Microsoft Microsoft Certifications 98-367 Questions & Answers

• Question 81:

  You work as a security manager for Company Inc. An individual is connecting to your corporate internal network over the Internet. You have to ensure that he is not an intruder masquerading as an authorized user. Which of the following technologies will you use to accomplish the task?

  A. Two-factor authentication

  B. IP address packet filtering

  C. Intrusion detection system (IDS)

  D. Embedded digital signature

  Correct Answer: A

  Two-factor authentication offers an extra security mechanism above that offered by passwords alone. It is frequently used by mobile users who want to establish connectivity to a corporate network.

• Question 82:

  Mark works as a Network Administrator for NetTech Inc. The company has a Windows Server 2008 domain-based network. Mark configures Network Access Protection (NAP) on the network. He then configures secure wireless access to the network from all access points on the network. He also configures 802.1x authentication for accessing the network. Mark wants to ensure that all computers connecting to the network are checked by NAP for the required configuration and update status. What will Mark do to accomplish the task?

  A. Configure all computers connecting to the network with IPSec.

  B. Configure all access points as RADIUS clients to Distributed File System.

  C. Configure Link-local Multicast Name Resolution (LLMNR) on the network.

  D. Configure all access points as RADIUS clients to Network Policy Server (NPS).

  Correct Answer: D

  In order to accomplish the task, Mark will have to configure all access points as RADIUS clients to Network Policy Server (NPS). Network Access Protection (NAP) is a set of operating system components included with the Windows Server 2008 and Windows Vista/7 operating systems. It ensures that the client computers on a private network meet administrator-defined requirements for system health. NAP policies define the required configuration and update status for a client computer's operating system and critical software. For example, an administrator can set policies that computers might be required to have antivirus software with the latest virus definition installed and current operating system updates. Using NAP, a network administrator can enforce compliance with health requirements for the client computers connection to the network. NAP helps network administrators to reduce the risk caused by improperly configured client computers that might be exposed to viruses and other malicious software. Network Policy Server (NPS) is a Remote Authentication Dial-In User Service (RADIUS) server and proxy in Windows Server 2008. It allows administrator to create and enforce network access policies for client health, connection request authentication, and connection request authorization. It can be used to centrally manage network access through a variety of network access servers, including wireless access points, VPN servers, dial-up servers, and 802.1X authenticating switches. NPS can also be used to deploy secure password authentication with Protected Extensible Authentication Protocol (PEAP)-MS-CHAP v2 for wireless connections. Answer B is incorrect. Distributed file system (Dfs) is a network server component: that makes it easier for users to find files and resources on distributed enterprise networks. It permits the linking of servers and shares into a simpler, more meaningful name space. Dfs provides improved load sharing and data availability. Answer: A is incorrect. IPSec has nothing to do with the solution. Answer: C is incorrect. Configuring Link-local Multicast Name Resolution (LLMNR) on the network has nothing to do with the solution.

• Question 83:

  Which of the following are the types of group scopes? Each correct answer represents a complete solution. Choose all that apply.

  A. Global

  B. Domain Users

  C. Universal

  D. Domain local

  Correct Answer: ACD

  Answer: D, A, and C Following are the types of group scopes: 1.Domain local 2.Global 3.Universal

• Question 84:

  Which of the following is a US Federal government algorithm created to generate a secure message digest?

  A. DSA

  B. RSA

  C. Triple DES

  D. SHA

  Correct Answer: D

  SHA is a Federal government algorithm created to generate a secure message digest. The Secure Hash Algorithm (SHA) is a cryptographic hash algorithm. It generates a fixed-length digital representation (message digest) of an input data sequence of any length. The SHA algorithm is very secure, as it is computationally very difficult to find a message that corresponds to a given message digest. In this algorithm, any change to a message will result in a completely different message digest. There are five SHA algorithms: SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. Answer: A is incorrect. Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. DSA is a public key algorithm; the secret key operates on the message hash generated by SHA-1; to verify a signature, one recomputes the hash of the message, uses the public key to decrypt the signature and then compares the results. The key size is variable from 512 to 1024 bits, which is adequate for the current computing capabilities as long as a user uses more than 768 bits. Answer: B is incorrect. RSA stands for Rivest, Shamir, and Adleman. It is an algorithm for public-key cryptography. It is the first algorithm known to be suitable for signing as well as encryption, and one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations. Answer: C is incorrect. Triple DES is the common name for the Triple Data Encryption Algorithm (TDEA). It is so named because it applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. The Data Encryption Standard (DES) is a block cipher (a form of shared secret encryption), which is based on a symmetric-key algorithm that uses a 56-bit key. The algorithm was initially controversial with classified design elements, a relatively short key length, and suspicions about a National Security Agency (NSA) backdoor. Triple DES provides a relatively simple method of increasing the key size of DES to protect against brute force attacks, without requiring a completely new block cipher algorithm.

• Question 85:

  You work as a Network Administrator for TechMart Inc. The company has a Windows-based network. After completing a security audit of the company's Microsoft Windows Server 2008 R2 file servers, you have determined that folder and share security requires a revision on the basis of corporate reorganization. You have noticed that some shares on the file system are not secured. Which of the following is a feature that you will use to reassign permissions without assigning permissions to every parent and child folder?

  A. Inheritance

  B. Kerberos

  C. TCP/IP protocol

  D. User Account Control (UAC)

  Correct Answer: A

  Inheritance is defined as the concept of permissions that are propagated to an object from a parent object. It is found in both file system permissions and Active Directory permissions and does not work with share permissions. It is used to reassign permissions without assigning permissions to every parent and child folder Answer: B is incorrect. Kerberos is defined as a secure method used for authenticating a request for a service in a computer network. Answer: D is incorrect. User Account Control (UAC) is used to prevent unauthorized changes to computers on the domain. Answer: C is incorrect. TCP/IP protocol is used to define the rule computers are required to follow for communicating with each other over the internet.

• Question 86:

  Which of the following is a program that runs at a specific date and time to cause unwanted and unauthorized functions?

  A. Keylogger

  B. Logic bomb

  C. Spyware

  D. Trojan horse

  Correct Answer: B

  A logic bomb is a malicious program that executes when a predetermined event occurs. For example, a logic bomb can execute when a user logs on to a computer or presses certain keys on the keyboard. It can also execute on a particular

  date or time specified by developers.

  Answer: D is incorrect. Trojan horse is a malicious software program code that masquerades itself as a normal program. When a Trojan horse program is run, its hidden code runs to destroy or scramble data on the hard disk. An example of a

  Trojan horse is a program that masquerades as a computer logon to retrieve user names and password information. The developer of a Trojan horse can use this information later to gain unauthorized access to computers. Trojan horses are

  normally spread by e-mail attachments. Unlike viruses, Trojan horses do not replicate themselves but only destroy information on hard disks. Answer: A is incorrect. A keylogger is a software tool that traces all or specific activities of a user on

  a computer. Once a keylogger is installed on a victim's computer, it can be used for recording all keystrokes on the victim's computer in a predefined log file. An attacker can configure a log file in such a manner that it can be sent

  automatically to a predefined e-mail address. Some of the main features of a keylogger are as follows:

  It can record all keystrokes.

  It can capture all screenshots.

  It can record all instant messenger conversations. It can be remotely installed.

  It can be delivered via FTP or e-mail.

  Answer: C is incorrect. Spyware is a computer program that collects all the information on the computer user and sends it to another computer or destination. It is used for monetary gain. It may have several ways of making money by using

  the information obtained. It tries to violate the privacy of the computer without causing damage to the computer or the software installed on it.

• Question 87:

  Which of the following points has to be considered for using the BitLocker?

  A. The deployment of antivirus because BitLocker needs a a removal of buffer overflow.

  B. The deployment of SEAL because BitLocker needs an alternative encryption algorithm to software- based DES, 3DES, and AES. .

  C. The deployment of hardware because BitLocker needs a system reserved partition.

  D. The deployment of hard disk because BitLocker needs a bot.

  Correct Answer: C

  Answer: B is incorrect. SEAL is an alternative encryption algorithm to software- based DES, 3DES, and AES. It uses a 160-bit encryption key. SEAL provides less impact to the CPU than other software- based encryption algorithms. In Cisco IOS IPSec implementations, SEAL supports the SEAL algorithm. It can be configured through the command-line interface using the crypto ipsec transform-set command and the esp-seal transform option. Answer: A is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. It helps an attacker not only to execute a malicious code on the target system but also to install backdoors on the target system for further attacks. All buffer overflow attacks are due to only sloppy programming or poor memory management by the application developers. The main types of buffer overflows are: Stack overflow Format string overflow Heap overflow Integer overflow Answer: D is incorrect. A bot is defined as a program that is used to perform some task on a network especially a task that is repetitive or time-consuming such as spybot or tracking software that uses other forms of deceptive software and programs conducting some activities on a computer without getting appropriate consent from the users.

• Question 88:

  Ron owns the domain TechPerfect.net. He often receives bounces about messages he didn't send. After looking at all such mails, he is sure that someone is spamming e- mails and using his domain name. What will Ron do to ensure that his domain name is not exploited?

  A. Publish the MX record for the domain.

  B. Publish the SPF record for the domain.

  C. Publish the AAAA record for the domain.

  D. Publish the A record for the domain.

  Correct Answer: B

  Sender Policy Framework (SPF) is an e-mail validation system designed to prevent e- mail spam by tackling source address spoofing. SPF allows administrators to specify which hosts are allowed to send e-mail from a given domain by creating a specific SPF record (or TXT record) in the public Domain Name System (DNS). Mail exchangers then use the DNS to check whether that mail from the given domain is being sent by a host sanctioned by that domain's administrators. Answer: A, D, and C are incorrect. These records do not help prevent domain names from being exploited by hackers.

• Question 89:

  Which of the following security features of IE 7+ helps determine whether a Web site is a legitimate site?

  A. Protected mode

  B. Pop-up blocker

  C. Security zones

  D. Phishing filter

  Correct Answer: D

  The Phishing filter of IE 7+ provides protection from online phishing attacks, frauds, and spoofed Web sites. The filter helps determine whether a Web site is a legitimate site or a phishing site. The filter blocks the Web sites and cautions the users about both reported and suspected phishing Web sites. Answer: B is incorrect. A Pop-up blocker allows users to block most pop-ups while surfing the Internet on their computers. The users can select the level of blocking; they can either block all pop- up windows or allow pop-ups that they want to see. Answer: A is incorrect. The protected mode feature of IE 7+ prevents a computer from saving the files or programs of a Web site. The protected mode makes it more difficult for malware to be installed. In case such a program is installed, it makes it difficult for the program to damage a user's file and the other operating system files. Protected mode is enabled by default for Internet, local intranet, and restricted sites. However, it is not enabled for the trusted sites. Answer: C is incorrect. IE 7+ provides a user the facility of configuring security through the security zones. It allows a user or systems administrator to categorize Web sites that a user visits into several groups with a suitable security level.

• Question 90:

  In which of the following is the file audit events are written when auditing is enabled?

  A. File system ACL

  B. Biometric device

  C. Network Access Control List

  D. Security event log

  Correct Answer: D

  The various enabled file auditing events are documented and written in the security event log Answer: A is incorrect. A filesystem ACL is deifned as a data structure (usually a table) that contains entries specifying individual user or group rights to specific system objects like programs, processes, or files. These entries are known as access control entries (ACEs) in the Microsoft Windows NT, OpenVMS, Unix-like, and Mac OS X operating systems and each of the accessible object contains an identifier to its ACL. The permissions are used to find the particular access rights, such as whether a user is able to read from, write to, or execute an object. Answer: C is incorrect. Network Access Control List is defined as a set of rules applied to port numbers or network daemon names that are available on a host or other layer 3, and attached with a list of hosts and networks permitted to use the various defined service. The individual servers and routers can have network ACLs. It is used to control both inbound and outbound traffic as firewall does. Answer: B is incorrect. A biometric device is used for uniquely recognizing humans based upon one or more intrinsic, physical, or behavioral traits. Biometrics is used as a form of identity access management and access control. It is also used to identify individuals in groups that are under surveillance. Biometric characteristics can be divided into two main classes: 1.Physiological: These devices are related to the shape of the body. These are not limited to the fingerprint, face recognition, DNA, hand and palm geometry, and iris recognition, which has largely replaced the retina and odor/scent. 2.Behavioral: These are related to the behavior of a person. They are not limited to the typing rhythm, gait, and voice.