You are a network administrator for your company. The network contains a perimeter network. The perimeter network contains four Windows Server 2003， Web Edition computers that are configured as a Network Load Balancing cluster.  
The cluster hosts an e-commerce Web site that must be available 24 hours per day. The cluster is located in a physically secure data center and uses an Internet-addressable virtual IP address. All servers in the cluster are configured with the Hisecws.inf template.  
You need to implement protective measures against the cluster’s most significant security vulnerability. 
 What should you do？  （）

You are the network administrator for your company. The network contains a single Active Directory domain. All computers on the network are members of the domain. All domain controllers run Windows Server 2003.  
You are planning a public key infrastructure （PKI）. The PKI design documents for your company specify that certificates that users request to encrypt files must have a validity period of two years.  
The validity period of a Basic EFS certificate is one year. In the Certificates Templates console， you attempt to change the validity period for the Basic EFS certificate template. However， the console does not allow you to change the value.  You need to ensure that you can change the value of the validity period of the certificate that users request to encrypt files.
What should you do？  （）

You are the network administrator for your company. The network consists of a single Active Directory domain. All computers on the network are members of the domain. The domain contains a Windows Server 2003 computer named Server1.  
You are planning a public key infrastructure （PKI） for the company. You want to deploy a certification authority （CA） on Server1.  
You create a new global security group named Cert Administrators. You need to delegate the tasks to issue， approve， and revoke certificates to members of the Cert Administrators group.  
What should you do？（）

You are the network administrator for Contoso Pharmaceuticals. The network consists of a single Active Directory forest. The forest contains Windows Server 2003 servers and Windows XP Professional computers.  
The forest consists of a forest root domain named contoso.com and two child domains named child1.contoso.com and child2.contoso.com. The child1.contoso.com domain contains a member server named Server1. You configure Server1 to be an enterprise certification authority （CA）， and you configure a user certificate template. You enable the Publish certificate in Active Directory setting in the certificate template. You instruct users in both the child1.contoso.com and the child2.contoso.com domains to enroll for user certificates.  
You discover that the certificates for user accounts in the child1.contoso.com domain are being published to Active Directory， but the certificates for user accounts in the child2.contoso.com domain are not.  
You want certificates issued by Server1 to child2.contoso.com domain user accounts to be published in Active Directory.  
What should you do？ （）

You are a network administrator for your company. The network consists of two Active Directory domains. You are responsible for administering one domain， which contains users who work in the sales department. User objects for the users in the sales department are stored in an organizational unit （OU） named Sales in your domain.  
Users in the sales department use a public key infrastructure （PKI） enabled application that requires users to present client authentication certificates before they are granted access. You install Certificate Services on two member servers 
running Windows Server 2003. You configure one server as an enterprise subordinate certification authority （CA） and the other server as a stand-alone root CA.  
You need to issue certificates that support client authentication to sales users only. You need to achieve this goal by using the minimum amount of administrative effort.  
What should you do？  （）

You are the network administrator for your company. The network consists of a single Active Directory domain.  The domain contains a Windows Server 2003 computer named Server1 that is located in an organizational unit （OU） named Servers. Server1 contains confidential data， and all network communications with Server1 must be encrypted by using IPSec.  
The default Client （Respond Only） IPSec policy is enabled in the Default Domain Policy Group Policy object （GPO）. You create a new GPO and link it to the Servers OU. You configure the new GPO by creating and enabling a custom IPSec policy. You monitor and discover that network communications with Server1 are not being encrypted.  You need to view all IPSec policies that are being applied to Server1. 
 What should you do？  （）

You are the systems engineer for your company. The company has a main office in Los Angeles and two branch offices， one in Chicago and one in New York. The offices are connected to one another by dedicated T1 lines. Each office has its own local IT department and administrative staff.  
The company network consists of a single Active Directory domain. All servers run Windows Server 2003. All client computers run Windows XP Professional. All servers support firmware-based console redirection by means of the serial port. The server hardware does not support any other method of console redirection and cannot be upgraded to do so.  The company is currently being reorganized. The IT departments from each branch office are being relocated to a new central data center in the Los Angeles office. Several servers from each branch office are also being relocated to the Los Angeles data center. Each branch office will retain 10 servers.
 A new written security policy includes the following requirements：  
• All servers must be remotely administered for all administrative tasks.  
• All servers must be administered from the Los Angeles office.  
• All remote administration connections must be authenticated and encrypted.  
Your current network configuration already adheres to the new written security policy for day-to-day server administration tasks performed on the servers. You need to plan a configuration for out-of-band management tasks for each office that meets the new security requirements.  
Which three actions should you take？（）

You are the systems engineer for your company. The network consists of a single Active Directory domain. The company has a main office and two branch offices. All servers run Windows Server 2003. All client computers run either Windows XP Professional or Windows 2000 Professional.  
Each branch office maintains a dedicated 256-Kbps connection to the main office. Each office also maintains a T1 connection to the Internet. Each office has a Microsoft Internet Security and Acceleration （ISA） Server 2000 computer， which provides firewall and proxy services on the Internet connection. Each branch office contains one domain controller and five servers that are not domain controllers. There is minimal administrative staff at the branch offices.  A new company policy states that all servers must now be remotely administered by administrators in the main office. The policy states that all remote administration connections must be authenticated by the domain and that all traffic must be encrypted. The policy also states that the remote administration traffic must never be carried in clear text across the Internet.  
You choose to implement remote administration by enabling Remote Desktop connections on all servers on the network. You decide to use the Internet-connected T1 lines for remote administration connectivity between offices.  
Because administrative tasks might require simultaneous connections to multiple servers across the network， you need to ensure that administrators do not lose connections to servers in one office when they attempt to connect to servers in another office. 
 What should you do？ （）

You are the systems engineer for your company. The network consists of three physical networks connected by hardware-based routers. The network consists of a single Active Directory domain. All servers run Windows Server 2003. All client computers run Windows XP Professional.  
Each physical network contains at least one domain controller and at least one DNS server. One physical network contains a Microsoft Internet Security and Acceleration （ISA） Server array that provides Internet access for the entire company. The network also contains a certificate server.  
Company management wants to ensure that all data is encrypted on the network and that all computers transmitting data on the network are authenticated.  
You decide to implement IPSec on all computers on the network. You edit the Default Domain Policy Group Policy object （GPO） to apply the Secure Server （Require Security） IPSec policy.  
Users immediately report that they cannot access resources located in remote networks. You investigate and discover that all packets are being dropped by the routers. You also discover that Active Directory replication is not functioning between domain controllers in different networks.  
You need to revise your design and implementation to allow computers to communicate across the entire network. You also need to ensure that the authentication keys are stored encrypted.  
Which two actions should you take？（）

You are the senior systems engineer for your company. The network consists of a single Active Directory domain. 
All servers run Windows Server 2003. Client computers in the sales department run Windows NT Workstation 4.0 with the Active Directory Client Extensions software installed. All other client computers run Windows XP Professional. All servers are located in an organizational unit （OU） named Servers. All client computers are located in an OU named Desktops.  
Four servers contain confidential company information that is used by users in either the finance department or the research department. Users in the sales department also store files and applications on these servers. The company’s written security policy states that for auditing purposes， all network connections to these resources must require authentication at the protocol level. The written security policy also states that all network connections to these resources must be encrypted. The company budget does not allow for the purchase of any new hardware or software. The applications and data located on these servers may not be moved to any other server in the network.  
You define and assign the appropriate permissions to ensure that only authorized users can access the resources on the servers.  
You now need to ensure that all connections made to these servers by the users in the finance department and in the research department meet the security guidelines stated by the written security policy. You also need to ensure that all users in the sales department can continue to access their resources.  
Which two actions should you take？（）