Killtset 70-299题库（DEMO）
认证名称：Implementing and Administering Security in a Microsoft Windows Server 2003 Network考题数目：55
价格：￥ 300
更新：2008-09-01
1.You are a security administrator for your company. The network consists of a single Active Directory domain.
All servers run Windows Server 2003. All client computers run Windows XP Professional.
Eight Windows Server 2003 computers are members of the domain. These computers are used to store confidential files. They reside in a data center that only IT administration personnel have physical access to.
You need to restrict members of a group named Contractors from connecting to the file server computers. Allother employees require access to these computers.
What should you do
A. Apply a security template to the file server computers that assigns the Access this computer from the network right to the Domain Users group.
B. Apply a security template to the file server computers that assigns the Deny access to this computer from the net work right to the Contractors group.
C. Apply a security template to the file server computers that assigns the Allow log on locally right to the Domain Users group.
D. Apply a security template to the file server computers that assigns the Deny log on locally right to the Contractors group.
Answer B
2. You are a security administrator for your company. The network consists of a single Active Directory domain.
Four Windows Server 2003 computers run IIS and serve as Web servers on the Internet.
The company's written security policy states that computers that are accessible from the Internet must be hardened against attacks. The procedure for hardening computers includes disabling unnecessary services. You evaluate which services are necessary by using the following information about the Web servers Customers and business partners access Web content on the Web servers after they authenticate by using a user
name and password. To access certain parts of the site, some of these connections use the SSL protocol.
All software is installed locally on the Web servers by using removable media, except for service packs and security patches.
The Web servers automatically download service packs and security patches from an internal computer that runs Software Update Services (SUS).
The Web servers are not functioning as any other roles.
You need to create a security template for the Web servers that disables unnecessary services and allows necessary services to operate.
What should you do
To answer, drag the appropriate service startup types to the correct locations in the work area.
Answer
3. You are a security administrator for your company. The network consists of a single Active Directory domain.
Servers run either Windows Server 2003 or Windows 2000 Server. All client computers run Windows 2000 Professional. The latest operating system service pack is installed on each computer.
Thirty Windows Server 2003 computers are members of the domain and function as file servers. Client computers access files on these file servers over the network by using the Server Message Block (SMB) protocol. You are concerned about the possible occurrence of man-in-the-middle attacks during SMB communications.
You need to ensure that SMB communications between the Windows Server 2003 file servers and the client computers are cryptographically signed. The file servers must not communicate with client computers if the client computers cannot sign SMB communications. Client computers must be able to use unsigned SMB
communications with all other computers in the domain.
What should you do to configure the file servers
A. Apply a security template that enables the Microsoft network server Digitally sign communications (always) setting.
B. Apply a security template that enables the Microsoft network server Digitally sign communications (if client agrees) setting.
C. Apply a security template that enables the Domain member Digitally sign secure channel data (when possible)setting.
D. Apply a security template that enables the Domain member Digitally encrypt or sign secure channel data(always) setting.
Answer A
4. You are a security administrator for your company. The network consists of two Active Directory domains that are in separate Active Directory forests. No Active Directory trust relationships exist between the domains. All servers run Windows Server 2003. Client computers run either Windows XP Professional or Windows 2000Professional. All domain controllers run Windows Server 2003.
You discover that users in one domain can obtain a list of account names for users in the other domain. This capability allows unauthorized users to guess passwords and to access confidential data.
You need to ensure that account names can be obtained only by users of the domain in which the accounts reside.
Which two actions should you perform on the domain controllers (Each correct answer presents part of the solution. Choose two.)
A. Apply a security template that disables the Network access Allow anonymous SIDName translation setting.
B. Apply a security template that enables the Network access Do not allow anonymous enumeration of SAM accounts setting.
C. Apply a security template that enables the Network security Do not store LAN Manager hash value on next password change setting.
D. Apply a security template that sets the Domain controller LDAP server signing requirements setting to Require signing.
Answer A AND B
5. You are a security administrator for your company. The network consists of a single Active Directory domain.
All servers run Windows Server 2003. All client computers run Windows 2000 Professional. Twenty Windows Server 2003 computers serve as domain controllers. Your organization uses only Active Directory integrated DNS.
The company's written security policy states that computers that contain employee user account names and passwords must be hardened against attacks. The procedure for hardening computers includes disabling unnecessary services. You are evaluating which services are necessary by using the following information about the domain controllers
Domain controllers do not function as Web servers, application servers, file servers, or print servers.
Service packs and security patches are manually installed on domain controllers from local media. Service packs and security patches are installed only by IT administrators.
All servers in the company are remotely managed by using a third-party program.
Printing is not allowed from the domain controllers.
Domain controllers do not run any IP routing protocols.
You need to create a security template to be applied to all domain controllers that disables unnecessary services while allowing necessary services to operate.
What should you do
To answer, drag the appropriate service startup types to the correct locations in the work area.
Answer
6. You are a security administrator for your company. The network consists of a single Active Directory domain.
All servers run Windows Server 2003. All client computers run Windows XP Professional. You manage client computers by using Group Policy.
Some of the administrators in your company are responsible for managing network connectivity and TCPIP.
These administrators are known as infrastructure engineers and are members of a global group named Infra_Engineers. The infrastructure engineers must be able to configure and troubleshoot TCPIP settings on servers and client computers.
You need to configure a Restricted Groups policy that ensures that only infrastructure engineers are members of the Network Configuration Operators local group on all client computers. You want to achieve this goal without granting unnecessary permissions to the infrastructure engineers.
What should you do
To answer, drag the appropriate group or groups to the correct list or lists in the dialog box in the work area.
Answer
7. You are a security administrator for your company. The network consists of a single Active Directory domain.
All servers run Windows Server 2003. All client computers run Windows 2000 Professional.
The company's written security policy states the following requirements
All access to files must be audited.
File servers must be able to record all security events.
You create a new Group Policy object (GPO) and filter it to apply to only file servers. You configure an audit policy to audit files and folders on file servers. You configure a system access control list (SACL) to audit the appropriate files.
You need to ensure that the GPO enforces the written security policy.
Which two additional actions should you perform to configure the GPO (Each correct answer presents part of the solution. Choose two.)
A. Set a manual retention method for the security log.
B. Set the security log to retain entries for 7 days.
C. Set the maximum security log size to the maximum allowed size.
D. Configure the GPO to shut down the computer if it is unable to log security audits.
E. Ensure that users who are responsible for reviewing audit log data are granted the right to manage the securitylog.
Answer D AND A
8. You are a security administrator for your company. The network consists of a single Active Directory domain.
All servers run Windows Server 2003. All client computers run Windows XP Professional.
Administrators in your company use scripts to perform administrative tasks when they troubleshoot problems on client computers. They connect to the Telnet service on client computers when they run these scripts. For security reasons, all Telnet traffic is encrypted by using an IPSec policy. In addition, the Telnet service is configured for manual startup on all client computers. Administrators manually start and stop the Telnet service when they perform administrative tasks.
Administrators report that they sometimes cannot start the Telnet service on client computers. You examine several client computers and discover that the Telnet service is disabled.
You need to ensure that administrators can troubleshoot problems on client computers at all times.
What should you do
A. Use a Restricted Groups policy in a new Group Policy object (GPO) to add the Domain Admins group to the Power Users group on each client computer.
B. Use a Restricted Groups policy in a new Group Policy object (GPO) to ensure that the Power Users group on each client computer contains no members.
C. Use a System Services policy in a new Group Policy object (GPO) to ensure that only Domain Admins can manage the Telnet service.
D. Use an Administrative Template setting to prevent local users from starting the Services snap-in.
Answer C
9. You are a security administrator for your company. The network consists of a single Active Directory domain.
Servers on the network run Windows Server 2003. All servers are in an organizational unit (OU) named Servers,or in Ous contained within the Servers OU.
Based on information in recent security bulletins, you want to apply settings from a security template namedMessenger.inf to all servers on which the Messenger service is started. You do not want to apply these settings to servers on which the Messenger service is not started. You also do not want to move servers to other Ous.
You need to apply the Messenger.inf security template to the appropriate servers.
What should you do
A. Import the Messenger.inf security template into a Group Policy object (GPO), and link the GPO to the Servers OU. Configure Administrative Templates filtering in the GPO.
B. Import the Messenger.inf security template into a Group Policy object (GPO), and link the GPO to the Servers OU. Configure a Windows Management Instrumentation (WMI) Filter for the GPO.
D. Configure a logon script in a Group Policy object (GPO), and link the GPO to the Servers OU. Configure the script to run the gpupdate command if the Messenger service is started.
E. Edit the Messenger.inf security template to set the Messenger service startup mode to Automatic, and then run the secedit refreshpolicy command.
Answer B
10. You are a security administrator for your company. The network consists of a single Active Directory domain.
All domain controllers and servers run Windows Server 2003. All computers are members of the domain.
The domain contains 12 database servers. The database servers are in an organizational unit (OU) named DBServers. The domain controllers and the database servers are in the same Active Directory site.
You receive a security report that requires you to apply a security template named Lockdown.inf to all database servers as quickly as possible. You import Lockdown.inf into a Group Policy object (GPO) that is linked to the DBServers OU.
You need to ensure that the settings in the Lockdown.inf security template are applied to all database servers as quickly as possible.
What should you do
A. On each database server, run the repadmin replicate command.
B. On each database server, run the gpupdate command.
C. On each database server, run the secedit refreshpolicy command.
D. On each database server, open Local Computer Policy, select Security Settings, and then use the Reload command.
E. On each database server, open Resultant Set of Policy, and then use the Refresh Query command.
Answer B
点击下载70-299考试题库预览部分（PDF格式）
页:
[1]