MCSE 70-299: Implementing Network Security 1 — Questions and Answers
Question 1: Which command is used to apply a security template to a Windows Server 2003 system from the command line?
- secedit /configure /db temp.sdb /cfg hisecws.inf (Correct answer)
- gpupdate /force
- secpol.msc /apply
- netsh advfirewall set
Correct answer: secedit /configure /db temp.sdb /cfg hisecws.inf
The secedit command with the /configure switch applies a security template (.inf file) to the local system using a specified security database.
Question 2: What is the effect of setting the LAN Manager Authentication Level to 'Send NTLMv2 response only. Refuse LM & NTLM'?
- Forces all authentication to use NTLMv2, blocking weaker LM and NTLM protocols (Correct answer)
- Disables all network authentication
- Enables Kerberos for legacy systems
- Allows only smart card logon
Correct answer: Forces all authentication to use NTLMv2, blocking weaker LM and NTLM protocols
This setting maximizes NTLM security by refusing the weaker LM and NTLMv1 authentication protocols, requiring all clients to use NTLMv2.
Question 3: Which tool can be used to test IPSec policy on a Windows Server 2003 computer and see active security associations?
- ipseccmd show sas (Correct answer)
- netsh ipsec static show policy
- netstat -a
- secpol.msc
Correct answer: ipseccmd show sas
The ipseccmd show sas command displays active IPSec security associations, allowing administrators to verify that IPSec is negotiating correctly.
Question 4: What does enabling 'Restrict CD-ROM access to locally logged-on user only' accomplish in Windows Server 2003?
- Prevents network users from accessing the local CD-ROM drive (Correct answer)
- Encrypts all data written to CD-ROM
- Audits all CD-ROM access attempts
- Disables AutoRun for CD-ROM drives
Correct answer: Prevents network users from accessing the local CD-ROM drive
This security setting ensures that only the user physically logged on at the console can access the CD-ROM, preventing remote users from reading sensitive media.
Question 5: Which Windows Server 2003 built-in group has the ability to manage security policy settings without being a member of Administrators?
- Account Operators
- Backup Operators
- Server Operators (Correct answer)
- Power Users
Correct answer: Server Operators
Server Operators can perform tasks like managing shared resources, starting and stopping services, and backing up/restoring files on domain controllers.
Question 6: What is the purpose of enabling 'Do not store LAN Manager hash value on next password change' in Windows Server 2003?
- Prevents the weak LM hash from being stored in the SAM database (Correct answer)
- Forces all users to change passwords at next logon
- Disables NTLM authentication entirely
- Encrypts the SAM database with AES
Correct answer: Prevents the weak LM hash from being stored in the SAM database
Disabling LM hash storage prevents the weak LAN Manager password hash from being saved, making offline password cracking attacks against the SAM database much harder.
MCSE 70-299: Implementing Network Security 1
Which command is used to apply a security template to a Windows Server 2003 system from the command line?