70-410 - Group Policy

Front 1

Windows Service that must be running for App-locker to function.

Back 1

Application Identity Service

The Application Identity service must be running for an AppLocker policy to be enforced on a computer.

Front 2

Which ports should firewall ports should be left open for SSTP VPN connections?

Back 2

Port 443

You should create an inbound rule for TCP port 443 and an outbound rule for TCP port 443 on the firewall.

Front 3

What is the difference between Applocker and a software restriction policy?

Back 3

Applocker restricts every app, and lets you create a white list.

Software Restriction policies allow you to manage one Black list.

Front 4

Given the choice, should you use Applocker or Software restriction policies?

Back 4

Applocker -

It is recommended that you use AppLocker policies instead of Software Restriction policies because AppLocker provides the same functionality and mor.

Front 5

Will Applocker work on Windows XP?

Back 5

NO! Applocker wasn't introduced till windows 7. It will not work on Server 2003, Windows XP, or older operation systems. User Software restriction policies instead.

Front 6

You want to delete a folder every time a user signs in... What kind of GPO do you use?

Back 6

A Preference - Preferences allow you to change registry settings, drive mapping, folder creation, folder updates, shortcuts, scheduled tasks, and more.

Front 7

Default PPTP ports for VPN Connections?

Back 7

TCP port1723 and IP Protocol 47.

Front 8

You want to ensure a computer complies with a security policy listed in an .xml file. Which command do you use?

Back 8

You should use the scwcmd command, which is the Security Configuration Wizard (SCW).

Front 9

If you have multiple local GPOs on a Windows Server 2012 server, in what order are the local GPOs processed?

Back 9

1.Local Group Policy

2. Administrators and Non-Administrators Group Policy

3. User-specific Local Group Policy

Front 10

Which GPO setting manages mapped drives, scheduled tasks, environment variables, printer mappings, and Start menu settings?

Back 10

Preferences

Front 11

Which local group(s) membership on a member server allows the user to back up and restore files and directories on the server?

Back 11

Membership in the Administrators or Backup Operators groups

Front 12

If you had both a Restricted Group setting and a Preference setting in the membership of a group in a Group Policy Object, which setting would apply?

Back 12

the Restricted Group setting would apply because GPO policy settings take priority over GPO preference settings if there is a conflict

Front 13

After creating ADMX files to define registry-based policy settings on all client computers in the domain, what should you do to ensure that the custom ADMX file for the Chinese language is automatically available to all Group Policy administrators in the domain?

Back 13

Create an ADML file and copy it to the SYSVOL\domain\policies\PolicyDefinitions\[MUIculture] folder on the domain controller.

Front 14

Which service, if stopped, with will prevent AppLocker policies from being enforced?

Back 14

the Application Identity service

Front 15

What does the Block all connections setting on a Firewall profile block?

Back 15

Blocks all connections, regardless of any firewall rules that explicitly allow the connection

Front 16

What type of condition would you apply to an AppLocker rule to restrict users from installing software in a particular location?

Back 16

A path rule.

Front 17

Which ports and protocols should you enable on the Windows Firewall for a Windows Server 2012 R2 acting as a VPN server to allow inbound PPTP connections?

Back 17

TCP port 1723 and IP Protocol ID 47

Front 18

If you upgrade a computer that is using Software Restriction Policies to Windows Server 2012 R2 or Windows 8.1, and then implement AppLocker rules, which set of policies is enforced?

Back 18

only the AppLocker rules are enforced

Front 19

Which command is used to configure one or many servers with an SCW-generated policy?

Back 19

Scwcmd

Front 20

Which group can reduce the number of users that belong to the local Administrators group while providing users with access to Hyper-V?

Back 20

Hyper-V Administrators

Front 21

What should you do to allow AppLocker rules to test what software will be affected by the rules when they are implemented?

Back 21

Set enforcement to Audit

Front 22

What is the scope of the Restore-GPO cmdlet when restoring GPO backups?

Back 22

It only restores GPO backups to the original domain where the GPO was saved

Front 23

What path on a domain controller contains the Group Policy files?

Back 23

%SystemRoot%\SYSVOL\Domain\Policies\GPOGUID path, where GPOGUID is the GUID of the Group Policy container.

Front 24

Why does Microsoft recommend that you create a new Group Policy Object (GPO) for AppLocker in environments where both Software Restriction Policies and AppLocker are in place?

Back 24

If you upgrade a computer that uses Software Restriction Policies to Windows Server 2012 R2 or Windows 8.1, and then implement AppLocker rules, only the AppLocker rules will be enforced.

Front 25

What type of AppLocker rules are available to configure in a GPO for Windows 8.1 or Windows Server 2012 R2 computers?

Back 25

packaged app rules, executable rules, Windows Installer rules, and script rules

Front 26

Which firewall profile is applied when a computer is connected to a domain through a public network?

Back 26

Public profile

Front 27

Which Hyper-V features can be accessed by members of the Hyper-V Administrators group?

Back 27

Members of the Hyper-V Administrators have complete and unrestricted access to all features of Hyper-V.

Front 28

What does the Allow setting on a Firewall profile allow?

Back 28

Allows the connection, unless there is a firewall rule that explicitly blocks the connection

Front 29

What parameter of the Import-GPO cmdlet will create the destination GPO if the GPO does not exist?

Back 29

-CreateIfNeeded

Front 30

Which user feature protects the computer from the unauthorized installation of any software?

Back 30

User Account Control (UAC)

Front 31

What PowerShell cmdlet would you use to display the settings that have been enabled in a particular GPO?

Back 31

the Get-GPOReport cmdlet

Front 32

Which type of GPO allows you to create a baseline from which you can build GPOs?

Back 32

A Starter GPO

Front 33

Which user can always change permissions on an object, even when that user is denied all access to the object?

Back 33

The user or group that is the owner of the object

Front 34

How do you copy Windows Firewall with Advanced Security rules from one server to another?

Back 34

In the Windows Firewall with Advanced Security MMC snap-in, click Export Policy to export the rules to a file. On the other server, open the Windows Firewall with Advanced Security MMC snap-in and clickImport Policy.

Front 35

Which firewall profile is applied when a computer is connected to a network in which the computer's domain account resides?

Back 35

Domain profile

Front 36

How do you export AppLocker rules from a GPO in one domain to another GPO in another domain?

Back 36

Export the AppLocker rules from the source GPO to an XML file. Import the XML file with Group Policy Editor on the destination GPO

Front 37

What does the Block setting on a Firewall profile block?

Back 37

Blocks all connections that do not have firewall rules that explicitly allow the connection

Front 38

What are the differences between firewall rules and connection security rules?

Back 38

• Firewall rules allow traffic through, but do not secure that traffic

• Connection security rules can secure the traffic, but only if a firewall rule was previously configured

Front 39

What type of condition would you apply to an AppLocker rule to restrict users from running a specific version number of a program?

Back 39

a file hash rule

Front 40

What type of AppLocker rule would you use to control an application from the Windows store?

Back 40

a packaged app rule

Front 41

How can you copy AppLocker rules to another computer?

Back 41

Export the AppLocker rules from a GPO or local security policy to an XML file, and import the XML file to another GPO or another local security policy

Front 42

To open the Windows Firewall with Advanced Security from the Start screen, what do you type from the Run prompt?

Back 42

wf.msc

Front 43

What is the path to the central store that is used to store and replicate Windows policy files on a domain controller?

Back 43

%logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions

Front 44

Which firewall rules should be configured to allow ping commands to work?

Back 44

the correct echo rules, such as "File and Printer Sharing (Echo Request - ICMPv4-In)"

Front 45

Which ports and protocols should you enable on the Windows Firewall for a Windows Server 2012 R2 acting as a VPN server to allow inbound L2TP connections?

Back 45

UDP port 500 and 4500 as well as IP Protocol ID 50

Front 46

Which firewall profile is applied when a computer is connected to a network in which the computer's domain account does not reside, such as a home network?

Back 46

Private profile

Front 47

Which ports and protocols should you enable on the Windows Firewall for a Windows Server 2012 R2 acting as a VPN server to allow inbound SSTP connections?

Back 47

TCP Port 443

Front 48

What type of condition would you apply to an AppLocker rule to restrict users from running software from a specific software vendor?

Back 48

a publisher rule

Front 49

To specify the Accounts:Rename Administrator account policy to rename the local Administrator account on a computer to a different name, what path in a GPO must you search for the policy?

Back 49

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options

Front 50

What are the two enforcement options that can be set on the enforcement of AppLocker executable rules, Windows Installer rules, script rules, and packaged app rules?

Back 50

Enforce Rules and Audit

Front 51

How does an administrator repair or change permissions on a file in which the administrator has been denied permissions?

Back 51

The administrator should take ownership of the file

Front 52

When editing a Group Policy, which Flexible Single Master Operations (FSMO) role contains the version of the Group Policy that is being edited?

Back 52

PDC emulator

Front 53

What is the term for the folder that is created in the SYSVOL folder of an Active Directory domain controller and is used to provide a centralized storage location for ADMX and ADML files for the domain?

Back 53

central store

Front 54

Which tool do you use to edit a local Group Policy on a computer?

Back 54

you can open and edit a GPO by using the Group Policy Editor

Front 55

If you have multiple local GPOs on a Windows Server 2012 server, in what order are the local GPOs processed?

Back 55

• Local Group PolicyAdministrators and Non-Administrators
  
• Group PolicyUser-specific
  
• Local Group Policy

Front 56

How can domain administrators disable the processing of local GPOs on clients that are running Windows client and Windows Server operating systems?

Back 56

by enabling the Turn Off Local Group Policy Objects Processing policy setting in a domain GPO

Front 57

Which GPO setting manages mapped drives, scheduled tasks, environment variables, printer mappings, and Start menu settings?

Back 57

Preferences