MEM Audit

Your company has an Active Directory domain that has an organizational unit named Sales. The Sales organizational unit contains two global security groups named sales managers and sales executives. You need to apply desktop restrictions to the sales executives group. You must not apply these desktop restrictions to the sales managers group. You create a GPO named DesktopLockdown and link it to the Sales organizational unit. What should you do next?

• Configure the Deny Apply Group Policy permission for Authenticated Users on the DesktopLockdown GP

• Configure the Deny Apply Group Policy permission for the sales executives on the DesktopLockdown GP

• Configure the Allow Apply Group Policy permission for Authenticated Users on the DesktopLockdown GP

• Configure the Deny Apply Group Policy permission for the sales managers on the DesktopLockdown G

Your company has file servers located in an organizational unit named Payroll. The file servers contain payroll files located in a folder named Payroll. You create a GPO. You need to track which employees access the Payroll files on the file servers. What should you do?

• Enable the Audit process tracking option

• .Link the GPO to the Domain Controllers organizational unit

• On the file servers, configure Auditing for the Authenticated Users group in the Payroll folder

• On the file servers, configure Auditing for the Everyone group in the Payroll folder

• On the domain controllers, configure Auditing for the Authenticated Users group in the Payroll folder

You need to ensure that users who enter three successive invalid passwords within 5 minutes are locked out for 5 minutes. Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.)

• Set the Account lockout duration setting to 5 minute

• Set the Reset account lockout counter after setting to 5 minute

• Set the Account lockout threshold setting to 3 invalid logon attempt

• Set the Enforce password history setting to 3 passswords remembere

• Set the Minimum password age setting to one day

Your company has an Active Directory forest. The forest includes organizational units corresponding to the following four locations: . London . Chicago . New York . Madrid Each location has a child organizational unit named Sales. The Sales organizational unit contains all the users and computers from the sales department. The offices in London, Chicago, and New York are connected by T1 connections. The office in Madrid is connected by a 256-Kbps ISDN connection. You need to install an application on all the computers in the sales department. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

• Create a Group Policy Object (GPO) named OfficeInstall that assigns the application to user

• Link the GPO to each Sales organizational unit

• Disable the slow link detection setting in the Group Policy Object (GPO).

• Configure the slow link detection threshold setting to 1,544 Kbps (T1) in the Group Policy Object (GPO)

• Create a Group Policy Object (GPO) named OfficeInstall that assigns the application to the computer

You need to identify all failed logon attempts on the domain controllers. What should you do?

• View the Netlogon.log file

• View the Security tab on the domain controller computer object

• Run Event Viewer

• Run the Security and Configuration Wizard

You have a domain controller named DC1 that runs Windows Server. DC1 is configured as a DNS Server for contoso.com. You install the DNS Server role on a member server named Server1 and then you create a standard secondary zone for contoso.com. You configure DC1 as the master server for the zone. You need to ensure that Server1 receives zone updates from DC1. What should you do?

• On DC1, modify the permissions of contoso.com zone

• On Server1, add a conditional forwarde

• On DC1, modify the zone transfer settings for the contoso.com zone

• Add the Server1 computer account to the DNSUpdateProxy group

All consultants belong to a global group named TempWorkers. You place three file servers in a new organizational unit named SecureServers. The three file servers contain confidential data located in shared folders. You need to record any failed attempts made by the consultants to access the confidential data. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

• Create and link a new GPO to the SecureServers organizational unit

• Configure the Deny access to this computer from the network user rights setting for the TempWorkers global group

• Create and link a new GPO to the SecureServers organizational unit

• Configure the Audit privilege use Failure audit policy setting

• Create and link a new GPO to the SecureServers organizational unit

Which event is user interaction?

• Gaining root access

• executing remote code

• reading and write file permission

• Opening a malicious file

Which security principle requires more than one person is required to perform a critical task?

• least privilege

• need to know

• separation of duties

• due diligence

Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

• decision making

• rapid response

• data mining

• due diligence