70-298: Designing Network Security Flashcards

Which security template in Windows Server 2003 provides the highest level of security but may break legacy application compatibility?

Answer: hisecws.inf

The hisecws.inf (High Security Workstation) template enforces strict security settings that may prevent older applications from running correctly.

What is the purpose of a DMZ (Demilitarized Zone) in network security design?

Answer: Isolates publicly accessible servers from the internal private network

A DMZ is a network segment that separates public-facing servers (web, mail, FTP) from the internal corporate network, limiting exposure if a DMZ server is compromised.

Which feature of Windows Server 2003 IPSec allows you to require encryption for all traffic between two specific servers?

Answer: IPSec policy with Require Security rule

An IPSec policy configured with a 'Require Security' action mandates that all communications matching the filter rule use encrypted, authenticated IPSec connections.

What is the minimum Kerberos ticket lifetime that Microsoft recommends to prevent replay attacks?

Answer: 5 minutes

The default and recommended Kerberos ticket lifetime is 10 hours for TGTs, but the clock skew tolerance (which prevents replay attacks) defaults to 5 minutes.

Which tool is used to analyze the current security configuration of a Windows Server 2003 system against a security template?

Answer: Security Configuration and Analysis

The Security Configuration and Analysis snap-in compares the current system security settings against a security template and highlights discrepancies.

What does EFS (Encrypting File System) protect against in Windows Server 2003?

Answer: Unauthorized access to files when the OS is bypassed (e.g., boot from another disk)

EFS encrypts files on disk so that an attacker who physically accesses the drive cannot read the data by booting from another OS.