Microsoft Microsoft Certifications 98-367 Questions & Answers

• Question 101:

  What are the main classes of biometric characteristics? Each correct answer represents a complete solution. Choose two.

  A. Psychological

  B. Behavioral

  C. Fundamental

  D. Physiological

  Correct Answer: BD

  Answer: D and B

  A biometric device is used for uniquely recognizing humans based upon one or more intrinsic, physical, or behavioral traits. Biometrics is used as a form of identity access management and access control. It is also used to identify individuals

  in groups that are under surveillance.

  Biometric characteristics can be divided into two main classes:

  1.Physiological: These devices are related to the shape of the body. These are not limited to the fingerprint, face recognition, DNA, hand and palm geometry, and iris recognition, which has largely replaced the retina and odor/scent.

  2.Behavioral: These are related to the behavior of a person. They are not limited to the typing rhythm, gait, and voice.

  Answer: A and C are incorrect. These are not the classes of biometric characteristics.

• Question 102:

  Which of the following actions should be taken so that the computer requires confirmation before installing an ActiveX component?

  A. Configuring a firewall on the network

  B. Configuring the settings on the Web Browser

  C. Installing an anti-virus software

  D. Configuring DMZ on the network

  Correct Answer: B

  Configuring the settings on the Web browser will enable a computer to ask for confirmation before installing an ActiveX component. This will enable users to prevent the download of potentially unsafe controls onto the computer. ActiveX

  controls are software components that can be integrated into Web pages and applications, within a computer or among computers in a network, to reuse the functionality. Reusability of controls reduces development time of applications and

  improves program interfaces.

  They enhance the Web pages with formatting features and animation. ActiveX controls can be used in applications written in different programming languages that recognize Microsoft's Component Object Model (COM). These controls

  always run in a container. ActiveX controls simplify and automate the authoring tasks, display data, and add functionality to Web pages.

  Answer: A and D are incorrect. Configuring a firewall or DMZ will not help in accomplishing the task.

• Question 103:

  Which of the following types of attack is used to configure a computer to behave as another computer on a trusted network by using the IP address or the physical address?

  A. Distributed denial of service (DDOS) attack

  B. Honeypot

  C. RIP/SAP Spoofing

  D. Identity spoofing

  Correct Answer: D

  Identity spoofing (IP address spoofing) will occur when the attacker wants to use an IP address of a network, computer, or network component without being authorized for this task. It allows the unprivileged code to use someone else's identity, and use their security credentials Answer: B is incorrect. A honey pot is a computer that is used to attract potential intruders or attackers. It is for this reason that a honey pot has low security permissions. A honey pot is used to gain information about the intruders and their attack strategies. Answer: C is incorrect. RIP and SAP are used to broadcast network information in a regular way regardless of no changes in the routing or service tables. RIP/SAP spoofing method is used to intercept the SAP and RIP broadcasts by using a spoofing modem/router, and then re-broadcast network information via its own routing table or service table. Answer: A is incorrect. In the distributed denial of service (DDOS) attack, an attacker uses multiple computers throughout the network that it has previously infected. Such computers act as zombies and work together to send out bogus messages, thereby increasing the amount of phony traffic. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track down and shut down. TFN, TRIN00, etc. are tools used for the DDoS attack.

• Question 104:

  You work as a Network Administrator for NetTech Inc. Your computer has the Windows 2000 Server operating system. You want to harden the security of the server. Which of the following changes are required to accomplish this? Each correct answer represents a complete solution. Choose two.

  A. Enable the Guest account.

  B. Rename the Administrator account.

  C. Remove the Administrator account.

  D. Disable the Guest account.

  Correct Answer: BD

  Answer: B and D For security, you will have to rename the Administrator account and disable the Guest account. Renaming the Administrator account will ensure that hackers do not break into the network or computer by guessing the password of the Administrator account. You can also create a fake Administrator account that has no privileges and audit its use to detect attacks. Disabling the Guest account will prevent users who do not have a domain or local user account from illegally accessing the network or computer. By default, the Guest account is disabled on systems running Windows 2000 Server. If the Guest account is enabled, you will have to disable it.

• Question 105:

  Which of the following layers defines the mechanisms that allow data to be passed from one network to another?

  A. Network layer

  B. Session layer

  C. Physical layer

  D. Data-link layer

  Correct Answer: A

  The network layer defines the mechanisms that allow data to be passed from one network to another.

  Answer: B is incorrect. The session layer is responsible for data synchronization between the applications on the sending device and the receiving device. Answer: C is incorrect. The physical layer is the lowest layer of the OSI model. The

  physical layer is responsible for packaging and transmitting data over physical media. This layer controls the way in which data is sent and received over a physical medium.

  Answer: D is incorrect. The data-link layer is responsible for error free transfer of data frames.

• Question 106:

  Which of the following is defined as a digitally signed statement used to authenticate and to secure information on open networks?

  A. Kerberos

  B. Public certificate

  C. Single sign-on (SSO)

  D. SEAL

  Correct Answer: B

  A public certificate is defined as a digitally signed statement used to authenticate and to secure information on open networks Answer: C is incorrect. Single sign-on (SSO) is defined as a mechanism in which a single action of user authentication and authorization is used to allow a user to access all computers and systems where he got a access permission, without entering passwords for multiple times. Answer: A is incorrect. Kerberos is defined as a secure method used for authenticating a request for a service in a computer network. Answer: D is incorrect. SEAL is an alternative encryption algorithm to software- based DES, 3DES, and AES. It uses a 160-bit encryption key. SEAL provides less impact to the CPU than other software- based encryption algorithms. In Cisco IOS IPSec implementations, SEAL supports the SEAL algorithm. It can be configured through the command-line interface using the crypto ipsec transform-set command and the esp-seal transform option.

• Question 107:

  You work as a Network Administrator for TechMart Inc. The company has a Windows-based network. After completing a security audit of the company's Microsoft Windows Server 2008 R2 file servers, you have determined that folder and share security requires a revision on the basis of corporate reorganization. You have noticed that some shares on the file system are not secured. Which of the following will you use to prevent unauthorized changes to computers on the domain?

  A. TCP/IP protocol

  B. Kerberos

  C. User Account Control (UAC)

  D. Lightweight Directory Access Protocol

  Correct Answer: C

  User Account Control (UAC) is used to prevent unauthorized changes to computers on the domain Answer: B is incorrect. Kerberos is defined as a secure method used for authenticating a request for a service in a computer network. Answer: D is incorrect. The Lightweight Directory Access Protocol (LDAP) is defined as a directory service protocol that is used to provide a mechanism used to connect to, search, and modify Internet directories. Answer: A is incorrect. TCP/IP protocol is used to define the rule computers are required to follow for communicating with each other over the internet.

• Question 108:

  Which of the following can be installed for ensuring that the domain is secure in the remote locations?

  A. Read-Only domain controller (RODC)

  B. Microsoft Baseline Security Analyzer

  C. Windows Software Update Services

  D. DNS dynamic update

  Correct Answer: A

  Read-only Domain Controller (RODC) is a domain controller that hosts the read-only partition of the Active Directory database. RODC was developed by Microsoft typically to be deployed in a branch office environment. RODC is a good option to enhance security by placing it in a location where physical security is poor. RODC can also be placed at locations having relatively few users and a poor network bandwidth to the main site. As only the read-only partition of the Active Directory database is hosted by RODC, a little local IT knowledge is required to maintain it. Answer: C is incorrect. Windows Server Update Services (WSUS) is an add- on component of Windows Server 2008. It provides functionality to a server to run as a Windows Update server in a Windows network environment. Administrators can configure a WSUS server as the only server to download updates from Windows site, and configure other computers on the network to use the server as the source of update files. This will save lots of bandwidth as each computer will not download updates individually. WSUS 3.0 SP1 is the only version of WSUS that can be installed on Windows Server 2008. Earlier versions of WSUS cannot be installed on a server running Windows Server 2008. Answer: D is incorrect. DNS dynamic update is used to enable DNS client computers for registering and dynamically updating their resource records with a DNS server whenever any modification or change has been taken place. It is used to update the DNS client computers with the reflecting changes. Answer: B is incorrect. Microsoft Baseline Security Analyzer (MBSA) is a software tool of Microsoft to determine security state by assessing missing security updates and less-secure security settings within Microsoft Windows, Windows components such as Internet Explorer, IIS web server, and products Microsoft SQL Server, and Microsoft Office macro settings. Microsoft Baseline Security Analyzer (MBSA) includes a graphical and command line interface that can perform local or remote scans of Windows systems.

• Question 109:

  Which of the following is a secret numeric password shared between a user and a system for authenticating the user to the system?

  A. Key escrow

  B. Public key

  C. Private key

  D. PIN

  Correct Answer: D

  A personal identification number (PIN) is a secret numeric password shared between a user and a system for authenticating the user to the system. Answer: A is incorrect. Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. These third parties may include businesses, who may want access to employees' private communications, or governments, who may wish to be able to view the contents of encrypted communications. Answer: C is incorrect. In cryptography, a private or secret key is an encryption/decryption key known only to the party or parties that exchange secret messages. In traditional secret key cryptography, a key would be shared by the communicators so that each could encrypt and decrypt messages. Answer: B is incorrect. A Public Key is known commonly to everybody. It is used to encrypt data. Only specific users can decrypt it. Data encryption is used to encrypt data so that it can only be decrypted with the corresponding private key owned by the public key owner. The public key is also used to verify digital signatures. This signature is created by the associated private key.

• Question 110:

  Which of the following viruses cannot be detected by signature-based antivirus?

  A. Macro virus

  B. Boot sector virus

  C. MBR virus

  D. Polymorphic virus

  Correct Answer: D

  A polymorphic virus has the ability to change its own signature at the time of infection. This virus is very complicated and hard to detect. When the user runs the infected file in the disk, it loads the virus into the RAM. The new virus starts making its own copies and infects other files of the operating system. The mutation engine of the polymorphic virus generates a new encrypted code, thus changing the signature of the virus. Therefore, polymorphic viruses cannot be detected by signature-based antivirus. Answer: A is incorrect. A macro virus is a virus that consists of a macro code which infects the system. A Macro virus can infect a system rapidly. Since this virus has VB event handlers, it is dynamic in nature and displays random activation. The victim has only to open a file having a macro virus in order to infect the system with the virus. DMV, Nuclear, and Word Concept are some good examples of macro viruses. Answer: C is incorrect. A Master boot record (MBR) virus replaces the boot sector data with its own malicious code. Every time when the computer starts up, the boot sector virus executes. It can then generate activity that is either annoying (system will play sounds at certain times) or destructive (erase the hard drive of the system). Because the code in the Master Boot Record executes before any operating system is started, no operating system can detect or recover from corruption of the Master Boot Record. Answer: B is incorrect. A boot sector virus infects the master boot files of the hard disk or floppy disk. Boot record programs are responsible for booting the operating system and the boot sector virus copies these programs into another part of the hard disk or overwrites these files. Therefore, when the floppy or the hard disk boots, the virus infects the computer.