Practice Test GeeksMCTS 70-640 Exam Practice Test
← All MCTS 70-640 Flashcard Decks

Regulatory Frameworks & Compliance Flashcards

7 cards from real MCTS 70-640 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Frameworks & Compliance flashcards as text

  1. A regulatory requirement mandates that all removable storage be blocked on workstations in the finance OU. Which Group Policy area contains device installation restriction settings?

    Answer: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

    Device Installation Restrictions under System > Device Installation in Administrative Templates allows you to prevent installation of removable storage devices.

  2. Under GLBA compliance, your organization must encrypt all data on mobile devices. Which Windows Server 2008 feature, managed through AD, enforces BitLocker encryption on domain-joined laptops?

    Answer: BitLocker Drive Encryption GPO settings

    Group Policy BitLocker Drive Encryption settings can require BitLocker on fixed and removable drives, enforcing encryption compliance on domain-joined machines.

  3. Which AD DS feature allows you to prove to auditors that no unauthorized changes were made to the AD schema by comparing against a known-good state?

    Answer: AD Snapshot (ntdsutil snapshot)

    AD snapshots created with ntdsutil allow you to mount and compare a point-in-time copy of the AD database against the current state without impacting production.

  4. A compliance framework requires that smart card logon be mandatory for all privileged administrators. Which setting enforces this at the account level in AD?

    Answer: Both A and B are required together

    The account-level flag forces the user's password to change to a random value, while the GPO Security Option prevents non-smart-card logons at the machine level — both are needed for full enforcement.

  5. Your compliance officer requires a quarterly report of all AD group membership changes for privileged groups. Which event ID in the Security log records when a member is added to a security-enabled global group?

    Answer: Event ID 4728

    Event ID 4728 is logged when a member is added to a security-enabled global group, which covers most privileged AD groups like Domain Admins.

  6. To meet compliance requirements, you must ensure that when a user's AD account is disabled, their Kerberos tickets are immediately invalidated. What is the maximum Kerberos ticket lifetime you should configure?

    Answer: Tickets cannot be revoked before expiry; minimize lifetime to reduce window

    Kerberos tickets cannot be revoked mid-lifetime; minimizing the ticket lifetime (e.g., 1-2 hours) reduces the window during which a disabled account's tickets remain valid.

  7. A PCI-DSS audit requires that all DNS zone transfers be restricted to authorized secondary DNS servers only. In Windows DNS, which setting controls this?

    Answer: Zone transfer settings: Only to servers listed on the Name Servers tab

    In DNS zone properties, configuring 'Allow zone transfers' to 'Only to servers listed on the Name Servers tab' restricts zone transfers to authorized secondaries only.