70-291 Implementing, Managing, And Maintaining A Network.

Front 1

If the administrator is never used, what can be done to prevent unauthorized user from logging in as the administrator ?

Back 1

Disable the administrator account.

Front 2

How can EFS be permitted for only a limited subset of machines ?

Back 2

Disable EFS at the domain level, Enable EFS in a GPO linked to an OU with the appropriate subset of systems listed within.

Front 3

How can an enterprise network be configured to ensure that users are not running rogue applications

Back 3

Softare restricion policied.

Front 4

What type of software restriction policy is best for applications with code that is constantly changing ?

Back 4

Path Rule.

Front 5

What software restriction policy is best for applications with code that is static but an installation path that changes ?

Back 5

Hash Rule.

Front 6

What softare restriction policy can be used to ensure that only validated applications are allowed to be installed ?

Back 6

Certificate Rule.

Front 7

Which audit setting will capture network logons ?

Back 7

Audit account logon events.

Front 8

Which audit setting will capture interactive logons or access to a system via the network ?

Back 8

Audit logon events

Front 9

Which audit setting will capture access to files, folders, printers and registry keys ?

Back 9

Object Access.

Front 10

What events should be audited to audit all access to confidential files and folders ?

Back 10

Success and Failure for Audit Object Access.

Front 11

What events should be audited to audit any attempt to modifiy a registry key ?

Back 11

Success and Failure to Audit object Access.

Front 12

How can the Event Viewer retention settings be configured for multiple systems ?

Back 12

Group Policy Object (GPO)

Front 13

Define the principle of least privilege ?

Back 13

Allowing users to only have the rights necessary to perform their jobs and noting more.

Front 14

What built in group provides users with the ability to create Group Policy Objects ?

Back 14

Group Policy Creator Owners group.

Front 15

What security template resets a system to its original system configuration ?

Back 15

Setup security.inf

Front 16

What security template resets a domain controller to its original DC configuration ?

Back 16

Dc security.inf

Front 17

What right must a user have to be able to link Group Policy Objects ?

Back 17

Manage GPLinks (this is a default task available in the Delegation of Control Wizard)

Front 18

What utility will examine a system for security vulnerabilities like weak or expired passwords as well as missing updates and hot fixes ?

Back 18

MBSA or mbsacli.exe command line version.

Front 19

What windows Management Instrumentation command line tool can be used to identify missing security updates ?

Back 19

Wmic /qfe

Front 20

What network service facilitates deploying updates, service packs, and hot fixes ?

Back 20

Software Update Service (SUS)

Front 21

What network service should be restarted when SUS experiences problems ?

Back 21

IIS

Front 22

How can domain clients easily be configured to pull all updates from server name SUS02 ?

Back 22

Use a GPO to specity http://sus02 as the server for both intranet updates and intranet statistics server.

Front 23

What Service Pack is required for Windows XP clients to support being a SUS client for updates ?

Back 23

Windows XP Service Pack 1 or Later.

Front 24

What Service Pack is required for Windows 2000 clients to support being a SUS client for updates ?

Back 24

Windows 2000 Service Pack 3 or later.

Front 25

Without installing a Service Pack how can Windows 2000 and Windows XP clients be configured as SUS clients for updates ?

Back 25

Install the Automatic Updates client on each system.(wuau22.msi)

Front 26

What is the name of the Automatic Updates Client ?

Back 26

wuau22.msi

Front 27

In what two ways can data be secured as it is being transferred ?

Back 27

Configure a web share and use SSL or IPSec.

Front 28

What are the three default IPSec policies ?

Back 28

Client (respond), Server (request), Secure Server(require).

Front 29

Which IPSec policy uses "security when asked"?

Back 29

Client (respond)

Front 30

Which IPSec policy uses "security when available"?

Back 30

Server (request)

Front 31

Which IPSec policy uses "security always"?

Back 31

Secure Server(require)

Front 32

What utilities are available for managing and moniotring IPSec ?

Back 32

IP Security Monitor snap-in, IP Security Policy Management snap-in, ipseccmd, and netsh.

Front 33

Which command line utility provides details on IPSec main mode negotiations, quick mode degotiations, and logging ?

Back 33

Netsh

Front 34

What can be done to ensure that host names are resolved when monitoring IPSec traffic in the IP Security Monitor snap-in ?

Back 34

ON the properties of a system listed in the IP security Monitor snap-in enable the "Enable DNS name resolution" option.

Front 35

What options are available for IPSec authentication ?

Back 35

Kerberos V5, Certificates, and Pre-shared key.

Front 36

What prerequisite exists for using Kerberos v5 as the IPSec authenticaiton method ?

Back 36

Any system involved in the negotiation must belong to a trusted Active Directory domain.

Front 37

When systems do not belong to a trusted Active Directory domain which IPSec authentication method is best ?

Back 37

Certificates.

Front 38

What is the WEAKEST of the three IPSec authentication methods ?

Back 38

Pre-shared key.

Front 39

When should the Pre-shared key authentication method be configured ?

Back 39

Only for testing purposes, never in final deployment production networks.