MCSE 70-299: Implementing Network Security 2 — Questions and Answers
Question 1: Which Windows Server 2003 service must be running for IPSec policy to be applied to network traffic?
- IPSec Policy Agent (IPSECPOL) (Correct answer)
- Remote Registry
- Security Accounts Manager
- Windows Management Instrumentation
Correct answer: IPSec Policy Agent (IPSECPOL)
The IPSec Policy Agent service (also called IPSECPOL or PolicyAgent) retrieves and enforces IPSec policies on the local computer.
Question 2: What is the difference between an IPSec transport mode and tunnel mode?
- Transport mode encrypts only the payload; tunnel mode encapsulates the entire IP packet (Correct answer)
- Transport mode is faster than tunnel mode
- Tunnel mode works only with L2TP
- Transport mode creates new IP headers
Correct answer: Transport mode encrypts only the payload; tunnel mode encapsulates the entire IP packet
IPSec transport mode encrypts and authenticates the payload only, while tunnel mode encapsulates the entire original IP packet inside a new IP header — used for VPNs.
Question 3: Which Group Policy setting prevents users from installing device drivers without administrator approval?
- Prevent installation of devices not described by other policy settings (Correct answer)
- Audit device installation
- Turn off Autoplay
- Restrict access to Device Manager
Correct answer: Prevent installation of devices not described by other policy settings
This policy blocks unapproved hardware installations, reducing the risk of malicious or unauthorized devices being added to corporate computers.
Question 4: What type of attack does account lockout policy specifically help mitigate?
- Brute-force password guessing (Correct answer)
- Pass-the-hash
- SQL injection
- ARP spoofing
Correct answer: Brute-force password guessing
Account lockout policy limits the number of failed logon attempts before locking the account, making automated brute-force password guessing attacks ineffective.
Question 5: Which Windows Server 2003 feature allows administrators to restrict which software can run on a computer?
- Software Restriction Policies (Correct answer)
- AppLocker
- Windows Defender
- DEP (Data Execution Prevention)
Correct answer: Software Restriction Policies
Software Restriction Policies use rules based on certificate, hash, path, or zone to control which applications are allowed or denied from running.
Question 6: What is the recommended action when a certificate is compromised before its expiration date?
- Revoke the certificate and publish an updated CRL immediately (Correct answer)
- Wait for the certificate to expire naturally
- Delete the certificate from the CA database
- Issue a duplicate certificate to replace it
Correct answer: Revoke the certificate and publish an updated CRL immediately
Compromised certificates must be immediately revoked and a new CRL published so relying parties can check and reject the compromised certificate.
MCSE 70-299: Implementing Network Security 2
Which Windows Server 2003 service must be running for IPSec policy to be applied to network traffic?