Windows XP Pro Risk Assessment & Management 2 — Questions and Answers
Question 1: A Windows XP Pro workstation stores sensitive financial data. Which built-in feature best mitigates the risk of unauthorized physical access to that data?
- BitLocker Drive Encryption
- Encrypting File System (EFS) (Correct answer)
- NTFS permissions
- Windows Firewall
Correct answer: Encrypting File System (EFS)
EFS (Encrypting File System) is the built-in Windows XP Pro feature that encrypts files on NTFS volumes to protect data from unauthorized physical access.
Question 2: When assessing risk on a Windows XP Pro network, which action BEST reduces the attack surface?
- Enabling the Guest account for auditing
- Disabling unnecessary services via Services.msc (Correct answer)
- Installing all available third-party software
- Using FAT32 instead of NTFS
Correct answer: Disabling unnecessary services via Services.msc
Disabling unnecessary services reduces the number of potential entry points attackers can exploit, directly shrinking the attack surface.
Question 3: Which Windows XP Pro tool allows an administrator to assess which security settings deviate from a defined security template?
- Device Manager
- Security Configuration and Analysis (Correct answer)
- Disk Management
- System Information (msinfo32)
Correct answer: Security Configuration and Analysis
Security Configuration and Analysis compares the current system settings against a security template and highlights discrepancies.
Question 4: An organization's risk assessment identifies that a Windows XP Pro machine has no local firewall enabled. What is the PRIMARY risk this creates?
- Slower boot times
- Unauthorized inbound network connections (Correct answer)
- Inability to run Windows Update
- Loss of EFS encryption keys
Correct answer: Unauthorized inbound network connections
Without a firewall, inbound connections on any open port can reach the system, enabling attackers to exploit network-accessible services.
Question 5: Which Windows XP Pro audit policy setting should be enabled to detect brute-force password attacks?
- Audit object access
- Audit account logon events (Correct answer)
- Audit privilege use
- Audit process tracking
Correct answer: Audit account logon events
Auditing account logon events records successful and failed authentication attempts, making brute-force attacks visible in the Security log.
Question 6: A risk assessment reveals that Windows XP Pro users frequently run as local administrators. What compensating control BEST reduces this risk?
- Rename the Administrator account
- Enforce least-privilege by creating standard user accounts for daily tasks (Correct answer)
- Disable the Security Center
- Enable AutoPlay on all drives
Correct answer: Enforce least-privilege by creating standard user accounts for daily tasks
Enforcing least-privilege by restricting users to standard accounts limits the damage malware or user error can cause if an account is compromised.
Question 7: Which Windows XP Pro log should be reviewed first when investigating a potential security incident involving unauthorized file access?
- Application log
- System log
- Security log (Correct answer)
- Setup log
Correct answer: Security log
The Security log records audited events including file access, logon attempts, and privilege use, making it the primary source for security incident investigation.
Windows XP Pro Risk Assessment & Management 2
A Windows XP Pro workstation stores sensitive financial data.
Which built-in feature best mitigates the risk of unauthorized physical access to that data?