Securing Windows Server 2016 Free Practice Test — 30 Questions

Question 1

A critical Windows Server 2016 infrastructure supporting a financial services firm\'s core trading platform is experiencing sporadic periods of extreme latency and application unresponsiveness. The IT security team has diligently deployed AppLocker to restrict unauthorized software execution, BitLocker to encrypt sensitive data at rest, and Windows Defender Antivirus to mitigate malware threats. Despite these robust security measures, end-users report a degradation in service during peak trading hours. An analysis of network traffic patterns reveals no overt signs of external intrusion or malware activity. Which of the following technological implementations, when absent from the current secure configuration, would most directly contribute to the observed performance degradation and lack of resilience under load?

Accepted Answer

Network Load Balancing (NLB)

Question 2

A cybersecurity administrator is tasked with enhancing the security posture of a Windows Server 2016 environment. A critical SQL Server instance, configured to run under a Group Managed Service Account (gMSA), requires access to a remote file share for storing backup files. Initial testing reveals that while the SQL Server service itself is functioning correctly, it consistently fails to authenticate to the remote file share, resulting in backup operations failing. The gMSA\'s password management is handled automatically by Active Directory, and the service account has been verified as operational for the SQL Server service. The file share is protected by standard SMB security, and the user accounts that typically access the share have no issues. The administrator suspects a misconfiguration in how the gMSA is permitted to access external resources.

Which of the following actions, when implemented on the domain controller, would most effectively resolve the SQL Server\'s inability to access the remote file share while adhering to the principle of least privilege?

Accepted Answer

Configure the gMSA in Active Directory to allow constrained Kerberos delegation to the Service Principal Name (SPN) of the remote file server.

Question 3

Following a recent organizational restructuring and a former employee\'s departure, the IT department is tasked with fulfilling a data subject\'s request for erasure under the General Data Protection Regulation (GDPR). The employee, an architect, had access to sensitive project documentation, client communications, and system administration logs across multiple Windows Server 2016 roles, including file servers, domain controllers, and a custom-built application server. The request specifically targets the removal of all personal data associated with this individual. Which of the following strategies most effectively addresses the comprehensive requirements of GDPR Article 17 in this scenario?

Accepted Answer

Deleting the user's Active Directory account and their associated profile folder on the file server.

Question 4

A critical Windows Server 2016 instance, responsible for hosting an internal application accessible via TCP port 8080, is experiencing intermittent network disruptions following the application of a recent cumulative security update. Users report that while some internal clients can still connect, others are intermittently unable to reach the application, and diagnostic pings to the server are also inconsistent. The server\'s operating system logs show no critical errors related to the application itself or the update process. Considering the server is hardened according to NIST SP 800-53 controls for network access, which of the following administrative actions would most effectively diagnose and potentially resolve the network connectivity issue, assuming no other system changes were made concurrently?

Accepted Answer

Reviewing and validating the inbound and outbound rules within Windows Firewall with Advanced Security to ensure they permit legitimate traffic on TCP port 8080 and any necessary supporting ports, while also checking for any newly created restrictive rules.

Question 5

A cybersecurity team is tasked with hardening a Windows Server 2016 domain controller that hosts sensitive financial data. They aim to implement a robust application control policy to prevent the execution of any unauthorized executables, thereby mitigating risks associated with malware or rogue software. Considering the principle of least privilege and the capabilities of Windows Server 2016 security features, what is the most effective strategy to achieve this objective using AppLocker?

Accepted Answer

Configure AppLocker executable rules to deny all executables by default and subsequently create explicit allow rules for all approved applications.

Question 6

Following the discovery of unauthorized access to the finance department\'s file shares on a Windows Server 2016, which was confirmed by suspicious outbound network traffic and unusual login patterns from an external IP address, the IT security team has successfully isolated the affected server from the network. What is the most critical immediate action to undertake to facilitate a comprehensive forensic investigation and support potential legal proceedings, adhering to established incident response frameworks?

Accepted Answer

Secure and preserve volatile data from the isolated server, including active processes, network connections, and logged-on users, before any system shutdown or reboot.

Question 7

An enterprise network administrator for a mid-sized financial services firm has discovered evidence of an attacker who successfully gained initial access to the network through a phishing attack targeting an employee\'s workstation. The attacker is suspected of attempting to pivot to other critical systems, including financial databases and authentication servers. Considering the firm operates under strict regulatory requirements like the Gramm-Leach-Bliley Act (GLBA) which mandates the protection of customer financial information, which of the following strategies would most effectively mitigate the risk of the attacker achieving widespread lateral movement across the server infrastructure?

Accepted Answer

Configure host-based firewalls on all critical servers to permit only essential inbound and outbound traffic based on the principle of least privilege.

Question 8

Following a confirmed intrusion into a Windows Server 2016 environment, where evidence suggests active data exfiltration and significant service disruption, what is the most critical immediate action a security administrator must take to mitigate further damage and preserve the integrity of the remaining infrastructure?

Accepted Answer

Isolating the affected server from the network

Question 9

An organization is implementing a new web application hosted on a Windows Server 2016 instance. The application requires specific administrative tasks to be performed regularly, such as modifying application pool identities and restarting web server services, but only for that particular application. To minimize the security risk and adhere to the principle of least privilege, a security administrator needs to grant a junior administrator the ability to perform these tasks without providing full local administrator privileges on the server. Which of the following strategies best achieves this objective?

Accepted Answer

Create a custom security group, assign the junior administrator to this group, and delegate specific permissions to the group for managing IIS application pools and relevant services on the server.

Question 10

A multinational corporation operating within the European Union must ensure its Windows Server 2016 file servers comply with the General Data Protection Regulation (GDPR) concerning the storage and access of employee personal data. The compliance officer has mandated that only authorized personnel within the HR department can access specific sensitive employee records, and a detailed audit trail of all access attempts to these files must be maintained for regulatory review. Which of the following configurations, when implemented via Group Policy Objects, would most effectively address these dual requirements for granular access control and comprehensive auditing?

Accepted Answer

Configure GPOs to enforce specific NTFS permissions on the sensitive data folders, coupled with GPOs to enable detailed auditing of file system access events for the relevant servers.

Question 11

An enterprise operating within the European Union has implemented a Windows Server 2016 environment to manage customer order data. The company\'s sales department requires access to historical order information for trend analysis, which is stored on a dedicated file server. To comply with the General Data Protection Regulation (GDPR), the security team is reviewing the Active Directory (AD) structure and data storage practices. It is discovered that dormant user accounts, including those of former employees and customers who have no ongoing business relationship, still retain extensive personal information in their AD profiles, such as passport numbers and detailed home addresses, which are not directly utilized for sales analysis. The data retention policy mandates keeping all historical order data indefinitely. Which of the following actions best balances the need for sales analysis with GDPR compliance and robust server security?

Accepted Answer

Implement a policy to purge or anonymize non-essential sensitive attributes from inactive AD user accounts and apply strict Role-Based Access Control (RBAC) to the sales data repository.

Question 12

Following a detected anomalous outbound network traffic pattern from a critical database server running Windows Server 2016, which action should be the absolute first priority to mitigate potential data exfiltration and preserve forensic evidence?

Accepted Answer

Isolate the affected server from the network by disabling its network interface or rerouting traffic.

Question 13

A global enterprise utilizes Windows Server 2016 extensively across its operations, including sensitive financial data processing centers and remote branch offices with limited network bandwidth. A critical zero-day vulnerability has been identified, necessitating immediate patching. The IT security team must devise a deployment strategy that prioritizes rapid remediation while ensuring system stability, minimizing operational downtime, and adhering to PCI DSS compliance requirements for all financial transaction systems. Which of the following approaches best balances these competing demands for a secure and effective rollout?

Accepted Answer

Implement a phased deployment starting with a small group of non-critical servers to validate the patch, followed by a broader rollout to production systems, leveraging Windows Server Update Services (WSUS) with configured distribution points at key network segments and enabling background installation for minimal user impact, while closely monitoring system health and compliance reports.

Question 14

Consider a scenario where a cybersecurity audit for a Windows Server 2016 environment, adhering to the Payment Card Industry Data Security Standard (PCI DSS) requirements, has identified a vulnerability where standard user accounts possess excessive permissions on critical operating system files, potentially allowing for unauthorized modification or deletion. The security team needs to implement a robust, centrally managed solution to enforce the principle of least privilege for these files. Which of the following administrative strategies, leveraging Group Policy, would most effectively mitigate this identified risk without compromising essential system functionality?

Accepted Answer

Utilize Group Policy to enforce NTFS permissions, specifically denying 'Full Control' and 'Modify' permissions to the 'Users' group for critical system files within the \Windows\System32 folder, while ensuring 'System' and 'Administrators' groups retain appropriate access.

Question 15

An enterprise operating a critical financial services platform on Windows Server 2016 is undergoing a rigorous audit to ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) v4.0. The audit specifically flags vulnerabilities related to the protection of sensitive cardholder data. The IT security team is tasked with implementing the most effective foundational security measures to address these findings and establish a robust compliance posture. Considering the immediate need to secure sensitive data and meet regulatory requirements, which of the following actions represents the most impactful initial step?

Accepted Answer

Implement granular access controls using Role-Based Access Control (RBAC) and enforce strong password policies with complexity and history requirements.

Question 16

A cybersecurity incident response team has identified a critical zero-day vulnerability affecting Windows Server 2016 installations across a global enterprise. The organization operates with a distributed IT support structure, inconsistent inter-site network bandwidth, and a diverse range of server hardware configurations. Business-critical applications run on these servers, and any prolonged downtime would have significant financial repercussions. What phased deployment strategy would most effectively balance the urgency of patching with the imperative of maintaining operational stability?

Accepted Answer

Implement a pilot deployment to a representative subset of servers across different geographical locations and critical application tiers, monitor closely for adverse effects, and then proceed with a phased rollout to remaining servers based on risk assessment and network capacity, with a rollback plan in place.

Question 17

A financial services organization has detected an ongoing sophisticated cyberattack targeting its sensitive customer financial data. The threat actor appears to be exfiltrating data using encrypted channels, making traditional signature-based detection methods ineffective. The security team needs to implement a strategy that not only stops the current exfiltration but also provides deeper visibility into the attacker\'s tactics, techniques, and procedures (TTPs) to prevent recurrence. Which of the following configurations would most effectively address this immediate threat and enhance the organization\'s ability to detect and respond to similar advanced persistent threats (APTs)?

Accepted Answer

Configuring Windows Defender Advanced Threat Protection (ATP) to leverage its advanced threat hunting and behavioral analysis capabilities for identifying anomalous data transfer patterns and compromised endpoints.

Question 18

A sophisticated zero-day exploit targeting a critical vulnerability in a core Windows Server 2016 component has been detected actively compromising multiple production servers within your organization. The exploit is observed to be propagating laterally through network traffic, impacting a wide array of business-critical applications and data stores. Initial analysis suggests the exploit leverages specific network packet structures to gain unauthorized access and execute malicious code. Given the urgency and the lack of an immediate vendor patch, which of the following actions would constitute the most effective and immediate containment strategy to limit the spread and impact of this active threat?

Accepted Answer

Deploying a custom application firewall rule on all affected servers to block traffic based on observed malicious patterns.

Question 19

A compliance audit of a Windows Server 2016 environment has identified an excessive number of users with persistent, high-level administrative privileges across critical infrastructure servers. The auditor has mandated a significant reduction in direct, standing administrative access to mitigate potential insider threats and reduce the attack surface. Which of the following strategies would most effectively address this finding by aligning with the principle of least privilege and providing granular control over administrative tasks?

Accepted Answer

Implement a Privileged Access Management (PAM) solution that enforces Just-In-Time (JIT) administrative access, granting elevated privileges only for specific, time-bound tasks.

Question 20

Considering the stringent requirements of the General Data Protection Regulation (GDPR) for data subject rights and breach accountability, a security administrator for a multinational corporation discovers suspicious activity around a file share containing sensitive customer information on a Windows Server 2016 instance. Initial investigation suggests potential unauthorized modification of access control lists (ACLs) on critical directories. To effectively trace such actions and demonstrate compliance, which specific Windows Server 2016 audit policy, when enabled for both success and failure events, would provide the most granular and direct logging of changes to file and folder permissions?

Accepted Answer

Audit File System

Question 21

Following a confirmed security incident that has led to unauthorized access and exfiltration of sensitive customer information from a Windows Server 2016 environment, the IT security lead must devise an immediate response strategy. The breach appears to have exploited a vulnerability in a custom-built application hosted on the server, but the exact exploit vector and the full extent of data compromise are not yet fully understood. Given the potential for regulatory fines under frameworks like GDPR for data breaches, what is the most prudent initial course of action to mitigate immediate risks and lay the groundwork for effective remediation?

Accepted Answer

Isolate the affected server from the network, initiate a comprehensive forensic analysis of the server logs and application code to identify the root cause and scope of the breach, and prepare a preliminary communication plan for regulatory bodies and affected clients.

Question 22

A newly formed security operations team requires access to monitor event logs, reset user account lockouts, and review the membership of critical security groups within your Windows Server 2016 domain. To uphold the principle of least privilege and minimize the attack surface, which of the following delegation strategies would be the most secure and effective for granting these necessary permissions?

Accepted Answer

Create a custom security group and delegate specific read permissions for event logs, the "Reset Password" and "Unlock Account" user rights, and read access to relevant Active Directory group objects.

Question 23

A financial services firm operating across multiple European Union member states has been notified of an impending update to the Payment Services Directive (PSD3), which introduces stricter data encryption and access control requirements for sensitive customer information processed by Windows Server 2016 environments. The IT security team must rapidly implement these new mandates across all company servers to ensure continued regulatory compliance. Which of the following methodologies or tools would be the most effective and systematic approach to adapt the existing server security posture to meet these evolving regulatory demands?

Accepted Answer

Utilize the Microsoft Security Compliance Toolkit to import and apply updated security baselines, customizing them as necessary to align with the specific requirements of PSD3 and then deploying these through Group Policy.

Question 24

A large enterprise utilizes Windows Server 2016 with Active Directory. The IT security policy mandates that regional IT support teams can only manage security configurations on user workstations within their designated geographical domain segments. These teams are not to be granted broad administrative privileges over the entire domain. To achieve this, what specific delegation of control within Active Directory and Group Policy Management Console would most effectively empower these regional teams to adjust workstation security settings, such as password policies and firewall rules, while strictly adhering to the principle of least privilege?

Accepted Answer

Delegate control to modify specific Group Policy Objects linked to their respective OU

Question 25

A multinational enterprise operating Windows Server 2016 environments across various geographical regions and departments is seeking to refine its Active Directory delegation model. The current system, characterized by broad administrative rights granted at the domain level and a lack of granular control within organizational units (OUs), presents significant security risks and operational inefficiencies. The IT security team has identified a critical need to implement a more robust delegation strategy that supports efficient localized administration, enhances security posture, and facilitates compliance with data protection mandates. Which of the following approaches best addresses these requirements by promoting the principle of least privilege and enabling effective operational management?

Accepted Answer

Construct bespoke administrative roles with meticulously defined permissions, scoped to specific organizational units and server groups, allowing local IT teams to manage their assigned resources effectively.

Question 26

A multinational corporation operating within the European Union is transitioning its critical personal data repositories to Windows Server 2016. They are prioritizing strict adherence to the General Data Protection Regulation (GDPR), particularly concerning the \"right to erasure.\" Given the server\'s configuration, which of the following technical strategies would most effectively ensure that personal data, once requested for deletion, is rendered irretrievable and compliant with GDPR\'s data protection mandates?

Accepted Answer

Implementing BitLocker Drive Encryption on all storage volumes containing personal data and subsequently securely destroying the encryption keys associated with those volumes.

Question 27

During a security audit of an Active Directory environment, an administrator discovers that a user account delegated to manage password resets for all user objects within the \"Sales\" Organizational Unit can also unlock accounts that are currently locked out. This delegation was specifically configured using the Active Directory Users and Computers console, granting only the \"Reset password\" permission. What underlying security principle or technical implementation within Windows Server Active Directory best explains this observation?

Accepted Answer

The "Reset password" delegation implicitly includes the right to unlock user accounts due to their functional proximity in resolving user login issues.

Question 28

An administrator is alerted to an unusual and resource-intensive process exhibiting suspicious network activity on a Windows Server 2016 hosting a critical financial database. Initial investigation suggests the process may be attempting unauthorized data exfiltration. Given the sensitivity of the data, what is the most prudent immediate action to mitigate further risk?

Accepted Answer

Isolate the server from all network segments, including management interfaces, to prevent any further communication.

Question 29

A network administrator has deployed a Group Policy Object (GPO) linked to the \"CoreInfrastructure\" OU, which contains numerous server objects. This GPO is configured with Security Filtering to exclusively target members of the \"CriticalServicesOps\" security group. A server object residing within the \"CoreInfrastructure\" OU, specifically in a child OU named \"DMZServers,\" is being managed by a user who is a member of the \"CriticalServicesOps\" group. Despite the user\'s membership and the GPO\'s linkage to the parent OU, the GPO\'s settings are not being applied to this server. What is the most probable reason for this behavior?

Accepted Answer

Security Filtering on the GPO prevents its application to any user or computer not explicitly a member of the "CriticalServicesOps" group, regardless of OU structure or inheritance.

Question 30

A financial services organization, operating under strict regulatory compliance frameworks like SOX and GDPR, is implementing a new security policy for its Windows Server 2016 infrastructure. The policy mandates that administrative tasks related to the company\'s core financial application, which runs on several dedicated servers, must be performed by a specialized application support team. This team should only have the necessary permissions to manage the application\'s services, configuration files, and related user accounts, without possessing general server or domain administrative privileges. Which of the following approaches best adheres to the principle of least privilege and ensures robust security for this scenario?

Accepted Answer

Create a dedicated security group for the application support team and utilize Group Policy Objects (GPOs) to delegate specific administrative permissions for the financial application's services and configurations to this group on the relevant servers.

Securing Windows Server 2016 Free Practice Test — 30 Questions

A lot more is already mapped out

About the Securing Windows Server 2016 Certification