MCSE 70-298: Designing Network Security 1 — Questions and Answers
Question 1: Which security template in Windows Server 2003 provides the highest level of security but may break legacy application compatibility?
- hisecws.inf (Correct answer)
- securedc.inf
- setup security.inf
- compatws.inf
Correct answer: hisecws.inf
The hisecws.inf (High Security Workstation) template enforces strict security settings that may prevent older applications from running correctly.
Question 2: What is the purpose of a DMZ (Demilitarized Zone) in network security design?
- Isolates publicly accessible servers from the internal private network (Correct answer)
- Provides VPN access for remote users
- Stores backup copies of domain controllers
- Segments wireless from wired clients
Correct answer: Isolates publicly accessible servers from the internal private network
A DMZ is a network segment that separates public-facing servers (web, mail, FTP) from the internal corporate network, limiting exposure if a DMZ server is compromised.
Question 3: Which feature of Windows Server 2003 IPSec allows you to require encryption for all traffic between two specific servers?
- IPSec policy with Require Security rule (Correct answer)
- TCP/IP filtering
- Windows Firewall with exceptions
- Network Monitor capture filter
Correct answer: IPSec policy with Require Security rule
An IPSec policy configured with a 'Require Security' action mandates that all communications matching the filter rule use encrypted, authenticated IPSec connections.
Question 4: What is the minimum Kerberos ticket lifetime that Microsoft recommends to prevent replay attacks?
- 5 minutes (Correct answer)
- 1 minute
- 30 minutes
- 1 hour
Correct answer: 5 minutes
The default and recommended Kerberos ticket lifetime is 10 hours for TGTs, but the clock skew tolerance (which prevents replay attacks) defaults to 5 minutes.
Question 5: Which tool is used to analyze the current security configuration of a Windows Server 2003 system against a security template?
- Security Configuration and Analysis (Correct answer)
- Group Policy Object Editor
- Local Security Policy
- System Monitor
Correct answer: Security Configuration and Analysis
The Security Configuration and Analysis snap-in compares the current system security settings against a security template and highlights discrepancies.
Question 6: What does EFS (Encrypting File System) protect against in Windows Server 2003?
- Unauthorized access to files when the OS is bypassed (e.g., boot from another disk) (Correct answer)
- Network interception of data in transit
- Brute-force password attacks
- Denial of service attacks
Correct answer: Unauthorized access to files when the OS is bypassed (e.g., boot from another disk)
EFS encrypts files on disk so that an attacker who physically accesses the drive cannot read the data by booting from another OS.
MCSE 70-298: Designing Network Security 1
Which security template in Windows Server 2003 provides the highest level of security but may break legacy application compatibility?