A Quick Answer Key follows the Self Test questions. For complete questions, answers, and explanations to the Self Test questions in this chapter as well as the other chapters in this book, see the Self Test Appendix.
|
You have instituted new security policies for the IT department. One important rule is to never log on as Administrator unless it is absolutely necessary. To enhance security, you want everyone to use their regular user accounts for everyday tasks so you can maintain security as much as possible. A junior administrator comes to you and says he does not wish to log on to the server with an administrative account, but he needs to use a program that requires administrative privileges. What can he do?
If running the program requires administrative privileges, he cannot run it unless he logs off and logs back on as Administrator.
He can open the Computer Management console and use the Set password option.
He can right-click the program he wants to run, select Properties, click the Advanced button, and configure the program to run without administrative privileges.
He can right-click the program, choose the Run as command, and enter the Administrator account name and password.
| ||
|
You have been hired as the network administrator for a small law firm. The first thing you want to do when you take over the job is increase the security on the network. You evaluate the current security level and find it lacking. You decide that you need to secure account passwords using strong encryption on domain controllers. Which utility should you use?
System Key Utility
Secedit
MBSA
SUS
| ||
|
You have recently hired a new junior administrator to assist you in running the network for a medium-sized manufacturing company. You are explaining to your new assistant that AD objects are assigned security descriptors to allow you to implement access control. You tell your assistant that the security descriptor contains several different components. Which of the following are contained in the security descriptor for an object? (Select all that apply.)
Discretionary access control list
System access control list
Dynamic access control list
Ownership information
| ||
|
You are attempting to troubleshoot some problems with access that you think can be traced back to membership in multiple groups. You want to ensure that all administrative accounts are able to perform the tasks they need to accomplish, but you want to remove the built-in accounts from all groups to which they’ve been added by another administrator, and give them only the access they had by default. You are a little confused because you know that the built-in accounts already belong to some groups at installation, and you don’t want to remove them from groups they are supposed to belong to. To which groups does the Domain Administrator account belong in Windows Server 2003 by default? (Select all that apply.)
Schema Admins
Enterprise Admins
Group Policy Creator Owners
|
Answers
|
D |
|
|
A |
|
|
A, B, D |
|
|
A, B, C |
Answers
|
D |
|
|
A, B |
|
|
B |
|
|
B |
Answers
|
D |
|
|
C |
|
You need to configure Kerberos policies because you want to force user logon restrictions. You go to the computer of the user on whom you want to enforce these policies and access the Local Security Policy. However, in the GPO Editor, you cannot find Kerberos policies in the Security Settings node under Computer Configuration, under Windows Settings. What is the problem?
You are looking in the wrong section; Kerberos policies are located in the User Configuration node.
You cannot set Kerberos policies through the Local Security Policy console.
You must first raise the domain functional level before Kerberos can be used and this option will appear in the GPO.
Another administrator has deleted the Kerberos policies node from the GPO.
| ||
|
You have been analyzing all of your security configuration information as part of a new project that requires you to provide a detailed report on your network’s security to management. Toward that end, you need to evaluate the security database test.sdb at the command prompt. What command can you use to do this?
secedit /validate test.sdb
secedit /analyze test.sdb
secedit /configure test.sdb
secedit /export test.sdb
| ||
|
You want to set up auditing on several folders that contain important and sensitive information. There are other folders within the specified folders that contain less sensitive information, so you don’t want to audit them, because you want to put as little overhead burden on the network as you can. What happens to subfolders and files within a parent folder if auditing has been enabled?
Subfolders only are audited
Files only are audited; special access must be turned on for the folders to be audited
Subfolders and files are audited
No auditing is performed
| ||
|
A parent folder has auditing enabled. Two folders, Applications and Phone Listings, are listed under this parent folder. You need to have the Phone Listings folder audited but not the Applications folder. How can this be accomplished?
It cannot; all subfolders are audited when the parent folder has auditing enabled.
Right-click the Applications folder, and click the Properties tab, select the Security tab, and click Advanced. Then select the Auditing tab and clear the check box that is labeled Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here.
Right-click the Phone Listings folder, click the Properties tab, select the Security tab, and click Advanced. Then select the Auditing tab and clear the check box that is labeled Inherit from parent the auditing entries that apply to child objects. Audit entries defined here.
Right-click the Phone Listings folder, click the Security tab, and click Advanced. Then select the Auditing tab and clear the check box that is labeled Inherit from parent the auditing entries that apply to child objects. Include these with entries explicitly defined here option.
|
Answers
|
B |
|
|
B |
|
|
C |
|
|
B |
Answers
|
B |