automatic logoff requirement.
Question 4: PCI DSS requires that all system clocks be synchronized to ensure accurate audit log timestamps. Which protocol and Windows Server 2008 service fulfill this requirement?
- SNMP with Windows Management Instrumentation
- NTP synchronized via Windows Time Service (W32tm) (Correct answer)
- DNS with DNSSEC timestamps
- Kerberos with ticket timestamp validation
Correct answer: NTP synchronized via Windows Time Service (W32tm)
The Windows Time Service (W32tm) uses NTP to synchronize clocks across the domain, ensuring that audit log timestamps are accurate and consistent as required by PCI DSS.
Question 5: A NIST 800-53 control requires that the operating system protect audit records from unauthorized deletion. Which Windows Server 2008 setting directly enforces this?
- Set 'Audit: Shut down system immediately if unable to log security audits' to Enabled
- Restrict event log access permissions so only Administrators can clear logs (Correct answer)
- Enable EFS on the Windows\System32\winevt folder
- Configure BitLocker on the system volume
Correct answer: Restrict event log access permissions so only Administrators can clear logs
Restricting the Security event log permissions so only administrators can clear it prevents unauthorized deletion or tampering with audit records.
Question 6: An organization's compliance policy based on NIST SP 800-53 requires identification and authentication for all users accessing network resources. Which Windows Server 2008 role enforces this for wireless clients?
- Active Directory Domain Services with 802.1X via NPS (Correct answer)
- DHCP Server with MAC address filtering
- DNS Server with split-brain DNS
- Windows Internet Name Service (WINS)
Correct answer: Active Directory Domain Services with 802.1X via NPS
Using NPS to enforce 802.1X authentication against Active Directory ensures that all wireless clients are identified and authenticated before gaining network access.
Question 7: An auditor assessing PCI DSS compliance asks whether network traffic between a Windows Server 2008 web server and database server is encrypted. Which technology should the administrator implement?
- SSL certificates on the web server only
- IPsec transport mode between the two servers (Correct answer)
- VLAN segmentation between web and database tiers
- Windows Firewall rules restricting TCP port 1433
Correct answer: IPsec transport mode between the two servers
IPsec transport mode encrypts the data payload between the web server and database server, satisfying PCI DSS requirements for encrypting cardholder data in transit on internal networks.
MCTS 70-642 Regulatory Frameworks & Compliance 4
A Windows Server 2008 network must comply with SOX by ensuring that no single administrator can both make and approve changes to financial systems.
This is an example of which control principle?