You are the network administrator for your company. The network consists of a single Active Directory domain. The network contains 50 application servers that run Windows Server 2003.
The security configuration of the application servers is not uniform. The application servers were deployed by local administrators who configured the settings for each of the application servers differently based on their knowledge and skills. The application servers are configured with different authentication methods， audit settings， and account policy settings.
The security team recently completed a new network security design. The design includes a baseline configuration for security settings on all servers. The baseline security settings use the Hisecws.inf predefined security template. The design also requires modified settings for servers in an application role. These settings include system service startup requirements， renaming the administrator account， and more stringent account lockout policies. The security team created a security template named Application.inf that contains the modified settings.
You need to plan the deployment of the new security design. You need to ensure that all security settings for the application servers are standardized， and that after the deployment， the security settings on all application servers meet the design requirements.
What should you do？ （）
A. Apply the Setup security.inf template first， the Hisecws.inf template next， and then the Application.inf template.
B. Apply the Application.inf template and then the Hisecws.inf template.
C. Apply the Application.inf template first， the Setup security.inf template next， and then the Hisecws.inf template.
D. Apply the Setup security.inf template and then the Application.inf template.
您可能感兴趣的试卷
你可能感兴趣的试题
You are the network administrator for your company. The network consists of a single Active Directory domain. All domain controllers run Windows Server 2003. All client computers run Windows XP Professional.
The company has legacy applications that run on UNIX servers. The legacy applications use the LDAP protocol to query Active Directory for employee information.
The domain controllers are currently configured with the default security settings. You need to configure enhanced security for the domain controllers. In particular， you want to configure stronger password settings， audit settings， and lockout settings. You want to minimize interference with the proper functioning of the legacy applications.
You decide to use the predefined security templates. You need to choose the appropriate predefined security template to apply to the domain controllers.
What should you do？（）
A. Apply the Setup security.inf template to the domain controllers.
B. Apply the DC security.inf template to the domain controllers.
C. Apply the Securedc.inf template to the domain controllers.
D. Apply the Rootsec.inf template to the domain controllers.
You are the network administrator for your company. The network consists of a single Active Directory domain. The company’s written security policy requires that computers in a file server role must have a minimum file size for event log settings. In the past， logged events were lost because the size of the event log files was too small. You want to ensure that the event log files are large enough to hold history. You also want the security event log to be cleared manually to ensure that no security information is lost. The application log must clear events as needed.
You create a security template named Fileserver.inf to meet the requirements. You need to test each file server and take the appropriate corrective action if needed. You audit a file server by using Fileserver.inf and receive the results shown in the exhibit. （Click the Exhibit button.）
You want to make only the changes that are required to meet the requirements.
Which two actions should you take？ （）
A. Correct the Maximum application log size setting on the file server.
B. Correct the Maximum security log size setting on the file server.
C. Correct the Maximum system log size setting on the file server.
D. Correct the Retention method for application log setting on the file server.
E. Correct the Retention method for security log setting on the file server.
F. Correct the Retention method for system log setting for the file server.
You are the network administrator for your company. The network consists of a single Active Directory domain. The functional level of the domain is Windows Server 2003. The domain contains an organizational unit （OU） named Servers that contains all of the company’s Windows Server 2003 resource servers. The domain also contains an OU named Workstations that contains all of the company’s Windows XP Professional client computers.
You configure a baseline security template for resource servers named Server.inf and a baseline security template for client computers named Workstation.inf. The Server.inf template contains hundreds of settings， including file and registry permission settings that have inheritance propagation enabled. The Workstation.inf template contains 20 security settings， none of which contain file or registry permissions settings.
The resource servers operate at near capacity during business hours.
You need to apply the baseline security templates so that the settings will be periodically enforced. You need to accomplish this task by using the minimum amount of administrative effort and while minimizing the performance impact on the resource servers.
What should you do？ （）
A. Create a Group Policy object （GPO） and link it to the domain. Import both the Server.inf and the Workstation.inf templates into the GPO.
B. Import both the Server.inf and the Workstation.inf templates into the Default Domain Policy Group Policy object （GPO）.
C. On each resource server， create a weekly scheduled task to apply the Server.inf settings during off-peak hours by using the secedit command. Create a Group Policy object （GPO） and link it to the Workstations OU. Import the Workstation.inf template into the GPO.
D. On each resource server， create a weekly scheduled task to apply the Server.inf settings during off-peak hours by using the secedit command. Import the Workstation.inf template into the Default Domain Policy Group Policy object （GPO）.
You are a network administrator for your company. The network consists of a single Active Directory domain. The network contains 80 Web servers that run Windows 2000 Server. The IIS Lockdown Wizard is run on all Web servers as they are deployed.
Your company is planning to upgrade its Web servers to Windows Server 2003. You move all Web servers into an organizational unit （OU） named Web Servers.
You are planning a baseline security configuration for the Web servers. The company’s written security policy states that all unnecessary services must be disabled on servers. Testing shows that the server upgrade process leaves the following unnecessary services enabled：
Your plan for the baseline security configuration for Web servers must comply with the written security policy. You need to ensure that unnecessary services are always disabled on the Web servers.
What should you do？ （）
A. Create a Group Policy object （GPO） to apply a logon script that disables the unnecessary services. Link the GPO to the Web Servers OU.
B. Create a Group Policy object （GPO） and import the Hisecws.inf security template. Link the GPO to the Web Servers OU.
C. Create a Group Policy object （GPO） to set the startup type of the unnecessary services to Disabled. Link the GPO to the Web Servers OU.
D. Create a Group Policy object （GPO） to apply a startup script to stop the unnecessary services. Link the GPO to the Web Servers OU.
You are a network administrator for Alpine Ski House. The network consists of a single Active Directory domain. The network contains 50 Windows Server 2003 computers and 200 Windows XP Professional computers. Alpine Ski House does not use wireless networking. The network at Alpine Ski House is shown in the exhibit. （Click the Exhibit button.） Alpine Ski House enters into a strategic partnership with Adventure Works. Under the strategic partnership， Adventure Works will regularly send employees to Alpine Ski House. Your design team interviews Adventure Works administrators and discovers the following. Adventure Works employees require access to the Internet to retrieve e-mail messages and to browse the Internet. Adventure Works employees do not need access to the internal network at Alpine Ski House. Adventure Works employees all have portable computers that run Windows XP Professional， and they use a wireless network in their home office. The wireless network client computers of Adventure Works employees must be protected from Internet-based attacks.Adventure Works sends you a wireless access point that its employees will use to access the Internet through your network. You are not allowed to change the configuration of the wireless access point because any change will require changes to all of the wireless client computers. You need to develop a plan that will meet the requirements of Adventure Works employees and the security requirements of Alpine Ski House.
Your solution must be secure and must minimize administrative effort.
What should you do？ （）
A. Install the wireless access point on a separate subnet inside the Alpine Ski House network. Configure a router to allow only HTTP， IMAP4， and SMTP traffic out of the wireless network.
B. Install the wireless access point on a separate subnet inside the Alpine Ski House network. Configure a VPN from the wireless network to the Adventure Works office network.
C. Install the wireless access point on the Alpine Ski House perimeter network. Configure Firewall1 to allow wireless network traffic to and from the Internet. Configure Firewall2 to not allow wireless traffic into the Alpine Ski House network.
D. Install the wireless access point outside Firewall1 at Alpine Ski House. Obtain IP addresses from your ISP to support all wireless users.
Your company has an Active Directory directory service domain. All servers run Windows Server 2003. All domain controllers are configured to audit specific events. You are developing a security monitoring plan for the domain controllers. You must back up the following information. Local logon attemptsDomain logon attemptsSecurity update installation attempts You need to specify the appropriate log files to back up.
Which files should you specify？ （）
A. AppEvent.Evt and NTDS.Evt
B. NTDS.Evt and SecEvent.Evt
C. SecEvent.Evt and SysEvent.Evt
D. AppEvent.Evt and SysEvent.Evt
Your company has 250 client computers connected to the office LAN. The company has a pool of five public IP addresses. All client computers have dynamically assigned IP addresses. You need to provide all client computers with Internet access.
What should you use？（）
A. DHCP Relay Agent
B. Routing Information Protocol （RIP）
C. Internet Group Management Protocol （IGMP）
D. Network Address Translation （NAT）/Basic Firewall
All servers in your environment run Windows Server 2003. Your companys network includes multiple network segments and multiple routers. A member server that has the Routing and Remote Access service （RRAS） installed provides Internet connectivity for all client computers. The RRAS server is located in a perimeter network （also known as DMZ）. A client computer named Client1 is unable to connect to the Internet. The RRAS server is able to connect to the Internet. You need to pinpoint the location of the network issue.
What should you do？（）
A. Use the nbtstat command-line tool on Client1.
B. Use the pathping command-line tool on Client1.
C. Run the nbtstat -r command on the RRAS server.
D. Run the ping -a Client1 command on the RRAS server.
All servers and client computers in your company are configured to use WINS for name resolution. The internal network is separated from a perimeter network （also known as DMZ） by a third-party firewall. Firewall rules do not allow name resolution between the internal network and the perimeter network. You move a Windows Server 2003 server named Server1 to the perimeter network. You need to ensure that all computers on the internal network can connect to Server1 by name.
What should you do？（）
A. Create an LMHOSTS file on Server1.
B. Create a static WINS entry for Server1.
C. Configure Server1 to use Broadcast （B-node） mode.
D. Configure Server1 to use Peer-to-Peer （P-node） mode.
Your company has an Active Directory directory service domain. The domain functional level is Windows Server 2003. The company has a main office with two domain controllers （DCs）. Users log on to client computers by using user principal names （UPNs）. You plan to set up a new branch office with one domain controller. You need to ensure that when the branch office domain controllers connection to the main office is unavailable， users in the branch office can log on to the domain.
What should you do？（）
A. Add a new domain controller in the branch office.
B. Configure the branch office domain controller as a global catalog server.
C. Transfer the RID Master role to the branch office domain controller.
D. Transfer the Infrastructure Master role to the branch office domain controller.
最新试题
You are the network administrator for Contoso Pharmaceuticals. The network consists of a single Active Directory forest. The forest contains Windows Server 2003 servers and Windows XP Professional computers. The forest consists of a forest root domain named contoso.com and two child domains named child1.contoso.com and child2.contoso.com. The child1.contoso.com domain contains a member server named Server1. You configure Server1 to be an enterprise certification authority （CA）， and you configure a user certificate template. You enable the Publish certificate in Active Directory setting in the certificate template. You instruct users in both the child1.contoso.com and the child2.contoso.com domains to enroll for user certificates. You discover that the certificates for user accounts in the child1.contoso.com domain are being published to Active Directory， but the certificates for user accounts in the child2.contoso.com domain are not. You want certificates issued by Server1 to child2.contoso.com domain user accounts to be published in Active Directory. What should you do？ （）
You are a network administrator for your company. The network contains a Windows Server 2003 computer named Server1. Server1 has a single CPU， 512 MB of RAM， and a single 100-Mb network adapter. All network users’ home folders are stored on Server1. Users access their home folders by using a mapped network drive that connects to a shared folder on Server1. After several weeks， users report that accessing home folders on Server1 is extremely slow at certain times during the day. You need to identify the resource bottleneck that is causing the poor performance. What should you do？ （）
You are the network administrator for Tailspin Toys. The company has a main office and two branch offices. The network in the main office contains 10 servers and 100 client computers. Each branch office contains 5 servers and 50 client computers. Each branch office is connected to the main office by a direct T1 line. The network design requires that company IP addresses must be assigned from a single classful private IP address range. The network is assigned a class C private IP address range to allocate IP addresses for servers and client computers. Tailspin Toys acquires a company named Wingtip Toys. The acquisition will increase the number of servers to 20 and the number of client computers to 200 in the main office. The acquisition is expected to increase the number of servers to 20 and the number of client computers to 200 in the branch offices. The acquisition will also add 10 more branch offices. After the acquisition， all branch offices will be the same size. Each branch office will be connected to the main office by a direct T1 line. The new company will follow the Tailspin Toys network design requirements. You need to plan the IP addressing for the new company. You need to comply with the network design requirement. What should you do？ （）
You are a network administrator for your company. The company has a main office and two branch offices. The branch offices are connected to the main office by T1 lines. The network consists of three Active Directory sites， one for each office. All client computers run either Windows 2000 Professional or Windows XP Professional. Each office has a small data center that contains domain controllers， WINS， DNS， and DHCP servers， all running Windows Server 2003. Users in all offices connect to a file server in the main office to retrieve critical files. The network team reports that the WAN connections are severely congested during peak business hours. Users report poor file server performance during peak business hours. The design team is concerned that the file server is a single point of failure. The design team requests a plan to alleviate the WAN congestion during business hours and to provide high availability for the file server. You need to provide a solution that improves file server performance during peak hours and that provides high availability for file services. You need to minimize bandwidth utilization. What should you do？ （）
You are the network administrator for your company. The network consists of a single Active Directory domain. All computers on the network are members of the domain. The domain contains a Windows Server 2003 computer named Server1. You are planning a public key infrastructure （PKI） for the company. You want to deploy a certification authority （CA） on Server1. You create a new global security group named Cert Administrators. You need to delegate the tasks to issue， approve， and revoke certificates to members of the Cert Administrators group. What should you do？（）
You are a network administrator for your company. The network consists of a single Active Directory domain and contains 10 Windows Server 2003 computers. You install a new service on a server named Server1. The new service requires that you restart Server1. When you attempt to restart Server1， the logon screen does not appear. You turn off and then turn on the power for Server1. The logon screen does not appear. You attempt to recover the failed server by using the Last Known Good Configuration startup option. It is unsuccessful. You attempt to recover Server1 by using the Safe Mode startup options. All Safe Mode options are unsuccessful. You restore Server1. Server1 restarts successfully. You discover that Server1 failed because the new service is not compatible with a security patch. You want to configure all servers so that you can recover from this type of failure by using the minimum amount of time and by minimizing data loss. You need to ensure that in the future， other services that fail do not result in the same type of failure. What should you do？ （）
You are a network administrator for your company. The network contains a perimeter network. The perimeter network contains four Windows Server 2003， Web Edition computers that are configured as a Network Load Balancing cluster. The cluster hosts an e-commerce Web site that must be available 24 hours per day. The cluster is located in a physically secure data center and uses an Internet-addressable virtual IP address. All servers in the cluster are configured with the Hisecws.inf template. You need to implement protective measures against the cluster’s most significant security vulnerability. What should you do？ （）
You are a network administrator for your company. The company has a main office and one branch office. The network consists of a single Active Directory domain. All servers run Windows Server 2003. The company needs to connect the main office network and the branch office network by using Routing and Remote Access servers at each office. The networks will be connected by a VPN connection over the Internet. The company’s written security policy includes the following requirements for VPN connections over the Internet： All data must be encrypted with end-to-end encryption. VPN connection authentication must be at the computer level. Credential information must not be transmitted over the Internet as part of the authentication process. You need to configure security for VPN connection between the main office and the branch office. You need to comply with the written security policy. What should you do？ （）
You are the systems engineer for your company. The company has a main office in Los Angeles and two branch offices， one in Chicago and one in New York. The offices are connected to one another by dedicated T1 lines. Each office has its own local IT department and administrative staff. The company network consists of a single Active Directory domain. All servers run Windows Server 2003. All client computers run Windows XP Professional. All servers support firmware-based console redirection by means of the serial port. The server hardware does not support any other method of console redirection and cannot be upgraded to do so. The company is currently being reorganized. The IT departments from each branch office are being relocated to a new central data center in the Los Angeles office. Several servers from each branch office are also being relocated to the Los Angeles data center. Each branch office will retain 10 servers. A new written security policy includes the following requirements： • All servers must be remotely administered for all administrative tasks. • All servers must be administered from the Los Angeles office. • All remote administration connections must be authenticated and encrypted. Your current network configuration already adheres to the new written security policy for day-to-day server administration tasks performed on the servers. You need to plan a configuration for out-of-band management tasks for each office that meets the new security requirements. Which three actions should you take？（）
You are a network administrator for Alpine Ski House. The internal network has an Active Directory-integrated zone for the alpineskihouse.org domain. Computers on the internal network use the Active Directory-integrated DNS service for all host name resolution. The Alpine Ski House Web site and DNS server are hosted at a local ISP. The public Web site for Alpine Ski House is accessed at www.alpineskihouse.com. The DNS server at the ISP hosts the alpineskihouse.com domain. To improve support for the Web site， your company wants to move the Web site and DNS service from the ISP to the company’s perimeter network. The DNS server on the perimeter network must contain only the host （A） resource records for computers on the perimeter network. You install a Windows Server 2003 computer on the perimeter network to host the DNS service for the alpineskihouse.com domain. You need to ensure that the computers on the internal network can properly resolve host names for all internal resources， all perimeter resources， and all Internet resources. Which two actions should you take？ （）