Title: Quiz 5
Course: CTS 2346 Windows Server 2012 > Section: Module 5

Q: Why is there a No Encryption option for network connections?
- to accommodate devices (clients) that don’t support encryption
- to test connectivity before applying an encryption scheme
- to allow for third-party encryption programs that might be incompatible with native encryption
- to allow certain trusted connections to remain unencrypted
A: to accommodate devices (clients) that don’t support encryption
If right: The No Encryption option allows unencrypted connections that match the remote access policy conditions. Clear this option to require encryption.
If wrong: The No Encryption option allows unencrypted connections that match the remote access policy conditions. Clear this option to require encryption.

Q: What do IP filters allow you to control?

Q: What is Bandwidth Allocation Protocol (BAP) used for?

Q: Where should specific NPS network policies be placed in the policies list?

Q: What character string attribute designates the phone number used by the access client?
- Identity Type
- Calling Station ID
- Client Friendly Name
- Called Station ID
A: Calling Station ID
If right: The Calling Station ID designates the phone number used by the caller (the access client). This attribute is a character string. You can use pattern-matching syntax to specify area codes.
If wrong: The Calling Station ID designates the phone number used by the caller (the access client). This attribute is a character string. You can use pattern-matching syntax to specify area codes.

Q: What character string makes up the telephone number of the network access server (NAS)?
- Identity Type
- Calling Station ID
- Client Friendly Name
- Called Station ID
A: Called Station ID
If right: The Called Station ID specifies a character string that is the telephone number of the network access server.
If wrong: The Called Station ID specifies a character string that is the telephone number of the network access server.

Q: Network Access Policy is part of which larger scope NPS policy?
- Connection request
- Network
- Health
- Realm
A: Health
If right: Health policies establish one or more system health validators (SHVs) and other settings that enable you to define client computer configuration requirements for computers capable of Network Access Policy (NAP) that attempt to connect to your network. Health policies are used only with NAP.
If wrong: Health policies establish one or more system health validators (SHVs) and other settings that enable you to define client computer configuration requirements for computers capable of Network Access Policy (NAP) that attempt to connect to your network. Health policies are used only with NAP.

Q: RADIUS Access-Request messages are processed or forwarded by NPS only if the settings of the incoming message match what on the NPS server?
- one of the connection request policies
- the time zone of the requestor
- the client type of the requestor
- the TCP/IP port of the requestor
A: one of the connection request policies
If right: RADIUS Access-Request messages are processed or forwarded by NPS only if the settings of the incoming message match at least one of the connection request policies configured on the NPS server.
If wrong: RADIUS Access-Request messages are processed or forwarded by NPS only if the settings of the incoming message match at least one of the connection request policies configured on the NPS server.

Q: Identify two remediation server types.
- Anti-virus/anti-malware servers
- Software update servers
- Terminal servers
- RRAS servers
A: Anti-virus/anti-malware servers; Software update servers
If right: Remediation servers typically consist of anti-virus/anti-malware servers to retrieve updated anti-virus/anti-malware updates, and software update servers so that clients can get Windows updates.
If wrong: Remediation servers typically consist of anti-virus/anti-malware servers to retrieve updated anti-virus/anti-malware updates, and software update servers so that clients can get Windows updates.

Q: DHCP enforcement is not available for what kind of clients?
- mobile
- remote dial-up
- noncompliant
- IPv6
A: IPv6
If right: DHCP enforcement is not possible for IPv6 clients.
If wrong: DHCP enforcement is not possible for IPv6 clients.

Q: Because NAP is provided by _________, you need to install _________ to install NAP.
- NPS, NPS
- DNS, NPS
- DHCP, NPS
- AD, NPS
A: NPS, NPS
If right: NAP is provided by NPS. Therefore, to install NAP, you must install NPS.
If wrong: NAP is provided by NPS. Therefore, to install NAP, you must install NPS.

Q: Network Access Protection (NAP) is Microsoft’s software for controlling network access of computers based on what?
- a computer’s IP address and VLAN
- a computer’s overall health
- a computer’s Windows version
- a computer’s network functionality (role)
A: a computer’s overall health
If right: Network Access Protection (NAP) is Microsoft’s software for controlling network access for computers based on the health of the host, such as if it has the newest security patches and a current anti-virus/anti-malware software package.
If wrong: Network Access Protection (NAP) is Microsoft’s software for controlling network access for computers based on the health of the host, such as if it has the newest security patches and a current anti-virus/anti-malware software package.

Q: These Windows computers move often and might not be connected to the organization’s network office. Because they are typically part of the domain, they can be managed but might not get the newest updates because they are not always connected to the network.
- desktop computers
- roaming laptops
- unmanaged home computers
- visiting laptops
A: roaming laptops
If right: Roaming laptops move often and might not be connected to the organization’s network office. Because they are typically part of the domain, they can be managed but might not get the newest updates because they are not always connected to the network.
If wrong: Roaming laptops move often and might not be connected to the organization’s network office. Because they are typically part of the domain, they can be managed but might not get the newest updates because they are not always connected to the network.

Q: These Windows computers are unmanaged computers often used by consultants or vendors who need to connect to your organization’s network. Because they are unmanaged, they might not have the newest up-to-date security patches and an up-to-date anti-virus/anti-malware software package.
- desktop computers
- roaming laptops
- unmanaged home computers
- visiting laptops
A: visiting laptops
If right: Visiting laptops are unmanaged Windows computers often used by consultants or vendors who need to connect to your organization’s network. Because they are unmanaged, they might not have the newest up-to-date security patches and an up-to-date anti-virus/anti-malware software package.
If wrong: Visiting laptops are unmanaged Windows computers often used by consultants or vendors who need to connect to your organization’s network. Because they are unmanaged, they might not have the newest up-to-date security patches and an up-to-date anti-virus/anti-malware software package.

Q: You should restrict access only for clients that don’t have all available security updates installed if what situation exists?
- the computers are running NAP
- the computers are running SHA
- the computers are running Windows Update
- the computers are running anti-virus software
A: the computers are running Windows Update
If right: If you select to restrict access for clients that do not have all available security updates installed, the client computer is restricted to a remediation network. However, this option should not be selected unless the computers have the Windows Update Agent running.
If wrong: If you select to restrict access for clients that do not have all available security updates installed, the client computer is restricted to a remediation network. However, this option should not be selected unless the computers have the Windows Update Agent running.

Q: Health policies are in pairs. What are the members of the pair? Select two.
- NAP-compliant
- NAP-remedial
- NAP-noncompliant
- NAP-quarantined
A: NAP-compliant; NAP-noncompliant
If right: Typically, the health policies are in pairs, one for NAP-compliant and the other for NAP-noncompliant.
If wrong: Typically, the health policies are in pairs, one for NAP-compliant and the other for NAP-noncompliant.

Q: What does the acronym NTLM stand for?
- NT Link Messenger
- NT Link Manager
- NT LAN Manager
- NT LAN Messenger
A: NT LAN Manager
If right: NT LAN Manager (NTLM) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.
If wrong: NT LAN Manager (NTLM) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.

Q: What is the default authentication protocol for non-domain computers?
- NTLM
- PAP
- CHAP
- Kerberos
A: NTLM
If right: Although Kerberos is the default authentication protocol for todays domain computers, NTLM is the default authentication protocol for Windows NT, standalone computers that are not part of a domain, and situations in which you authenticate to a server using an IP address.
If wrong: Although Kerberos is the default authentication protocol for todays domain computers, NTLM is the default authentication protocol for Windows NT, standalone computers that are not part of a domain, and situations in which you authenticate to a server using an IP address.

Q: What type of protocol is Kerberos?
- a secure network authentication protocol
- a simple Microsoft-only protocol
- a uni-directional authentication protocol
- a certificate-based authentication protocol
A: a secure network authentication protocol
If right: Kerberos is a computer network authentication protocol that allows hosts to prove their identity securely over a non-secure network.
If wrong: Kerberos is a computer network authentication protocol that allows hosts to prove their identity securely over a non-secure network.

Q: NTLM uses a challenge-response mechanism for authentication without doing what?
- revealing the client’s operating system to the server
- revealing the protocol to the server
- sending a password to the server
- sending an encrypt/decrypt message to the server
A: sending a password to the server
If right: NTLM uses a challenge-response mechanism for authentication in which clients can prove their identities without sending a password to the server.
If wrong: NTLM uses a challenge-response mechanism for authentication in which clients can prove their identities without sending a password to the server.

Q: What are the two restrictions for adding SPNs to an account?
- Domain Administrator privileges
- full control permissions for the folder
- local administrator privileges
- the editor runs from the domain controller
A: Domain Administrator privileges; the editor runs from the domain controller
If right: To configure an SPN for a service or application pool account, you must have domain administrative permissions or a delegation to modify the ServicePrincipalName property. You also must run ADSI Edit from a domain controller.
If wrong: To configure an SPN for a service or application pool account, you must have domain administrative permissions or a delegation to modify the ServicePrincipalName property. You also must run ADSI Edit from a domain controller.

Q: Which tool can you use to add SPNs to an account?
- Notepad
- LDAP
- Microsoft Word
- ADSI Edit
A: ADSI Edit
If right: You can use ADSI Edit to add SPNs to an account.
If wrong: You can use ADSI Edit to add SPNs to an account.

Q: What type of account is an account under which an operating system, process, or service runs?
- user
- system
- service
- network
A: service
If right: A service account is an account under which an operating system, process, or service runs.
If wrong: A service account is an account under which an operating system, process, or service runs.

Q: Identify another utility that you can use to add SPNs to an account.
- dnscmd
- spnedit
- setspn
- netsh
A: setspn
If right: You can use setspn.exe to add SPNs to an account.
If wrong: You can use setspn.exe to add SPNs to an account.

Q: What is the default maximum allowable time lapse between domain controllers and client systems for Kerberos to work correctly?
- 1 minute
- 5 minutes
- 15 minutes
- 45 minutes
A: 5 minutes
If right: For all of this to work and to ensure security, the domain controllers and clients must have the same time. Windows operating systems include the Time Service tool (W32Time service). Kerberos authentication will work if the time interval between the relevant computers is within the maximum enabled time parameters. The default is five minutes.
If wrong: For all of this to work and to ensure security, the domain controllers and clients must have the same time. Windows operating systems include the Time Service tool (W32Time service). Kerberos authentication will work if the time interval between the relevant computers is within the maximum enabled time parameters. The default is five minutes.