MCSE 70-298: Designing Network Security 2 — Questions and Answers
Question 1: Which certificate type is required for EFS recovery agents in a Windows Server 2003 PKI environment?
- EFS Recovery Agent certificate (Correct answer)
- Computer certificate
- Code Signing certificate
- SSL/TLS Server certificate
Correct answer: EFS Recovery Agent certificate
The EFS Recovery Agent certificate grants designated accounts the ability to decrypt EFS-protected files if the original encrypting user's key is lost.
Question 2: What is the function of an Enterprise Root CA in a Windows Server 2003 PKI hierarchy?
- Issues certificates to subordinate CAs and is the trust anchor for the entire PKI (Correct answer)
- Issues end-entity certificates directly to all users and computers
- Validates revocation status of all certificates in real time
- Manages smart card enrollment for all users
Correct answer: Issues certificates to subordinate CAs and is the trust anchor for the entire PKI
The Enterprise Root CA sits at the top of the PKI hierarchy and signs the certificates of subordinate CAs; it should be kept offline to protect the root private key.
Question 3: Which auditing category should be enabled to track failed logon attempts in Windows Server 2003?
- Audit account logon events (Correct answer)
- Audit object access
- Audit process tracking
- Audit privilege use
Correct answer: Audit account logon events
Enabling 'Audit account logon events' with failure auditing records failed authentication attempts, helping detect brute-force or credential-stuffing attacks.
Question 4: What is the purpose of 802.1X authentication in a wired or wireless network security design?
- Requires devices to authenticate before gaining network access (Correct answer)
- Encrypts all data between the access point and client
- Assigns VLAN membership based on MAC address
- Provides DHCP address assignment for wireless clients
Correct answer: Requires devices to authenticate before gaining network access
802.1X is a port-based network access control standard that requires clients to authenticate (typically via RADIUS) before being granted network access.
Question 5: Which Windows Server 2003 service acts as a RADIUS server to centralize network access authentication?
- Internet Authentication Service (IAS) (Correct answer)
- Routing and Remote Access Service (RRAS)
- Certificate Services (CS)
- Network Access Quarantine Control
Correct answer: Internet Authentication Service (IAS)
Internet Authentication Service (IAS) is Microsoft's RADIUS server implementation that centralizes authentication, authorization, and accounting for network access.
Question 6: What security measure does Smart Card logon provide that standard password authentication does not?
- Two-factor authentication requiring physical possession of the card (Correct answer)
- Faster logon processing
- Automatic session timeout
- Prevention of all phishing attacks
Correct answer: Two-factor authentication requiring physical possession of the card
Smart card logon implements two-factor authentication by requiring both the physical smart card and a PIN, making credential theft much harder.
MCSE 70-298: Designing Network Security 2
Which certificate type is required for EFS recovery agents in a Windows Server 2003 PKI environment?