Microsoft Microsoft Certifications 98-367 Questions & Answers

• Question 121:

  You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008 network environment. The network is configured as a Windows Active Directory-based single forest single domain network. You want to configure Network Access Protection (NAP) on your network. You want that the clients connecting to the network must contain certain configurations. Which of the following Windows components ensure that only clients having certain health benchmarks access the network resources? Each correct answer represents a part of the solution. Choose two.

  A. Windows Firewall

  B. System Health Agents (SHA)

  C. Terminal Service

  D. System Health Validators (SHV)

  E. TS Gateway

  Correct Answer: BD

  Answer: B and D The System Health Agents (SHA) and System Health Validators (SHV) are the components of Windows Server 2008 to validate a computer's health against a configured set of security benchmarks. These components are parts of Network Access Protection deployed on a network. The SHV component specifies which benchmarks the client must meet. The SHA component specifies configuration against those benchmarks that are being tested. They ensure that computers accessing resources on the network meet certain client health benchmarks. Answer: A is incorrect. Windows firewall is used to prevent network from unauthorized access. It can be one of the benchmarks configured for health checkup. Answer: E and C are incorrect. TS Gateway and Terminal Service are not used to enforce configurations specified in the

• Question 122:

  Which of the following is a technique used to attack an Ethernet wired or wireless network?

  A. ARP poisoning

  B. DNS poisoning

  C. Mail bombing

  D. Keystroke logging

  Correct Answer: A

  Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether. The attack can only be used on networks that actually make use of ARP and not another method of address resolution. The principle of ARP spoofing is to send fake ARP messages to an Ethernet LAN. Generally, the aim is to associate the attacker's MAC address with the IP address of another node (such as the default gateway). Any traffic meant for that IP address would be mistakenly sent to the attacker instead. The attacker could then choose to forward the traffic to the actual default gateway (passive sniffing) or modify the data before forwarding it. ARP spoofing attacks can be run from a compromised host, or from an attacker's machine that is connected directly to the target Ethernet segment. Answer: C is incorrect. Mail bombing is an attack that is used to overwhelm mail servers and clients by sending a large number of unwanted e-mails. The aim of this type of attack is to completely fill the recipient's hard disk with immense, useless files, causing at best irritation, and at worst total computer failure. E-mail filtering and properly configuring email relay functionality on mail servers can be helpful for protection against this type of attack. Answer: B is incorrect. DNS poisoning is the process in which a DNS server may return an incorrect IP address, diverting traffic to another computer. Answer: D is incorrect. Keystroke logging is a method of logging and recording user keystrokes. It can be performed with software or hardware devices. Keystroke logging devices can record everything a person types using his keyboard, such as to measure employee's productivity on certain clerical tasks. These types of devices can also be used to get usernames, passwords, etc.

• Question 123:

  Which of the following are types of password policies of Windows 7? Each correct answer represents a complete solution. Choose all that apply.

  A. Store Password Using Reversible Encryption

  B. Minimum Password Length

  C. User Name Length

  D. Password Must Meet Complexity Requirements

  Correct Answer: ABD

  Answer: B, A, and D Password policies are account policies that are related to user accounts. These policies increase the effectiveness of users' passwords by enforcing different types of controls on their usage. In Windows 7, there are following six types of password policies that can be configured by administrators: Enforce Password History Maximum Password Age Minimum Password Age Minimum Password Length Password Must Meet Complexity Requirements Store Password Using Reversible Encryption These options are disabled by default. However, an administrator can enable any option in the Local Security Settings tool, which can be accessed from the Administrative tools window found under Control Panel. Answer: C is incorrect. User name length does not come under password policies.

• Question 124:

  Which of the following can be installed and configured to prevent suspicious emails from entering the user's network?

  A. Kerberos

  B. Single sign-on (SSO)

  C. TCP/IP protocol

  D. Microsoft Forefront and Threat Management Gateway

  Correct Answer: D

  To prevent suspicious emails from entering the network, it is required to install Microsoft Forefront and Threat Management Gateway and configure it so that it can block any malicious emails. Exchange server has many spam filtering tools

  but Forefront and TMG are additional security measures used for enhancing the protection of the system.

  Answer: B is incorrect. Single sign-on (SSO) is defined as a mechanism in which a single action of user authentication and authorization is used to allow a user to access all computers and systems where he got a access permission, without

  entering passwords for multiple times.

  Answer: A is incorrect. Kerberos is defined as a secure method used for authenticating a request for a service in a computer network. Answer: C is incorrect. TCP/IP protocol is used to define the rule computers are required to follow for

  communicating with each other over the internet.

• Question 125:

  The stronger password is a critical element in the security plan. Which of the following are the characteristics used to make up a strong password?

  A. It contains more than seven hundred characters and does not contain the user name, real name, or any name that can be guessed by the attacker easily.

  B. It contains more than seven characters and does not contain the user name, real name, or anyname that can be guessed by the attacker easily.

  C. It contains the user name, real name, or any name that can be remembered easily and does not contain more than seven characters.

  D. It contains more than seven characters and the user name, real name, or any name.

  Correct Answer: B

  A strong password contains more than seven characters and does not contain the user name, real name, or any name that can be guessed by the attacker easily.

• Question 126:

  Which of following is required to be configured to ensure that the Bitlocker storage can be reclaimed?

  A. BitLocker to use data recovery agents

  B. BitLocker to use the password screen saver

  C. BitLocker to use the Secret Retrieval Agent

  D. BitLocker to use the Artificial Intelligence recovery option.

  Correct Answer: A

  BitLocker to use data recovery agents is created and properly stored to ensure that the secured data can be reclaimed when the Bitlocker protected storage is shifted to another computer.

• Question 127:

  Which of the following are the major components of the IPsec protocol? Each correct answer represents a complete solution. Choose all that apply.

  A. Encapsulating Security Payload (ESP)

  B. Authentication Header (AH)

  C. Internet Encryption Key (IEK)

  D. Internet Key Exchange (IKE)

  Correct Answer: ABD

  Answer: B, A, and D

  The IPsec protocol has three major components:

  1.Authentication Header (AH)

  2.Encapsulating Security Payload (ESP)

  3.Internet Key Exchange (IKE)

  Answer: C is incorrect. There is no such component of the IPSec protocol as Internet Encryption Key.

• Question 128:

  Which of the following states that a user should never be given more privileges than are required to carry out a task?

  A. Security through obscurity

  B. Segregation of duties

  C. Principle of least privilege

  D. Role-based security

  Correct Answer: C

  The principle of least privilege states that a user should never be given more privileges than are required to carry out a task. The user should not be logged on as an administrator, if the user is not doing administrative work on a computer.

  The administrator account should be used for performing tasks, such as changing system time, installing software, or creating standard accounts. Answer: D is incorrect. Role-based security provided by the .NET Framework allows, grants, or

  denies access to resources based on a Windows user's identity. It is built on the principle that the user is authenticated and can be authorized or assigned roles and permissions.

  Answer: B is incorrect. Segregation of duties is used to determine whether decision-making, executive tasks, or control tasks are carried out by a person to avoid unauthorized or unintended changes or the misuse of the organization's assets.

  Whether the person needs access to information can also be determined. The risk of information being intentionally or unintentionally used, altered, or destroyed is increased by unnecessary access. It is called the 'need to know' principle.

  Answer: A is incorrect. Security through obscurity is a principle in security engineering, which attempts to use secrecy (of design, implementation, etc.) to provide security. A system relying on security through obscurity may have theoretical or

  actual security vulnerabilities, but its owners or designers believe that the flaws are not known, and that attackers are unlikely to find them.

• Question 129:

  Which of the following infects the computer and then hides itself from detection by antivirus software?

  A. EICAR virus

  B. Boot-sector virus

  C. Macro virus

  D. Stealth virus

  Correct Answer: D

  A stealth virus is a file virus. It infects the computer and then hides itself from detection by antivirus software. It uses various mechanisms to avoid detection by antivirus software. It hides itself in computer memory after infecting the computer.

  It also masks itself from applications or utilities. It uses various tricks to appear that the computer has not lost any memory and the file size has not been changed. The virus may save a copy of original and uninfected data. When the anti-virus

  program tries to check the files that have been affected, the virus shows only the uninfected data. This virus generally infects .COM and .EXE files. Answer: B is incorrect. A boot sector virus infects the master boot files of the hard disk or

  floppy disk. Boot record programs are responsible for booting the operating system and the boot sector virus copies these programs into another part of the hard disk or overwrites these files. Therefore, when the floppy or the hard disk boots,

  the virus infects the computer.

  Answer: C is incorrect. A macro virus is a virus that consists of a macro code which infects the system. A Macro virus can infect a system rapidly. Since this virus has VB event handlers, it is dynamic in nature and displays random activation.

  The victim has only to open a file having a macro virus in order to infect the system with the virus. DMV, Nuclear, and Word Concept are some good examples of macro viruses.

  Answer: A is incorrect. The EICAR (EICAR Standard Anti-Virus Test File) virus is a file that is used to test the response of computer antivirus (AV) programs. The rationale behind it is to allow people, companies, and antivirus programmers to

  test their software without having to use a real computer virus that could cause actual damage should the antivirus not respond correctly. The file is simply a text file of either 68 or 70 bytes that is a legitimate executable file called a COM file

  that can be run by Microsoft operating systems and some work-alikes (except for 64-bit due to 16-bit limitations), including OS/2. When executed, it will print "EICAR- STANDARD-ANTIVIRUS-TEST-FILE!" and then stop. The string used in

  the EICAR virus is as follows:

• Question 130:

  Mark works as a Network Administrator fot Blue Well Inc. The company has a Windows-based network. Mark is facing a series of problems with email spam and identifying theft via phishing scams. He wants to implement the various security measures and to provide some education because it is related to the best practices while using email. Which of the following will Mark ask to employees of his company to do when they receive an email from a company they know with a request to click the link to "verify their account information"?

  A. Provide the required information

  B. Hide the email

  C. Use Read-only Domain Controller

  D. Delete the email

  Correct Answer: D

  In the above scenario, Mark will ask his employees to delete the email whenever he receives an email from a company that they know with to click the link to "verify their account information", because companies do not ask for account

  information via email now a days.

  Answer: C is incorrect. Read-only Domain Controller (RODC) is a domain controller that hosts the read-only partition of the Active Directory database. RODC was developed by Microsoft typically to be deployed in a branch office environment.

  RODC is a good option to enhance security by placing it in a location where physical security is poor. RODC can also be placed at locations having relatively few users and a poor network bandwidth to the main site. As only the read-only

  partition of the Active Directory database is hosted by RODC, a little local IT knowledge is required to maintain it.