Deck 11: Securing Windows Server 2019

Question 1

Alonso, a system administrator, has configured and deployed a new GPO at the domain level in his organization . However, when he checks after a few hours, two of the OUs in the Active Directory do not reflect the change. What is the most likely reason the new GPO configuration did not apply to the two OUs?

A) The OUs were under another domain.
B) The Block Inheritance setting prevented the OUs from applying the GPOs.
C) The users under the OUs declined the domain-level setting when prompted.
D) The GPO link was configured with the Enforced setting.

Answer 1

B

Question 2

Fatima is configuring a Windows Server 2019 system as a RADIUS server for use with 802.1X Wireless. She has configured the Network Policy and Access Services server role. What is the next step Fatima should take once the server role has been configured?

A) Configure the Configure 802.1X wizard
B) Activate the server in Active Directory
C) Edit or remove existing RADIUS clients
D) Choose the EAP authentication method

Answer 2

B

Question 3

When a CA public/private key pair expires, a system administrator must generate a new CA public/private key pair the same day to ensure a smooth transition.

Answer 3

False

Question 4

Yosef has configured Windows Server 2019 as an enterprise CA and deployed a GPO to enroll all the users for certificates. He chooses the setting that will enroll the users when they boot their computers. When he checks whether all users and computers have been enrolled, he finds that five users were not enrolled for the certificate. Yosef was able to manually enroll those users for certificates. Which of the following permissions to the certificate template is most likely to be missing for the five users who did not get enrolled?

A) Read
B) Write
C) Enroll
D) Autoenroll

Question 5

Stephen sets up manual enrollment for a user certificate from an enterprise CA. However, as he completes the process, he realizes that he has accidently set up the enrollment for a computer certificate rather than a user certificate. Which of the following commands did Stephen most likely type in the Command Prompt window?

A) certmgr.msc
B) certlm.msc
C) wf.msc
D) gpedit.msc

Question 6

Denali wants to store information about all Windows updates on a specific Microsoft SQL Server for security reasons. Which of the following wizards can Denali use to set up SQL Server Connectivity to store update information?

A) The Group Policy Results Wizard
B) The Add Roles and Features Wizard
C) The Windows Server Updates Services Configuration Wizard
D) The Certificate Enrollment wizard

Question 7

Giselle, a systems administrator, creates a file redirection GPO, in the User Configuration section that automatically saves files created by her colleagues to a shared network device instead of the local drives in their computers. However, the computers do not receive the configuration specified in the GPO. She runs the gpupdate /force command in the Command Prompt window of one of her colleagues' computer. Despite her effort, the computer does not receive the GPO, and she decides to rectify the issue the next day. To her surprise, she sees that the computer has been configured as per the GPO. What do you see as the issue with the GPO configuration?

A) The GPO was not backed up before the new settings were applied.
B) The settings can only be applied at the next login.
C) The computer had to be rebooted for the application of the GPO settings.
D) The Block Inheritance setting was enabled for the OU that the computers belonged to.

Question 8

If multiple GPOs are linked to the same site, domain, or OU, they will be applied in a random order.

Question 9

XM GraFix, a graphics design company, has bought new design software. Mason, the system administrator, wants to install the software on all the computers in the design department. However, not all the designers need the software. Using the GPO, Mason uses a deployment method that allows the users to install the program from the network when they need it. Which of the following methods of deployment has Mason most likely used in the given scenario?

A) Published the software under Software Settings in the Computer Configuration
B) Published the software under Software Settings in the User Configuration
C) Assigned the software under Software Settings in the Computer Configuration
D) Assigned the software under Software Settings in the User Configuratio

Question 10

While configuring Windows Server 2019 as a WSUS server, which of the following role services would you select to store information about updates in the Windows Internal Database?

A) WID connectivity
B) WSUS services
C) SQL server connectivit
D) Certification authority

Question 11

Which of the following is true of Group Policy Objects (GPOs)?

A) They do not apply to Active Directory groups.
B) They are not strictly enforced.
C) They allow users to configure settings that are applied by GPOs.
D) They are limited to 500 or less users or computers.

Question 12

David, a system administrator, has created specific GPOs for every department in his organization based on the permissions required by the various departments. However, he needs to apply the Default Domain Policy for some managers but not for the rest of the users. How can David ensure that the Default Domain Policy is applied only to specific managers' accounts?

A) By using the Block Inheritance setting on the domain-level GPO
B) By using the Enforced setting on the OU-level GPOs for the OUs that contain the managers' accounts
C) By removing the Authenticated Users group from the Security Filtering section and adding the managers' accounts
D) By using a WMI filter to check for conditions under which the Default Domain Policy must be applied

Question 13

A 257-bit encryption key is twice as difficult to guess compared to a 256-bit encryption key.

Question 14

Sasha is configuring Windows Server 2019 as an enterprise CA. She installs the Active Directory Certificate Services server role and is prompted to choose the role services that she wishes to install. Which of the following role services should Sasha select to ensure that routers are allowed to obtain certificates?

A) The Online Responder role service
B) The Network Device Enrollment Service role service
C) The Certificate Enrollment Policy Web Service role service
D) The Certification Authority Web Enrollment role service

Question 15

Amina, who works for a pharmaceutical company, configures and issues the Smartcard Logon certificate template with schema version 2. While most of the users get auto-enrolled, some of the users fail to obtain the certificate. Identify the most likely reason auto-enrollment failed for these users.

A) Their operating system is Windows XP.
B) They have the Block Inheritance setting at the OU level.
C) The template did not have the Enforced setting.
D) Their operating system is Windows 2000.

Question 16

Having heard the data theft suffered by a competing company by a man-in-the-middle attack, Finn asks Talia, his server administrator, to implement measures to prevent such attacks in his company. Which of the following should Talia do to ensure that Finn's company is protected from such attacks?

A) Hire the services of a third-party Certification Authority
B) Configure the Block Inheritance setting at OU-level GPOs
C) Run the gpupdate /force command in a Command Prompt window.
D) Run the gpresult /r command in Windows PowerShell.

Question 17

WPA3 is immune to wireless cracking tools because it uses a Wi-Fi password in a different way than WPA2 does.

Question 18

Amber is a hacker who steals information when people enter their personal details on specific websites. She intercepts the public key as it is sent from the Web server to the Web browser and substitutes her own public key in its place. This enables her to intercept the communication and decrypt the symmetric encryption key using her private key. Which type of hacking attack is Amber perpetrating?

A) A denial-of-service attack
B) A man-in-the-middle attack
C) A drive-by attack
D) A malware attack

Question 19

What is the level of encryption of the public/private key pair that is contained in the domain-server-CA in Microsoft Server 2019?\

A) 256-bit encryption
B) 257-bit encryption
C) 1024 -bit encryption
D) 2048-bit encryption

Question 20

Ramona, the chief technical officer of an engineering company, needs to install software on 32-bit computers using GPO. The system network consists of over 500 computers and has a mix of 32-bit and 64-bit computers. How can Ramona ensure that the software is installed only on the 32-bit computers?

A) By using a WMI filter
B) By using the Security Filtering option
C) By setting Group Policy preferences
D) By modifying Software Settings under Group Policy

Question 21

What is Group Policy, and why is it used?

Question 22

If a newly created firewall allows connection to a program only if the connection is authenticated by IPSec, which of the following options was most likely selected in the Action pane in the New Inbound Rule Wizard at the time of creating the rule?

A) Authentication exemptio
B) Allow the connection
C) Allow the connection if it is secure
D) Block the connection

Question 23

Which of the following settings in Windows defender should be enabled to prevent malware and network attacks from accessing high-security processes in systems that support core isolation?

A) The Block Inheritance setting
B) The firewall rules setting
C) The controlled folder access setting
D) The memory integrity setting

Question 24

Lisa, the system administrator of a bank, is going on a sabbatical for 12 weeks. Before leaving, she must prepare a knowledge transfer document to assist her colleague who will oversee her responsibilities in her absence. The document must include a report of the properties and settings of the GPOs. List the steps that Lisa needs to follow to obtain this report.

Question 25

What are the four main features provided by Windows Defender that can be configured? Give a brief description of each feature.

Question 26

Navin wants to reduce the chances of a data breach and monitor and control the traffic on his company's website. Instead of using a NAT router, he sets up an external server that acts as a filter between the organization's website and end users. Which of the following options must Navin select and configure when configuring WSUS?

A) Store updates in the following location
B) Use a proxy server when synchronizin
C) Synchronize from another Windows Server Update Services server
D) Synchronize from Microsoft Update servers

Question 27

Aster has created new firewall rules in Windows Defender. One of the new rules appears to cause an error. Aster thinks that the rule itself is the issue. Describe the steps she should follow to eliminate the rule as the cause of issue.

Question 28

The new system administrator of XYZ company realizes that whenever updates are available for Windows, WSUS redirects computers to the Microsoft Update servers on the Internet to obtain updates instead of storing the update information on the WID. Which of the following is a likely reason for this issue?

A) The WSUS installation is either incomplete or has not been installed properly.
B) While installing WSUS, the option SQL Server Connectivity was selected.
C) While installing WSUS, the option Store updates in the following location was deselected.
D) While configuring WSUS, the option Synchronize from another Windows Server Update Services server was selected.

Question 29

What are the advantages of implementing a Windows Server Update Services (WSUS) server in an organization?

Question 30

List and briefly describe the folders in the Certification Authority tool that are used to manage and configure most CA functionalities.

Question 31

To prevent man-in-the-middle attacks, Janet, a network administrator, configures a GPO such that all the traffic sent toward a specific database server is encrypted using IPSec. While most of her colleagues are able to successfully connect to the database via the IPSec authentication process, the connection is not successful for some computers. What do you see to be the problem here?

A) The IP addresses of the computers were not added under Endpoint 1.
B) The connection between the failed computers and the server was protected with IPSec.
C) The rule type was set to Isolation instead of Server-to-server.
D) The computers did not have an IPSec certificate.

Question 32

Anthony is a server administrator and has been asked to configure and issue the Root Certification Authority certificate to all the users in his organization. The default template is a schema version 1 template, but Anthony wants users to be auto-enrolled. Briefly outline the steps Anthony can follow to create a new template to ensure that users are auto-enrolled.

Question 33

List the sequence of events that takes place to ensure that data is encrypted during the transfer w hen someone accesses a website.

Question 34

By default, where are updates synchronized from in WSUS?

A) Microsoft Update servers on the Internet
B) The Windows Internal Database
C) The specified Microsoft SQL Server
D) Windows Server Update Services

Question 35

What is a starter GPO, and how is it created?

Question 36

Chynna wants to create two different firewall rules that are applicable depending on whether a computer is connected to a corporate domain or a home network. Which of the following panes in the New Inbound Rule Wizard should Chynna select to specify the conditions that should be met before the rules can be applied?

A) The Profile pane
B) The Action pane
C) The Rule Type pane
D) The Protocol and Ports pane

Question 37

What are the situations in which a GPO does not apply to a user or computer account?