Windows Server Final Exam

Front 1

What do ACLs do?

Back 1

They are the rules that determine the level of access a security principal (user, group) has.

Front 2

What is an Access Token called in a Windows Server environment?

Back 2

A Kerberos ticket (Issued by Kerberos/the Security Support Provider)

Front 3

What is Authentication?

Back 3

It is simply the process that says you are who you say you are (username and password)

Front 4

What is Authorization?

Back 4

Once authenticated, the security principal gains authorization by presenting their access token to a desired resource. The resource checks your permissions on its DACL based on your access token.

Front 5

What is Server Core?

Back 5

It is a stripped down version of Windows Server with no GUI. It is more secure with a smaller attack surface but it also has less features/capabilities than the full version of Windows Server can do.

Front 6

Where is the AD database stored?

Back 6

The Ntds.dit database file

Front 7

Where should the AD database and System Volume (SYSVOL) be stored?

Back 7

On separate volumes that do not contain other user data and application data.

Front 8

What was Active Directory Lightweight Directory Services named before?

Back 8

ADAM (Active Directory Applications Mode)

Front 9

What is AD LDS for?

Back 9

Designed to provide account services and similar directory benefits to applications without the overhead of a full-domain.

It's great for development of software that interacts with AD without altering the production network.

Front 10

Explain the reasons for PKI (Public Key Infrastructure)?

Back 10

Origin authentication: Verification that a document or message was created by the person claimed. This is often referred to as 'digital signature.’

Content integrity: Prove that a document has not been tampered with.

Content confidentiality (encryption): Protecting the contents of a document or message so that it can be read only by authorized users.

Non-repudiation: A security service whereby creation of a document or message cannot subsequently be denied.

Front 11

What is asymmetric encryption?

Back 11

Check out:
http://en.wikipedia.org/wiki/Public-key_cryptography

Front 12

What is the basic building block of a PKI?

Back 12

A digital certificate

Front 13

What is a CA?

Back 13

A trusted entity that issues digital certificates to clients/servers and etc.

Front 14

What does ADSI stand for?

Back 14

Active Directory Service Interfaces

Front 15

What is ADSI?

Back 15

It's a set of COM interfaces used to access the features of directory services.
It can be used to automate administrative tasks (mostly replaced by PowerShell now).

Front 16

What is COM?

Back 16

Component Object Model is a mechanism that allows the re-use of objects (or rather components), independently of the programming language used and where the component is implemented.

Front 17

What is a drawback of ADSI?

Back 17

You need complementary tools such as WMI, CDO and WSH to do things such as access the hardware, e-mail, access the registry.

Front 18

What is PowerShell?

Back 18

An Object Oriented command line interface developed by Microsoft.

It is also used for scripting.

Front 19

What is WMI?

Back 19

WMI allows scripting languages like ADSI and Windows PowerShell to manage Microsoft Windows personal computers and servers, both locally and remotely.

Front 20

What is WSH?

Back 20

Windows Script Host is an automation technology that provides scripting abilities comparable to batch files, but with a wider range of supported features such as registry access.

Front 21

What is CDO?

Back 21

Collaborative Data Objects allows email functionality from within a script

Front 22

What is Dynamic DNS?

Back 22

It allows a client to dynamically add itself to DNS when it is assigned an IP by DHCP.

Front 23

What is a Stub Zone (DNS)?

Back 23

A DNS Server that only contains records (NS) of another DNS server.

Front 24

Where is domain wide DNS information stored?

Back 24

On the Domain Partition of the directory

Front 25

Where is forest wide DNS information stored?

Back 25

On the application directory partition

Front 26

What is an ACL?

Back 26

An Access Control List contains a list of Access Control Entries (Permissions).

Front 27

True or false:
Authentication determines your level of access?

Back 27

False, authorization does that.

Front 28

What is the Authentication Process?

Back 28

o User to MSGINA (Graphical Interactive Network Authentication) (the logon screen on PC)

o MSGINA hands it off to LSA (Local system authority) and determines if its remote or local account

o LSA hands it off to SSP (Security Support Provider) which is on the DC if remote (the Kerberos engine)

Front 29

What is the Authorization Process for a print job?

Back 29

o User sends print job and token to printer server.
o Server checks to see if ACL is valid and which ACL applies to it.
o If user has access, the job prints.

Front 30

What is an Online Responder?

Back 30

They are designed to respond to specific certificate validation requests through the Online Certificate Status Protocol (OCSP). Using an OR, the system relying on a PKI does not need to obtain a full CRL and can submit validation request for a specific certificate.

Front 31

What AD CS Feature allows for routers and switches to participate in a Windows PKI?

Back 31

NDES (Network Device Enrollment Service)

Front 32

True or False:
Best practice suggests to have a Root CA be a Stand-alone Server.

Back 32

True, and it should be taken offline as soon as the Enterprise Subordinate CAs are setup.

Front 33

What are the four elements of AD CS?

Back 33

Certificate Authorities, CA Web Enrollment, Online Responders and Network Device Enrollment Service.

Front 34

What is a CRL?

Back 34

A Certificate Revocation Lists shows certificates that have been revoked (made invalid)

Front 35

What is a Delta CRL?

Back 35

A Delta CRL is a partial CRL that only contains entries for certificates that have been revoked since the issuance of a prior, base CRL.

Front 36

What are Certificate Templates?

Back 36

Certificate templates are used to define the format and content of certificates, to specify which users and computers can enroll for which types of certificates, and to define the enrollment process.

Front 37

What is the AIA?

Back 37

The Authority Information Access is a certificate extension that contains URLs where the issuing CA certificate can be retrieved.

Front 38

Site Link frequency is best defined as..

Back 38

how often the link attempts to replicate information within the specified availability (schedule)

Front 39

Universal Group Membership is maintained in the

Back 39

Global Catalog

Front 40

True or False: You can send email to a security group.

Back 40

True

Front 41

By default, the background group policy refresh interval is every ____ minutes.

Back 41

90

Front 42

Rather than wait until next user logoff or background policy refresh interval, you can force a group policy update via...

Back 42

gpupdate.exe /force

Front 43

To ensure that a Group Policy's settings do not get overwritten, you can...

Back 43

Enable the "No Override" switch

Front 44

To determine which group policies were applied to a particular user and/or PC, you would run:

Back 44

gpresult.exe

Front 45

What is AD FS?

Back 45

Active Directory Federation Services is a software component that provides users with single sign-on access to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and implement federated identity.

Front 46

What is AD RMS?

Back 46

Active Directory Rights Management Services uses encryption and a form of selective functionality denial for limiting access to documents such as corporate e-mail, Word documents, and web pages, and the operations authorized users can perform on them.

Companies can use this technology to encrypt information stored in such document formats, and through policies embedded in the documents, prevent the protected content from being decrypted except by specified people or groups, in certain environments, under certain conditions, and for certain periods of time.

Front 47

What are the two organizations required in AD FS?

Back 47

The Resource Organization and the Account Organization

Front 48

In AD FS, what are Claims?

Back 48

Assertions used to determine a user’s level of access to an application. Can be as simple as a user account name or groups.

Front 49

What is the Account Partner responsible for (AD FS)?

Back 49

The organization that hosts the user accounts (In AD DS or AD LDS) that need to use those resources.

Front 50

What is the Resource Partner responsible for (AD FS)?

Back 50

The organization responsible for maintaining the web resources.

Front 51

What are examples of applications that can use AD RMS?

Back 51

Office, SharePoint, Exchange Server

Front 52

What are the states that certificates can have (AD CS)?

Back 52

o Creation
o Revocation
o Expiration
o Suspension

Front 53

What is the difference between a Standalone PKI and Enterprise PKI (AD CS)?

Back 53

Standalone CA – does not require AD, less automated (request set to Pending) and requires more input from users.

Enterprise Certificate Authority – Integrates with AD and uses IIS to allow users to request Certificates. The certificate verification is mostly automated by verifying AD for the user’s identity and information.

Front 54

What is NDES (AD CS)?

Back 54

Network Device Enrollment Service is used to enable devices such as routers and switches as well as applications to request certificate enrollment with CAs.