Microsoft Microsoft Certifications 98-367 Questions & Answers

• Question 61:

  Mark works as a Network Administrator for NetTech Inc. The company has a Windows Server 2008 domain-based network. The network uses Network Access Protection (NAP). The company's employees at the remote locations are connecting to the company's network from their Windows Vista clients. Mark wants to ensure that the data transmission between a client computer and the company's network is as secure as possible. What will Mark do to accomplish the task?

  A. Use Encrypting File System (Efs) between the client computer and the company's network.

  B. Use IPSec NAP policy between client computer and the company's network.

  C. Use VPN connection with MS-CHAP v2 between the client computer and the company's network.

  D. Use NAP enforcement for DHCP.

  Correct Answer: B

  In order to accomplish the task, Mark will have to use IPSec NAP policy between the client computer and the company's network. Using the IPSec NAP policy between client computer and the company's network will provide the strongest security for data transmission. IPSec enforcement provides the strongest form of NAP enforcement. Because this enforcement method uses IPsec, the administrator can define requirements for protected communications on a per-IP address or per- TCP/UDP port number basis. Answer: A is incorrect. Encrypting File System (Efs) cannot work on the network. Answer: C is incorrect. According to the Question ensure that the data transmission between the client computer and the company's network is as secure as possible. Hence, this solution will not fulfill the requirement. Answer: D is incorrect. Using DHCP enforcement, DHCP servers and Network Policy Server (NPS) can enforce health policy when a computer attempts to lease or renew an IP version 4 (IPv4) address.

• Question 62:

  Which of the following are the main features of a key logger? Each correct answer represents a complete solution. Choose all that apply.

  A. It can be delivered via FTP or e-mail.

  B. It can record all keystrokes.

  C. It can capture all screenshots.

  D. It can detect viruses on the computer.

  Correct Answer: ABC

  Answer: A, B, and C

  A keylogger is a software tool that traces all or specific activities of a user on a computer. Once a keylogger is installed on a victim's computer, it can be used for recording all keystrokes on the victim's computer in a predefined log file. An

  attacker can configure a log file in such a manner that it can be sent automatically to a predefined e-mail address. Some of the main features of a keylogger are as follows:

  It can record all keystrokes.

  It can capture all screenshots.

  It can record all instant messenger conversations. It can be remotely installed.

  It can be delivered via FTP or e-mail.

  Answer: D is incorrect. It cannot detect viruses.

• Question 63:

  Which of the following is an authentication protocol?

  A. Kerberos

  B. LDAP

  C. TLS

  D. PPTP

  Correct Answer: A

  Kerberos is an industry standard authentication protocol used to verify user or host identity. Kerberos v5 authentication protocol is the default authentication service for Windows 2000. It is integrated into the administrative and security model,

  and provides secure communication between Windows 2000 Server domains and clients.

  Answer: C is incorrect. Transport Layer Security (TLS) is an application layer protocol that uses a combination of public and symmetric key processing to encrypt data.

  Answer: B is incorrect. Lightweight Directory Access Protocol (LDAP) is a protocol used to query and modify information stored within directory services. Answer: D is incorrect. Point-to-Point Tunneling Protocol (PPTP) is a method for

  implementing virtual private networks. PPTP does not provide confidentiality or encryption. It relies on the protocol being tunneled to provide privacy. It is used to provide secure, low-cost remote access to corporate networks through public

  networks such as the Internet. Using PPTP, remote users can use PPP- enabled client computers to dial a local ISP and connect securely to the corporate network through the Internet. PPTP has been made obsolete by Layer 2 Tunneling

  Protocol (L2TP) and IPSec.

• Question 64:

  Which of the following is a broadcast domain created by a switch?

  A. VLAN

  B. MAN

  C. DMZ

  D. VPN

  Correct Answer: A

  A VLAN is a broadcast domain created by a switch. Each broadcast domain connected to interfaces of the switch is known as a separate VLAN. A VLAN should be configured when a LAN has lots of traffic or more than 200 devices. It is also required when groups of users need more security or when a group of users has the same type of work and needs to be on the same broadcast domain. Answer: D is incorrect. A Virtual Private Network (VPN) is a computer network that is implemented in an additional software layer (overlay) on top of an existing larger network for the purpose of creating a private scope of computer communications or providing a secure extension of a private network into an insecure network such as the Internet. The links between nodes of a Virtual Private Network are formed over logical connections or virtual circuits between hosts of the larger network. The Link Layer protocols of the virtual network are said to be tunneled through the underlying transport network. Answer: C is incorrect. A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external networks, while an intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network such as the Internet. Answer: B is incorrect. Metropolitan Area Network (MAN) represents a network that connects two or more LANs in the same geographic area. A network connecting two different buildings or offices in the same city is an example of a MAN. The LANs involved in a MAN are connected to one another through high-speed connections such as T1, SONET, SDH, etc. A MAN is a hybrid of a LAN and a WAN. A WAN provides low to medium speed access, whereas a MAN provides high-speed access.

• Question 65:

  Which of the following is a attack type that is used to poison a network or computer to the point where the system is turned into unusable state?

  A. Mail bombing

  B. Pharming

  C. Protocol spoofing

  D. Denial of service (DOS)

  Correct Answer: D

  Denial of service (DOS) attack is an attack that is used to poison a network or computer to the point where the system is turned into a unusable state. Answer A is incorrect. Mail bombing is an attack that is used to overwhelm mail:

  servers and clients by sending a large number of unwanted e-mails. The aim of this type of attack is to completely fill the recipient's hard disk with immense, useless files, causing at best irritation, and at worst total computer failure. E-mail

  filtering and properly configuring email relay functionality on mail servers can be helpful for protection against this type of attack.

  Answer: B is incorrect. Pharming is a hacker's attack aiming to redirect a Web site's traffic to another Web site. Pharming can be conducted either by changing the hosts files on a victim's computer or by exploitation of a vulnerability in DNS

  server software. DNS servers are computers responsible for resolving Internet names into their IP addresses. Incorrect entries in a computer's hosts files are a popular target for malware.

  Answer: C is incorrect. Protocol spoofing is used in data communications for enhancing the performance in situations where an currently working protocol is inadequate. In a computer security context, it refers to several forms of falsification of

  technically unrelated data.

• Question 66:

  Which of the following types of Network Address Translation (NAT) uses a pool of public IP addresses?

  A. Static NAT

  B. Port Address Translation (PAT)

  C. Dynamic NAT

  D. Cache NAT

  Correct Answer: C

  Dynamic Network Address Translation (NAT) uses a pool of public IP addresses. Dynamic NAT is a technique that maps an unregistered IP address to a registered IP address from a group of registered IP addresses. It also establishes a one-to-one mapping between unregistered (private) and registered (public) IP addresses, but the mapping varies depending on the registered address available in the IP address pool at the time of connection. Answer: A is incorrect. Static NAT performs a manual translation of one IP address to a different one. Static NAT is typically used to translate the destination IP address in packets that reach to the translation device (such as a router) for LAN. In static translation type, a manual translation is performed between two addresses and possibly port numbers. Answer: B is incorrect. Port Address Translation (PAT) is also a type of NAT. This type of NAT is used in home networks that are using DSL or cable modems. It is designed to provide Internet access to many internal users through one external address. Answer: D is incorrect. There is no such type of NAT as Cache NAT.

• Question 67:

  Which of the following viruses cannot be detected by the signature-based antivirus?

  A. Polymorphic

  B. MBR virus

  C. Boot sector

  D. Macro

  Correct Answer: A

  A polymorphic virus has the ability to change its own signature at the time of infection. This virus is very complicated and hard to detect. When the user runs the infected file in the disk, it loads the virus into the RAM. The new virus starts making its own copies and infects other files of the operating system. The mutation engine of the polymorphic virus generates a new encrypted code, thus changing the signature of the virus. Therefore, polymorphic viruses cannot be detected by signature-based antivirus. Answer: B is incorrect. A Master boot record (MBR) virus replaces the boot sector data with its own malicious code. Every time when the computer starts up, the boot sector virus executes. It can then generate activity that is either annoying (system will play sounds at certain times) or destructive (erase the hard drive of the system). Because the code in the Master Boot Record executes before any operating system is started, no operating system can detect or recover from corruption of the Master Boot Record.

  Answer: D is incorrect. A macro virus is a virus that consists of a macro code which infects the system. A Macro virus can infect a system rapidly. Since this virus has VB event handlers, it is dynamic in nature and displays random activation. The victim has only to open a file having a macro virus in order to infect the system with the virus. DMV, Nuclear, and Word Concept are some good examples of macro viruses. Answer: C is incorrect. A boot sector virus infects the master boot files of the hard disk or floppy disk. Boot record programs are responsible for booting the operating system and the boot sector virus copies these programs into another part of the hard disk or overwrites these files. Therefore, when the floppy or the hard disk boots, the virus infects the computer.

• Question 68:

  Which of the following can be implemented to decrease the number of times a user is required to be authenticated for access a particular resource?

  A. TCP/IP protocol

  B. Network Directory Access Protocol

  C. Kerberos

  D. Single Sign-on (SSO)

  Correct Answer: D

  Single sign-on (SSO) is defined as a mechanism in which a single action of user authentication and authorization is used to allow a user to access all computers and systems where he got a access permission, without entering passwords for

  multiple times.

  Answer: C is incorrect. Kerberos is defined as a secure method used for authenticating a request for a service in a computer network. Answer: A is incorrect. TCP/IP protocol is used to define the rule computers are required to follow for

  communicating with each other over the internet. Answer: B is incorrect. This is an invalid Answer:

• Question 69:

  You are responsible for virus protection for a large college campus. You are very concerned that your antivirus solution must be able to capture the latest virus threats. What sort of virus protection should you implement?

  A. Network Based

  B. Host based

  C. Dictionary

  D. Heuristic

  Correct Answer: D

  A Heuristic antivirus protection solution uses certain behaviors to identify a file as a virus, even if it is not on any known antivirus list.

• Question 70:

  Which of the following applications captures network packets as they traverse a network and displays them to the attacker?

  A. Keylogger

  B. Sniffer

  C. Key fob

  D. Protocol analyzer

  Correct Answer: B

  A sniffer is a software tool that is used to capture any network traffic. Since a sniffer changes the NIC of the LAN card into promiscuous mode, the NIC begins to record incoming and outgoing data traffic across the network. A sniffer attack is

  a passive attack because the attacker does not directly connect with the target host. This attack is most often used to grab logins and passwords from network traffic. Tools such as Ethereal, Snort, Windump, EtherPeek, Dsniff are some good

  examples of sniffers. These tools provide many facilities to users such as graphical user interface, traffic statistics graph, multiple sessions tracking, etc. Answer: D is incorrect. A protocol analyzer for particular types of networks is a computer

  software or computer hardware that can intercept and log traffic passing over a digital network or part of a network. As data streams flow across the network, the protocol analyzer captures each packet and, if needed, decodes and analyzes

  its content according to the appropriate RFC or other specifications.

  Answer: A is incorrect. A keylogger is a software tool that traces all or specific activities of a user on a computer. Once a keylogger is installed on a victim's computer, it can be used for recording all keystrokes on the victim's computer in a

  predefined log file. An attacker can configure a log file in such a manner that it can be sent automatically to a predefined e-mail address. Some of the main features of a keylogger are as follows:

  It can record all keystrokes.

  It can capture all screenshots.

  It can record all instant messenger conversations. It can be remotely installed.

  It can be delivered via FTP or e-mail.

  Answer: C is incorrect. Key fobs are security devices used by telecommuters to provide one part of a three way match for a user to log on to a secured network.

  

  These are display-only devices that algorithmically generate security codes as part of a challenge/response authentication system. This code usually changes very quickly and is used with the PIN for authentication.