Title: Lesson 6: Quiz
Course: RITA MC - ITNW 1308 > Section: Lesson 6: Controlling Access to Local Hardware and Applications

Q: What is the largest danger that high-capacity removable storage devices pose to an enterprise network?
- Data can be brought into the network that is not authorized.
- Data can be taken out of the network without authorization.
- Data can be brought into the network that is unsafe.
- Data is being insufficiently backed up more often than not when placed on removable storage.
A: Data can be taken out of the network without authorization.
Feedback: High-capacity removable disks and drives are dangerous to enterprise networks in that they can allow data in, as well as carry it out. Users can easily introduce unauthorized software into the environment, and they can also copy corporate data and carry it out. Exfiltration of data in an unauthorized fashion, or without required protections (e.g., encryption) poses the largest danger to enterprise networks when dealing with removable storage devices.

Q: When using the Allow/Prevent installation of devices that match any of these device IDs setting in the Device Installation Restrictions folder of a GPO, what other setting must you ensure you also configure to provide the intended results?
- Allow/Prevent installation of devices using drivers that match these device setup classes.
- Prevent installation of devices not described by other policy settings.
- Allow administrators to override Device Installation Restriction policies.
- Prevent installation of devices with unsigned drivers.
A: Prevent installation of devices not described by other policy settings.
Feedback: Using the Allow/Prevent installation of devices that match any of these device IDs option enables you to allow or prevent installation or update of device drivers based on their Plug and Play hardware IDs. Use this Allow setting only when the Prevent installation of devices not described by other policy settings is also enabled.

Q: To exclude just MP3 players and digital cameras from being installed on your organization’s computers, which Removable Storage Access setting should you configure to deny?
- Custom Classes
- All Removable Storage
- WPD Devices
- All Removable Storage classes
A: WPD Devices
Feedback: If you configure the WPD Devices: Deny read/write access setting, you can deny users read and/or write access to all the Windows Portable Devices in the computer, including smartphones, MP3 players, and cameras.

Q: In order to use the Custom Classes: Deny read/write access setting of the Removable Storage Access policy settings, what will you need to know about each device to which you wish to allow read or write access?
- The manufacturer part number
- The device GUID
- The device bus ID
- The drive name
A: The device GUID
Feedback: You can use the Custom Classes: Deny read/write access setting to deny users read and/or write access to custom device classes identified by their GUIDs

Q: What disadvantage is encountered when using Software Restriction Policies?
- They will not work with Windows 8.1.
- They will only work with Windows 8.1.
- They must be configured manually.
- They can only be used in domain Group Policy.
A: They must be configured manually.
Feedback: Software restriction policies are Group Policy settings that enable administrators to specify the programs that are allowed to run on workstations by creating rules of various types. Software restriction policies have been around for years, and their main advantage is that you can create one set of policies that apply to Windows XP, Windows Vista, and Windows 7 workstations, as well as Windows 8.1. The disadvantage of software restriction policies is that, unlike the newer AppLocker feature, you can only create rules manually and individually.

Q: Software restriction policies can work in three ways, based on the settings you choose for each of the rules. Which of the following is not one of the settings to choose from?
- Allowed
- Basic user
- Disallowed
- Unrestricted
A: Allowed
Feedback: Software restriction policies can work in three ways, based on the settings you choose for each of the rules. The three possible settings are as follows: - Disallowed: Prevents an application matching a rule from running. - Basic user: Allows all applications not requiring administrative privileges to run. Allows applications that do require administrative privileges to run only if they match a rule. - Unrestricted: Allows an application matching a rule to run.

Q: When none of your configured Software Restriction Policies are matched, what happens?
- No action is taken.
- The software is blocked.
- The settings in the default rule are used.
- The settings in the first rule are used.
A: The settings in the default rule are used.
Feedback: The default rule applies when an application does not match any of the other rules you have created. To configure the default rule, you select one of the policies in the Security Levels folder and click Set As Default on its Properties sheet.

Q: There are four types of rules in AppLocker. Which of the following is not one these rule types?
- Executable rules
- Downloaded App rules
- Packaged App rules
- Script Rules
A: Downloaded App rules
Feedback: In the AppLocker container in a GPO, there are four nodes that contain the basic rule types, as follows: - Executable Rules: Contains rules that apply to files with .exe and .com extensions. - Windows Installer Rules: Contains rules that apply to Windows Installer packages with .msi and .msp extensions. - Script Rules: Contains rules that apply to script files with .ps1, .bat, .cmd, .vbs, and .js extensions. - Packaged app Rules: Contains rules that apply to applications purchased through the Windows Store.

Q: Which of the following operating systems are capable of utilizing AppLocker rules? (Choose all that apply.)
- Windows 7
- Windows Server 2008
- Windows Server 2012
- Windows 8.1
A: Windows 7; Windows Server 2012; Windows 8.1
Feedback: The primary disadvantage of AppLocker is that you can only apply the policies to computers running Windows 7, Windows 8.1, Windows Server 2008 R2, and Windows Server 2012.

Q: When configuring AppLocker rules, you can opt to either allow or block access to specific resources based on three criteria. Which of the following is not one of those criteria?
- Publisher
- Path
- Source
- File hash
A: Source
Feedback: Each of the AppLocker rules you create can allow or block access to specific resources, based on one of the following criteria: - Publisher - Path - File Hash

Q: When creating AppLocker rules manually, you will need to supply several pieces of information to fully configure the rule. Which of the following are pieces of information that you will need to supply? (Choose all that apply.)
- Exceptions
- Action
- User or group
- Conditions
A: Exceptions; Action; User or group; Conditions
Feedback: You will be expected to supply information about all four of these items to fully configure an AppLocker rule manually.

Q: Which of the following is not an AppLocker rule collection type available for usage when creating AppLocker rules?
- Executable files
- Unsigned files
- Scripts
- Packaged apps
A: Unsigned files
Feedback: Rule collections include: - Executable files (.exe, .com) - Scripts (.ps2, .bat, .js, .cmd, .vbs) - Windows Installer files (.msi, .mst, .msp) - Appx (Packaged apps and Packaged app installers; .appx)-This includes Windows apps and sideloaded LOB apps.

Q: When you create your first new rule in AppLocker, what will happen if you do not have the default rules in place?
- You will not be able to create the rule.
- You will be prompted to create the default rules.
- Your rule will be disabled until the default rules are created.
- The default rules will not override your rule.
A: You will be prompted to create the default rules.
Feedback: If you create an AppLocker rule and dont have the default rules created yet, Windows will prompt to you create the default rules.

Q: When creating AppLocker rules, which option should you choose first to start the option to allow all currently installed Windows apps to run, with the exception of one that you will select later?
- Create New Rule
- Automatically Generate Rules
- Create Default Rules
- Automatically Allow All Apps
A: Automatically Generate Rules
Feedback: The Automatically Generate Rules option starts a wizard that allows you to create rules for multiple packaged apps in a single step. You can select a folder and let the wizard create the applicable rules for the files in the folder; or, for packaged apps, the Wizard can create rules for all Windows apps on your computer. After this has been done, you can then select the Create New Rule option to start a wizard to create a rule to restrict a specific Windows app.

Q: Why does AppLocker need to create the “Default Rules”?
- So that your custom AppLocker rules will work
- So that you won’t inadvertently block key Windows paths for execution
- So that your users won’t be able to override your AppLocker rules
- So that AppLocker knows what software you want to restrict
A: So that you won’t inadvertently block key Windows paths for execution
Feedback: The Create Default Rules option is meant to ensure that some key Windows paths are allowed for execution (c:\Windows or c:\Program files).

Q: Which of the following is the default configuration of AppLocker?
- Only signed applications from Microsoft can be run.
- All applications can run.
- No applications can run.
- Only signed applications from trusted sources can be run.
A: All applications can run.
Feedback: By default, there are no rules in any of the rule collections; therefore, AppLocker allows every file covered in each collection to run.

Q: Using a single Microsoft account, on how many Windows 8.1 devices can you install a specific Windows app?
- 3
- 5
- 7
- 9
A: 5
Feedback: You can install the app on as many as five Windows 8.1 devices using the same account.

Q: What feature of Windows 8.1 can be used to restrict access to specific Windows Store content?
- Software Restriction Policies
- AppLocker
- Windows Store Restrictions
- App Permissions
A: AppLocker
Feedback: You can restrict access to the Windows Store content by using AppLocker, which can be used to control which Windows apps are allowed to run through the configuration of rules and properties. In older versions of Windows, this feature was known as Software Restriction Policies.

Q: Which AppLocker rule collections should you use to prevent users from installing new commercial software on your organization’s computers? (Choose all that apply.)
- Executable files
- Scripts
- Windows Installer files
- Appx
A: Executable files; Windows Installer files
Feedback: The Executable files (.exe, .com) and Windows Installer files (.msi, .mst, .msp) rule collections would be best used in this scenario since the vast majority of software you are looking to restrict will likely be .exe or .msi in nature.

Q: How can you configure Window 8.1 to be used as a kiosk?
- Use System Configuration to specify kiosk mode.
- Add the application into the Startup folder.
- Boot the computer into secure safe mode.
- Create a local account specifically for that purpose, and you associate it with an app that you have already installed.
A: Create a local account specifically for that purpose, and you associate it with an app that you have already installed.
Feedback: In Windows 8.1, you can associate a local user account with a single Windows app, so that the app launches when the user logs on to the system. Once in that app, the user cannot launch another app. The system also suppresses all notifications and disables all of the key combinations, gestures, and shortcuts that provide access to the underlying system components.