MCSE MSCE Security Protocols & Compliance Standards 4 — Questions and Answers
Question 1: A company must comply with SOC 2 Type II. What distinguishes a Type II report from a Type I report?
- Type II covers more trust service criteria than Type I
- Type II evaluates design and operating effectiveness over a period, Type I only evaluates design at a point in time (Correct answer)
- Type II is performed by internal auditors while Type I requires external auditors
- Type II applies only to cloud providers while Type I applies to on-premises systems
Correct answer: Type II evaluates design and operating effectiveness over a period, Type I only evaluates design at a point in time
SOC 2 Type II assesses whether controls were suitably designed AND operated effectively over an observation period (typically 6–12 months), whereas Type I only evaluates design at a single point in time.
Question 2: Which Windows feature encrypts the LSA secrets and cached credentials in memory to protect against tools like Mimikatz that perform pass-the-hash attacks?
- Windows Defender Credential Guard (Correct answer)
- Secure Boot
- Device Guard
- AppLocker
Correct answer: Windows Defender Credential Guard
Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a protected container, preventing credential theft tools from accessing them.
Question 3: Under GDPR, what is the maximum time frame an organization has to notify the supervisory authority after discovering a personal data breach that is likely to result in a risk to individuals?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires controllers to notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it.
Question 4: An MCSE candidate must configure certificate auto-enrollment for domain computers. Which combination of settings is required?
- Enterprise CA + certificate template with autoenroll permission + GPO enabling autoenrollment (Correct answer)
- Standalone CA + default web enrollment + manual import script
- Third-party CA + OCSP responder + manual GPO script
- Enterprise CA + manual MMC snap-in enrollment for each machine
Correct answer: Enterprise CA + certificate template with autoenroll permission + GPO enabling autoenrollment
Auto-enrollment requires an Enterprise CA, a certificate template that grants the Autoenroll permission to the target security group, and a Group Policy setting that enables certificate autoenrollment.
Question 5: Which protocol does Windows Remote Management (WinRM) use by default for secure communication when connecting to a remote host over HTTPS?
- SOAP over TLS on port 5986 (Correct answer)
- RPC over SMB on port 445
- SSH on port 22
- LDAP over TLS on port 636
Correct answer: SOAP over TLS on port 5986
WinRM uses SOAP (WS-Management protocol) over TLS on port 5986 when HTTPS transport is configured for secure remote management.
Question 6: A financial institution's Windows servers must enforce the principle of least privilege for service accounts. Which Active Directory feature allows service accounts to automatically manage their own passwords without storing them in plaintext?
- Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs) (Correct answer)
- Default service account with Password Never Expires flag
- Credential Manager with stored Windows credentials
- Virtual accounts created per-service
Correct answer: Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs)
Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) allow Windows to automatically manage complex passwords for service accounts, eliminating plaintext password storage.
Question 7: Which attack does DNSSEC primarily protect against by providing cryptographic origin authentication of DNS data?
- DNS amplification DDoS attacks
- DNS cache poisoning attacks (Correct answer)
- DNS tunneling exfiltration
- DNS sinkholing
Correct answer: DNS cache poisoning attacks
DNSSEC protects against DNS cache poisoning (Kaminsky-style attacks) by allowing resolvers to cryptographically verify that DNS responses come from the authoritative source and have not been tampered with.
MCSE MSCE Security Protocols & Compliance Standards 4
A company must comply with SOC 2 Type II.
What distinguishes a Type II report from a Type I report?