MCSE MSCE Security Protocols & Compliance Standards 2 — Questions and Answers
Question 1: An organization must ensure data transmitted between branch offices is encrypted and authenticated. Which protocol provides both confidentiality and data integrity for site-to-site VPN tunnels?
- PPTP with MPPE
- IPsec with ESP in tunnel mode (Correct answer)
- L2TP without IPsec
- GRE tunneling
Correct answer: IPsec with ESP in tunnel mode
IPsec with ESP (Encapsulating Security Payload) in tunnel mode encrypts and authenticates the entire IP packet, making it ideal for site-to-site VPNs.
Question 2: A company's compliance team requires audit logs to be tamper-evident and retained for seven years. Which Windows Server feature best satisfies this requirement?
- Windows Event Forwarding to a shared folder
- Azure Monitor with Log Analytics workspace retention policy (Correct answer)
- Local Security Policy audit settings only
- Task Scheduler log rotation scripts
Correct answer: Azure Monitor with Log Analytics workspace retention policy
Azure Monitor with Log Analytics supports configurable retention up to seven years and provides immutable log storage that satisfies tamper-evident requirements.
Question 3: Which EAP method uses certificates on both the server and client, providing mutual authentication without needing a password?
- EAP-MD5
- PEAP-MSCHAPv2
- EAP-TLS (Correct answer)
- LEAP
Correct answer: EAP-TLS
EAP-TLS requires X.509 certificates on both the authenticating server and the client, achieving strong mutual authentication without passwords.
Question 4: Under PCI DSS, which control requires that cardholder data environments use multi-factor authentication for all non-console administrative access?
- Requirement 2
- Requirement 7
- Requirement 8 (Correct answer)
- Requirement 11
Correct answer: Requirement 8
PCI DSS Requirement 8 governs identification and authentication of access to system components, including the mandate for MFA for non-console admin access.
Question 5: A security architect needs to prevent internal hosts from initiating connections to known malicious IP addresses. Which Windows Server feature applies this control at the network layer without a third-party firewall?
- AppLocker
- Windows Defender Firewall outbound rules (Correct answer)
- BitLocker Network Unlock
- Credential Guard
Correct answer: Windows Defender Firewall outbound rules
Windows Defender Firewall outbound rules can block traffic to specific IP ranges, preventing hosts from reaching known malicious destinations.
Question 6: Which FIPS 140-2 validation level requires that cryptographic modules show evidence of tamper by using tamper-evident coatings or seals on physical hardware?
- Level 1
- Level 2 (Correct answer)
- Level 3
- Level 4
Correct answer: Level 2
FIPS 140-2 Level 2 adds requirements for tamper-evident physical security mechanisms such as coatings or seals on the cryptographic module.
Question 7: An administrator configures a Group Policy to enforce TLS 1.2 as the minimum protocol version on all Windows servers. Which registry path controls the Schannel TLS protocol settings?
- HKLM\SOFTWARE\Policies\Microsoft\Cryptography
- HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols (Correct answer)
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Correct answer: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
The Schannel provider's protocol enable/disable settings are stored under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
MCSE MSCE Security Protocols & Compliance Standards 2
An organization must ensure data transmitted between branch offices is encrypted and authenticated.
Which protocol provides both confidentiality and data integrity for site-to-site VPN tunnels?