70-640: Group Policy

Front 1

Why is using Block Inheritance generally a bad idea?

Back 1

it makes it difficult to determine precedence and inheritance

Front 2

What should be used instead of Block Inheritance to control GPO application?

Back 2

security group filtering

Front 3

What does selecting Enforced for a GPO link do?

Back 3

makes settings for that GPO override any conflicts with other GPO's

Front 4

What happens when an OU has Block Inheritance but an upstream GPO link has Enforced set?

Back 4

the GPO is applied

Front 5

What two permissions are required for a GPO to apply to a user or computer?

Back 5

Allow Read and Allow Apply Group Policy

Front 6

What sort of groups can be used to filter GPO's?

Back 6

global security groups only

Front 7

What technology can be used to apply GPO's only to a particular class of machine (Windows XP, machines with SP3, etc.)?

Back 7

Windows Management Instrumentation (WMI)

Front 8

What tool is used to apply a WMI filter to Group Policy?

Back 8

Group Policy Management (GPME)

Front 9

What are two drawbacks of using WMI to filter Group Policy?

Back 9

it has a heavy impact on performance and they can't be used by Windows 2000

Front 10

What does a Windows 2000 machine do with a Group Policy Object with a WMI filter?

Back 10

it will ignore the filter and apply the GPO

Front 11

How can performance be optimized if a GPO contains only user or computer settings?

Back 11

the unused node can be disabled

Front 12

How can a GPO be used to assist in the case of a disaster, security incident, etc.?

Back 12

Create an appropriate GPO, apply, and disable. Enable when needed.

Front 13

What new technology eliminates some need for multiple GPO's?

Back 13

Preferences

Front 14

What order are GPO's applied in?

Back 14

local, site, domain, OU

Front 15

Which takes precedence, GPO's applied first or last?

Back 15

GPO's applied later overwrite earlier GPO's

Front 16

In what order are enforced GPO's added?

Back 16

after non-enforced GPO's, then in reverse order (OU, domain, and site)

Front 17

How often do Group Policy settings refresh by default?

Back 17

every 90-120 minutes

Front 18

What is Loopback Policy Processing?

Back 18

a feature that allows user's settings on a particular computer to be controlled by the settings in the Computer node, rather than from User node

Front 19

Where might Loopback Policy Processing be used?

Back 19

in environments where it's important that a computer be configured a certain way no matter who logs on (conference rooms, classrooms, etc.)

Front 20

Where is the User Group Policy Loopback Processing Mode policy located?

Back 20

Computer Configuration\Policies\Administrative Templates\System\Group Policy

Front 21

What are the two modes for User Group Policy Loopback Processing Mode?

Back 21

Replace and Merge

Front 22

What two tools are used (in addition to GPME) to support Group Policy administration?

Back 22

Resultant Set of Policy (RSOP) and Group Policy Operational Logs

Front 23

What three tools can be used to perform RSoP analysis?

Back 23

Group Policy Results Wizard, Group Policy Modeling Wizard, and gpresult.exe

Front 24

What tool can be used to predict the effects of a change on Group Policy?

Back 24

Group Policy Modeling Wizard

Front 25

What tool can be used to predict the effects of a change on Group Policy?

Back 25

Group Policy Modeling Wizard

Front 26

What tool is used to predict the effect of changes on Group Policy?

Back 26

Group Policy Modeling Wizard

Front 27

What are two settings in Restricted Groups policy settings?

Back 27

This group is a member of (MemberOf) and Members of this group (Members)

Front 28

What happens if multiple GPO's with the MemberOf policy are applied?

Back 28

The effects are cumulative- all listed groups will be members

Front 29

What happens if multiple GPO's with the Members policy are applied?

Back 29

only the last GPO applied will take effect

Front 30

What happens when one GPO specifies the Members of this group Restricted Groups policy and a later GPO specifies members with the This group is a member of policy?

Back 30

membership is initially set by the first GPO, but other members are added by the later GPO

Front 31

What format do security templates take?

Back 31

text files with a .inf extension

Front 32

What happens when a security template is applied to an Active Directory object?

Back 32

the template becomes part of the GPO associated with the object

Front 33

What happens when a security template is applied directly to a computer?

Back 33

it becomes part of the computer's local policies

Front 34

What is the procedure to apply a security template to a computer?

Back 34

use Security Configuration and Analysis snap-in to create a database, import the template into the database, and apply the database

Front 35

What command-line command performs the same functions as the Security Configuration and Analysis snap-in?

Back 35

secedit.exe

Front 36

What two advantages does secedit.exe have over the Security Configuration and Analysis snap-in?

Back 36

it can be used in script and batch files, and it can be used to apply only part of a template?

Front 37

What tool is used to create security policies?

Back 37

the Security Configuration Wizard

Front 38

What are security policies based on?

Back 38

the roles the server performs

Front 39

What command will change the location of the Security Configuration Wizard database files?

Back 39

scw.exe /kb

Front 40

What are the four categories in a security policy?

Back 40

Role-Based Service Configuration, Network Security, Registry Settings, and Audit Policy

Front 41

What does the Role-Based Service Configuration category of a security policy do?

Back 41

defines the startup state of services based on a server's role

Front 42

What does the Network Security category of a security policy do/

Back 42

configures Windows Firewall

Front 43

What does the Registry Settings category of a security policy do?

Back 43

configures protocols used to communicate with other computers

Front 44

What should you do if a security policy has an undesired effect?

Back 44

start the Security Configuration Wizard and select Rollback The Last Applied Security Policy

Front 45

What command-line command will launch the Security Configuration Wizard?

Back 45

scwcmd.exe

Front 46

What are the three methods of deploying a security policy?

Back 46

with the Security Configuration Wizard, scwcmd.exe, and by transforming it into a GPO

Front 47

What command will transform a security policy into a GPO?

Back 47

scwcmd.exe transform

Front 48

What format do security policies use?

Back 48

XML

Front 49

What is the successor to SMS?

Back 49

Microsoft System Center Configuration Manager

Front 50

What type of files does Windows Installer use?

Back 50

MSI files

Front 51

What two types of files can be used to customize Windows Installer packages?

Back 51

Transform (.mst) and Patch (.msp) files

Front 52

What is the difference between assigning and publishing applications?

Back 52

assigned applications are mandatory, and published applications are optional

Front 53

What entities can be assigned software?

Back 53

users and computers

Front 54

What entities can have software published to them?

Back 54

users only

Front 55

When is an application assigned to a user installed?

Back 55

the first time a user activates the application

Front 56

When is an application assigned to a computer installed?

Back 56

when the computer starts

Front 57

When is a published application installed?

Back 57

When it is selected through Add/Remove Programs (XP) or Programs And Features (2008/Vista) or when a user opens a file type associated with the application

Front 58

What is an SDP?

Back 58

a shared folder from which users and computers can install published or assigned software

Front 59

Why is it generally a better idea to assign a piece of software to a computer than to a user?

Back 59

software licenses are generally per computer

Front 60

What is the default definition of a slow link?

Back 60

< 500Kb/second

Front 61

What does GPSI do when it detects a slow link?

Back 61

it does not install software