Question 10A payroll server has virtualization-based security available, but credential theft tests still reveal reusable secrets in the LSASS process. Why does the proposed solution address the underlying problem? Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. ExplanationCorrect Answer D:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The mechanism explains the corrective action: Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. The associated validation is: Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Other Answers A:Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. By contrast, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. B:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. By contrast, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. C:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. In the stated system, credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping.
Question 11A payroll server has virtualization-based security available, but credential theft tests still reveal reusable secrets in the LSASS process. Which validation result directly demonstrates recovery? Reproduce the application's startup and verify unrelated test processes still retain the organization's required exploit mitigations. Check TPM, Secure Boot, and VBS health reporting and prove critical VMs recover after the maintenance change. Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. ExplanationCorrect Answer C:Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. This evidence tests whether the team actually completed: Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. It addresses the risk because credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. Other Answers A:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The relevant acceptance check is to confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. B:Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. The failure is checked more directly by a test to confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. D:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Proving this correction calls for a check to confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server.
Question 12A payroll server has virtualization-based security available, but credential theft tests still reveal reusable secrets in the LSASS process. Which operational practice most directly limits recurrence? Require platform firmware attestation and hardware security capability checks during server acquisition and servicing. Include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. Require an expiration date and vendor remediation plan for each security mitigation compatibility exception. Restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. ExplanationCorrect Answer B:Include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. This preventive control maintains the intended protection because credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The initial action remains: Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. Other Answers A:Secured-core protections use hardware-backed trust and virtualization-based isolation to strengthen the platform boot and runtime boundary. The stronger recurring control is to include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. C:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The lasting safeguard is to include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. D:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Reducing this risk requires a practice to include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline.
Question 13A legacy document conversion service crashes under suspicious memory corruption inputs, and the server has no tailored Exploit Protection rules. Which change meets the stated Windows Server requirement? Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. Apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. Enable and validate Windows Defender Credential Guard on supported hardware with the required virtualization-based security protections. Create a narrow documented application mitigation exception after identifying the failed protection instead of weakening Exploit Protection system-wide. ExplanationCorrect Answer B:Apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. This resolves the observed failure because exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. A suitable acceptance check is: Trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. Other Answers A:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The required change instead is to apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. C:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. This failure calls for a decision to apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. D:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. A more relevant action is to apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment.
Question 14A legacy document conversion service crashes under suspicious memory corruption inputs, and the server has no tailored Exploit Protection rules. Which Windows Server behavior explains the situation? Exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. ExplanationCorrect Answer A:Exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. The mechanism explains the corrective action: Apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. The associated validation is: Trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. Other Answers B:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. By contrast, exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. C:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. In the stated system, exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. D:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. By contrast, exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application.
Question 15A legacy document conversion service crashes under suspicious memory corruption inputs, and the server has no tailored Exploit Protection rules. Which observation proves the stated requirement is satisfied? Confirm configured VBS and Credential Guard state, then rerun a controlled credential extraction test against the server. Reproduce the application's startup and verify unrelated test processes still retain the organization's required exploit mitigations. Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. Trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. ExplanationCorrect Answer D:Trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. This evidence tests whether the team actually completed: Apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. It addresses the risk because exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. Other Answers A:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. A more meaningful verification is to trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. B:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The failure is checked more directly by a test to trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files. C:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The relevant acceptance check is to trigger a harmless regression harness and review mitigation events while confirming the converter still processes approved files.
Question 16A legacy document conversion service crashes under suspicious memory corruption inputs, and the server has no tailored Exploit Protection rules. Which ongoing safeguard would best prevent this failure recurring? Include supported firmware, VBS prerequisites, and Credential Guard status in the Windows Server security baseline. Use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. Require an expiration date and vendor remediation plan for each security mitigation compatibility exception. Keep application-specific exploit mitigation settings under change control and regression test them after software updates. ExplanationCorrect Answer D:Keep application-specific exploit mitigation settings under change control and regression test them after software updates. This preventive control maintains the intended protection because exploit Protection provides process-level exploit mitigations such as memory and control-flow defenses, but compatibility must be validated per application. The initial action remains: Apply appropriate Exploit Protection mitigations to the affected executable after testing its functionality in a representative staging environment. Other Answers A:Credential Guard isolates supported credential material using virtualization-based boundaries instead of leaving all secrets accessible to LSASS memory scraping. The lasting safeguard is to keep application-specific exploit mitigation settings under change control and regression test them after software updates. B:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The stronger recurring control is to keep application-specific exploit mitigation settings under change control and regression test them after software updates. C:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. Reducing this risk requires a practice to keep application-specific exploit mitigation settings under change control and regression test them after software updates.
Question 17A file server administrator downloads a utility from an unknown site despite the executable carrying an internet-zone mark and poor reputation. Which remediation specifically resolves the problem rather than a related symptom? Create a narrow documented application mitigation exception after identifying the failed protection instead of weakening Exploit Protection system-wide. Run the WDAC policy in audit mode, review code integrity events, and add narrowly approved signer rules before enforcing the policy. Configure Windows LAPS to rotate and back up each device's local administrator password to an authorized directory location. Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. ExplanationCorrect Answer D:Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. This resolves the observed failure because smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. A suitable acceptance check is: Repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. Other Answers A:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. This failure calls for a decision to require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. B:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The corrective action for this requirement is to require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. C:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. A more relevant action is to require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor.
Question 18A file server administrator downloads a utility from an unknown site despite the executable carrying an internet-zone mark and poor reputation. Which technical explanation makes the recommended approach appropriate? SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. ExplanationCorrect Answer A:SmartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. The mechanism explains the corrective action: Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. The associated validation is: Repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. Other Answers B:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. By contrast, smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. C:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. In the stated system, smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. D:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. By contrast, smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege.
Question 19A file server administrator downloads a utility from an unknown site despite the executable carrying an internet-zone mark and poor reputation. Which test should pass before accepting this change? Reproduce the application's startup and verify unrelated test processes still retain the organization's required exploit mitigations. Check Code Integrity event records and launch the approved monitoring agent under the revised audit-tested policy. Retrieve a test password using an authorized role and confirm rotation, expiration, and denied access to ordinary accounts. Repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. ExplanationCorrect Answer D:Repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. This evidence tests whether the team actually completed: Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. It addresses the risk because smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. Other Answers A:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The failure is checked more directly by a test to repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. B:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The relevant acceptance check is to repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally. C:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. A more meaningful verification is to repeat the download test with a known suspicious sample and verify warnings while approved signed downloads work normally.
Question 20A file server administrator downloads a utility from an unknown site despite the executable carrying an internet-zone mark and poor reputation. How can administrators make this correction durable through future changes? Require an expiration date and vendor remediation plan for each security mitigation compatibility exception. Restrict LAPS password-read permissions and audit recovery requests after help-desk staffing changes. Publish an approved software catalog and require source validation before installing utilities on privileged Windows servers. Use staged WDAC policy deployment with signed policy changes, exception ownership, and a tested recovery route. ExplanationCorrect Answer C:Publish an approved software catalog and require source validation before installing utilities on privileged Windows servers. This preventive control maintains the intended protection because smartScreen helps identify malicious or low-reputation downloads, but does not replace software provenance and least privilege. The initial action remains: Require reputation-aware SmartScreen checks in the supported user and download workflow, and obtain a signed utility from the authorized vendor. Other Answers A:Per-program mitigation controls allow compatibility exceptions without discarding unrelated security protections for every process. The stronger recurring control is to publish an approved software catalog and require source validation before installing utilities on privileged Windows servers. B:Windows LAPS generates device-specific rotating local credentials, limiting the lateral impact of a single leaked administrator password. A more direct preventive measure is to publish an approved software catalog and require source validation before installing utilities on privileged Windows servers. D:Windows Defender Application Control evaluates code trust against explicit policies, so an untested enforcement change can block legitimate binaries. The lasting safeguard is to publish an approved software catalog and require source validation before installing utilities on privileged Windows servers.
