MCTS 70-642 Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A Windows Server 2008 administrator needs to comply with DISA STIGs by disabling unnecessary services. Which tool helps identify which services are running and should be reviewed?
- Group Policy Modeling Wizard
- Security Configuration Wizard (SCW) (Correct answer)
- Remote Desktop Services Manager
- Network Monitor
Correct answer: Security Configuration Wizard (SCW)
The Security Configuration Wizard analyzes the server's role and recommends disabling unnecessary services, ports, and features, aligning with DISA STIG hardening requirements.
Question 2: GLBA requires financial institutions to have an incident response plan. Which Windows Server 2008 feature provides real-time alerts on suspicious events to support incident detection?
- Event Log subscriptions forwarding events to a central collector (Correct answer)
- DHCP audit logging
- Windows Server Backup event notifications
- Offline Files synchronization logs
Correct answer: Event Log subscriptions forwarding events to a central collector
Windows Event Log subscriptions allow central collection of security events from multiple servers, enabling real-time detection and alerting for suspicious activity as part of an incident response capability.
Question 3: Under HIPAA, a Business Associate Agreement (BAA) governs third-party access to PHI. In Windows Server 2008, which feature helps technically enforce limited third-party access to specific resources?
- Read-Only Domain Controllers (RODC) for branch offices
- Active Directory Federation Services (AD FS) for federated identity with restricted claims (Correct answer)
- Windows Deployment Services for controlled provisioning
- BitLocker To Go for removable media
Correct answer: Active Directory Federation Services (AD FS) for federated identity with restricted claims
AD FS allows federated identity with claims-based access control, enabling technically enforced, scoped access for third parties consistent with BAA terms without granting full domain access.
Question 4: A compliance framework requires that all administrative actions on Windows Server 2008 domain controllers be attributed to individual accounts, not shared credentials. Which best practice supports this?
- Create a single shared 'Admin' account with a strong password
- Use individual admin accounts and enable Audit Account Logon Events and Audit Privilege Use (Correct answer)
- Disable all built-in accounts and use smart card logon only
- Configure all DCs as RODCs
Correct answer: Use individual admin accounts and enable Audit Account Logon Events and Audit Privilege Use
Individual admin accounts combined with Audit Account Logon and Audit Privilege Use policies ensure all actions are attributed to specific individuals for accountability and non-repudiation.
Question 5: PCI DSS Requirement 6 mandates that all system components are protected from known vulnerabilities. Which Windows Server 2008 feature provides a current list of missing patches across the environment?
- WSUS reports showing update compliance status (Correct answer)
- Event Viewer Application log errors
- Netsh command-line output
- Performance Monitor counters
Correct answer: WSUS reports showing update compliance status
WSUS generates compliance reports showing which computers have missing updates, directly supporting PCI DSS Requirement 6 to identify and remediate known vulnerabilities.
Question 6: An organization must comply with NIST SP 800-53 AC-17 (Remote Access) by controlling and monitoring all remote access sessions. Which Windows Server 2008 role service fulfills this?
- Remote Desktop Gateway (RD Gateway) with connection authorization policies (Correct answer)
- Telnet Server role
- IIS FTP service with SSL
- Windows Server Backup remote management
Correct answer: Remote Desktop Gateway (RD Gateway) with connection authorization policies
RD Gateway enforces connection authorization policies (CAP) that control who can connect remotely and logs all remote sessions, satisfying NIST AC-17 remote access control requirements.
Question 7: A Windows Server 2008 deployment must meet FIPS 140-2 compliance for cryptographic modules. Which cipher suite is NOT compliant with FIPS 140-2 and must be disabled?
- AES-128-CBC
- 3DES-EDE-CBC
- RC4 (Correct answer)
- AES-256-CBC
Correct answer: RC4
RC4 is not a FIPS 140-2 approved cipher suite and must be disabled; AES and 3DES (with proper key lengths) are FIPS-approved algorithms.
MCTS 70-642 Regulatory Frameworks & Compliance 5
A Windows Server 2008 administrator needs to comply with DISA STIGs by disabling unnecessary services.
Which tool helps identify which services are running and should be reviewed?