Question 1A research lab has signed Windows Server applications, but its WDAC policy was switched to enforced mode without checking a needed monitoring agent. What should the administrator change first to resolve the stated issue? Apply the documented supported OSConfig baseline and compare its reported settings with the organization's approved exception register. Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. Resolve GPO precedence and security filtering for the server OU, then apply the intended hardened settings with a scoped policy link. Move intended OS hardening settings into an authoritative scoped Group Policy and remove unsupported local exceptions after reviewing resultant policy. ExplanationCorrect Answer B:Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. This resolves the observed failure because windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. A suitable acceptance check is: Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. Other Answers A:OSConfig can manage Windows Server security baseline settings, but drift visibility requires the baseline to be applied and monitored. The required change instead is to run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. C:Group Policy processing and link precedence determine resultant machine settings; the existence of a baseline GPO alone does not ensure application. A more relevant action is to run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. D:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. A more relevant action is to run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy.
Question 2A research lab has signed Windows Server applications, but its WDAC policy was switched to enforced mode without checking a needed monitoring agent. Which cause-and-effect mechanism best fits this evidence? Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. OSConfig can manage Windows Server security baseline settings, but drift visibility requires the baseline to be applied and monitored. Group Policy processing and link precedence determine resultant machine settings; the existence of a baseline GPO alone does not ensure application. Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. ExplanationCorrect Answer A:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The mechanism explains the corrective action: Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. The associated validation is: Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. Other Answers B:OSConfig can manage Windows Server security baseline settings, but drift visibility requires the baseline to be applied and monitored. By contrast, windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. C:Group Policy processing and link precedence determine resultant machine settings; the existence of a baseline GPO alone does not ensure application. By contrast, windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. D:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. By contrast, windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries.
Question 3A research lab has signed Windows Server applications, but its WDAC policy was switched to enforced mode without checking a needed monitoring agent. What should the engineer check to distinguish success from a superficial fix? Run gpresult and inspect resultant audit policy on a target server after policy refresh and reboot where necessary. Compare gpresult on two similarly classified servers and confirm the final security settings match the approved baseline. Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. Review the OSConfig compliance report and verify that an intentionally changed test setting is flagged as drift. ExplanationCorrect Answer C:Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. This evidence tests whether the team actually completed: Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. It addresses the risk because windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. Other Answers A:Group Policy processing and link precedence determine resultant machine settings; the existence of a baseline GPO alone does not ensure application. The relevant acceptance check is to check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. B:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. The relevant acceptance check is to check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. D:OSConfig can manage Windows Server security baseline settings, but drift visibility requires the baseline to be applied and monitored. A more meaningful verification is to check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy.
Question 4A research lab has signed Windows Server applications, but its WDAC policy was switched to enforced mode without checking a needed monitoring agent. What should be added to the permanent maintenance checklist? Version Windows Server baselines and validate supported OSConfig behavior during feature updates and gold-image revisions. Use configuration drift detection and access restrictions to prevent ad hoc local changes from overriding managed server policies. Review OU inheritance, WMI filtering, and GPO link order whenever server organizational units are restructured. Use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. ExplanationCorrect Answer D:Use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. This preventive control maintains the intended protection because windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The initial action remains: Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. Other Answers A:OSConfig can manage Windows Server security baseline settings, but drift visibility requires the baseline to be applied and monitored. The stronger recurring control is to use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. B:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. Reducing this risk requires a practice to use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. C:Group Policy processing and link precedence determine resultant machine settings; the existence of a baseline GPO alone does not ensure application. Reducing this risk requires a practice to use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route.
Question 5An acquired branch server keeps a shared local administrator password across all machines, and the credential was exposed in a support ticket. What is the most appropriate action given the observed constraints? Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. Move intended OS hardening settings into an authoritative scoped Group Policy and remove unsupported local exceptions after reviewing resultant policy. ExplanationCorrect Answer B:Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. This resolves the observed failure because windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. A suitable acceptance check is: Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. Other Answers A:SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. This failure calls for a decision to configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. C:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. This failure calls for a decision to configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. D:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. A more relevant action is to configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location.
Question 6An acquired branch server keeps a shared local administrator password across all machines, and the credential was exposed in a support ticket. What principle explains why the correct response works? Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. ExplanationCorrect Answer D:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. The mechanism explains the corrective action: Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. The associated validation is: Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. Other Answers A:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. By contrast, windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. B:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. In the stated system, windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. C:SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. In the stated system, windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password.
Question 7An acquired branch server keeps a shared local administrator password across all machines, and the credential was exposed in a support ticket. What observable evidence would verify that the fix succeeded? Compare gpresult on two similarly classified servers and confirm the final security settings match the approved baseline. Repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. ExplanationCorrect Answer D:Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. This evidence tests whether the team actually completed: Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. It addresses the risk because windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Other Answers A:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. The failure is checked more directly by a test to retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. B:SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. A more meaningful verification is to retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. C:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. A more meaningful verification is to retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts.
Question 8An acquired branch server keeps a shared local administrator password across all machines, and the credential was exposed in a support ticket. What control should be sustained after the immediate fix? Restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. Include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. Publish an approved software catalog and require source validation before installing utilities on privileged Windows servers. Use configuration drift detection and access restrictions to prevent ad hoc local changes from overriding managed server policies. ExplanationCorrect Answer A:Restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. This preventive control maintains the intended protection because windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. The initial action remains: Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. Other Answers B:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The stronger recurring control is to restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. C:SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. The stronger recurring control is to restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. D:Centralized Group Policy only produces predictable enforcement when precedence, scope, and local change privileges are understood. A more direct preventive measure is to restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes.
Question 9A payroll server has virtualization-based security available, but credential theft tests still reveal reusable secrets in the LSASS process. Which next corrective action best addresses this failure? Create a narrow documented application mitigation exception after identifying the failed protection instead of weakening Exploit Protection system-wide. Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. Enable the general secured-core platform settings without checking whether Credential Guard isolates LSASS credential material. Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. ExplanationCorrect Answer B:Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. This resolves the observed failure because credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. A suitable acceptance check is: Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Other Answers A:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. A more relevant action is to enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. C:Enable the general secured-core platform settings without checking whether Credential Guard isolates LSASS credential material. Platform secured-core settings strengthen trust, but the case specifically reports reusable LSASS secrets. Without validating Credential Guard isolation, enabling general platform safeguards alone cannot demonstrate that credential theft exposure has been removed. D:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. This failure calls for a decision to enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections.
Question 10A payroll server has virtualization-based security available, but credential theft tests still reveal reusable secrets in the LSASS process. Why does the proposed solution address the underlying problem? Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. ExplanationCorrect Answer D:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The mechanism explains the corrective action: Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. The associated validation is: Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Other Answers A:Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. By contrast, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. B:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. By contrast, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. C:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. In the stated system, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping.
