Domain Controller Security Hardening Quiz

1. What is the primary benefit of implementing a Read-Only Domain Controller (RODC)?

Reduces risk in branch office locations

Increases domain controller processing speed

Eliminates the need for password policies

Removes the need for backups

2. What is the primary function of implementing certificate-based authentication on a domain controller?

To strengthen authentication security and reduce password-based attacks

To eliminate the need for firewalls

To increase network bandwidth

To simplify user account management

3. Which event log on a domain controller is most important for security monitoring?

Security log

Application log

System log

DNS log

4. What is the purpose of implementing BitLocker on a domain controller?

To encrypt the entire disk and protect data at rest

To increase network speed

To manage user permissions

To monitor network traffic

5. Which Active Directory feature prevents unauthorized password changes by requiring administrator approval?

Fine-Grained Password Policy (FGPP)

Account lockout policies

Password expiration

Kerberos authentication

6. The practice of _____ involves granting users only the minimum permissions needed to perform their job.

Least privilege

Maximum access

Role-based security

Administrative delegation

7. What role does DNS play in domain controller security?

It enables domain clients to locate domain controllers for authentication

It encrypts all domain traffic

It manages firewall rules

It controls user access permissions

8. Which of these is NOT a recommended security hardening step for domain controllers?

Enabling unnecessary services

Disabling unused network protocols

Implementing strong password policies

Restricting administrative access

9. What should be the approach for patching and updating domain controllers?

Apply patches promptly after testing in a non-production environment

Never apply patches to avoid disruption

Apply all patches immediately without testing

Only patch during business hours

10. Which service is critical for domain controller authentication and should be strictly monitored?

Kerberos Key Distribution Center (KDC)

Print Spooler

Remote Desktop Services

Windows Update

11. What is the primary purpose of enabling audit logging on a domain controller?

To track user logon attempts and security events

To improve network performance

To encrypt all domain traffic

To automatically block failed logins

12. Which firewall rule should be implemented to protect domain controller replication traffic?

Allow RPC and LDAP only from authorized domain controllers

Allow all traffic on all ports

Block all inbound traffic

Allow only HTTPS traffic

13. What is the minimum recommended functional level for modern Active Directory security?

Windows Server 2016 or higher

Windows Server 2003

Windows Server 2008

Windows Server 2012

14. Which account should never be used for daily administrative tasks on a domain controller?

Domain Administrator account

Service account

Standard user account

Guest account

15. What is the purpose of implementing Group Policy Objects (GPOs) on a domain controller?

To centrally manage security settings across the domain

To increase network bandwidth

To reduce storage requirements

To eliminate the need for firewalls

16. Which protocol should be disabled on domain controllers to prevent unencrypted authentication?

LDAP over SSL

Kerberos

NTLM

HTTPS

17. What does LAPS (Local Administrator Password Solution) do?

Automatically manages and rotates local admin passwords

Encrypts all network traffic on domain controllers

Disables local administrator accounts

Monitors incoming network connections

18. Which of the following is a best practice for securing the physical access to a domain controller?

Place it in a locked server room with restricted access

Keep it in an open office area for easy access

Share administrative passwords with IT staff

Enable remote desktop for all users

19. What is NTDS.dit in Active Directory?

The database file containing all directory information

A network protocol for domain communication

A firewall rule set for domain controllers

A backup utility for Active Directory

20. Which Group Policy setting should be configured to prevent the storage of passwords in reversible encryption on a domain controller?

Store passwords using reversible encryption

Enforce password history

Maximum password age

Password must meet complexity requirements

Infrastructure Expert Hardening a Domain Controller Quiz