Windows XP Pro Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Windows XP Pro event log setting is critical for compliance frameworks requiring log retention, and what is the default behavior when the log is full?
- Overwrite events as needed — compliance requires changing this to 'Do not overwrite events' (Correct answer)
- Logs are archived automatically to a network share
- Logs are compressed and retained indefinitely
- Full logs trigger an automatic system backup
Correct answer: Overwrite events as needed — compliance requires changing this to 'Do not overwrite events'
The default 'Overwrite events as needed' can erase audit trails; compliance requires setting logs to 'Do not overwrite' and sizing logs appropriately.
Question 2: A company subject to PCI DSS 3.2 must log all administrative access to cardholder data systems. Which Windows XP Pro audit policy must be enabled?
- Audit account logon events and Audit logon events (Correct answer)
- Audit process tracking only
- Audit directory service access
- Audit privilege use only
Correct answer: Audit account logon events and Audit logon events
Both 'Audit account logon events' (domain authentication) and 'Audit logon events' (local logon) together capture all administrative access attempts.
Question 3: Under the principle of 'Defense in Depth' recommended by NIST, which combination of Windows XP Pro features provides multiple security layers for a compliance-sensitive workstation?
- Windows Firewall + EFS + NTFS permissions + Audit policies (Correct answer)
- NTFS permissions alone
- Windows Firewall alone
- Password policy alone
Correct answer: Windows Firewall + EFS + NTFS permissions + Audit policies
Defense in Depth requires layering controls — firewall for network access, EFS for data confidentiality, NTFS for access control, and auditing for accountability.
Question 4: Which Windows XP Pro feature allows a compliance officer to ensure that departing employees cannot access company resources using cached domain credentials after their account is disabled?
- Set 'Interactive logon: Number of previous logons to cache' to 0 (Correct answer)
- Delete the user's profile folder manually
- Disable the local Guest account
- Enable password complexity requirements
Correct answer: Set 'Interactive logon: Number of previous logons to cache' to 0
Setting cached logon count to 0 prevents Windows from caching domain credentials, so disabled domain accounts cannot log on offline.
Question 5: COPPA (Children's Online Privacy Protection Act) compliance requires strict access controls to systems storing children's data. Which Windows XP Pro audit setting would detect unauthorized access attempts?
- Audit object access with failure auditing on the data folder (Correct answer)
- Audit system events with success auditing
- Audit privilege use with success auditing
- Audit account management with failure auditing
Correct answer: Audit object access with failure auditing on the data folder
Enabling failure auditing for object access on the specific data folder creates log entries whenever unauthorized access attempts occur.
Question 6: Which Windows XP Pro Group Policy setting helps meet compliance requirements that prohibit use of weak authentication by requiring smart card logon for sensitive workstations?
- Interactive logon: Require smart card (Correct answer)
- Kerberos policy: Maximum ticket lifetime
- Network security: Do not store LAN Manager hash
- Account lockout: Lockout threshold
Correct answer: Interactive logon: Require smart card
The 'Require smart card' interactive logon policy forces two-factor authentication, eliminating password-only logon for compliance-sensitive systems.
Question 7: An internal audit reveals that Windows XP Pro workstations transmit LM hashes over the network, violating security policy. Which setting remediates this?
- Network security: LAN Manager authentication level set to 'Send NTLMv2 response only\refuse LM & NTLM' (Correct answer)
- Enable Windows Firewall for all connections
- Set password minimum length to 14 characters
- Disable the Messenger service
Correct answer: Network security: LAN Manager authentication level set to 'Send NTLMv2 response only\refuse LM & NTLM'
Setting LAN Manager authentication level to refuse LM and NTLM forces NTLMv2, preventing the transmission of weak LM hashes on the network.
Windows XP Pro Regulatory Frameworks & Compliance 5
Which Windows XP Pro event log setting is critical for compliance frameworks requiring log retention, and what is the default behavior when the log is full?