You need to create a security template based on the roles, features, and options that are configured on the ba
All servers in your environment run Windows Server 2003. You plan to deploy a Web farm of IIS servers. You configure a baseline IIS server to meet all corporate security requirements. You are preparing to create a security template from the baseline IIS server and to apply it to the other IIS servers. You need to create a security template based on the roles, features, and options that are configured on the baseline IIS server.
What should you use?
You need to ensure that clients in Site1 are authenticated by the domain controller in Site3
Your company has offices in three locations. You have an Active Directory directory service domain with three Active Directory sites named Site1, Site2, and Site3. Each site represents a physical location with multiple subnets. There is one domain controller in each site. All sites are connected through site links. The domain controller in Site1 is not accessible. You need to ensure that clients in Site1 are authenticated by the domain controller in Site3. What should you do?
Which predefined security template should you use?
Your company has an Active Directory directory service domain. All servers run Windows Server 2003. Your security baseline requires you to control local group membership on all member servers. You need to automatically remove users from the Power Users group on member servers. You must ensure that only the Domain Admins security group and the local Administrator account are members of the local Administrators group.
Which predefined security template should you use?
You need to ensure that the application is available for all users on each client computer, even if another us
You have a single Active Directory directory service domain. Users each have a primary client computer but also frequently use shared client computers. You use a Group Policy object (GPO) to publish an application to the users in the marketing department. The users can remove the application when they no longer need it. Some users report that when they log on to a shared client computer on which the application has been removed, the application is no longer available to install. You need to ensure that the application is available for all users on each client computer, even if another user removes the application. What should you do?
Which two actions should you perform? (Each correct answer presents part of the solution
Your company has an Active Directory directory service domain. All servers are located in a single organizational unit (OU). You install Windows Server 2003 on a new server named Server1, and you configure all security settings.
You plan to install Windows Server 2003 on additional servers and to apply the security settings from Server1 to the new servers.
You need to apply the security settings to the new servers before they are joined to the domain.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)
You need to remove this application from only a specific group of computers
Your network consists of Windows Vista computers joined to an Active Directory directory service domain. All client computers are located in an organizational unit (OU) named Clients. A Group Policy object (GPO) is linked to the Clients OU. This GPO assigns a new application to all computers in the Clients OU and uses the Uninstall the application when it falls out of the scope of management Group Policy setting. You need to remove this application from only a specific group of computers. What should you do?
You need to ensure that all passwords for user accounts that are stored on the new member servers are protecte
Your company has a single Active Directory directory service domain. All servers in the environment run Windows Server 2003. You are designing the baseline image for new member servers. You need to ensure that all passwords for user accounts that are stored on the new member servers are protected by using strong encryption. Your solution must ensure that decryption is not possible without two-factor authentication.
What should you do?
You need to ensure that you can log on to both domain controllers as the Administrator from the domain
You are the network administrator for your company. The network consists of a single Active Directory domain that contains two domain controllers. Both domain controllers run Windows Server 2003. All client computers run Windows XP Professional. The only account in the Domain Admins security group is the Administrator account in the domain. Each night, a full backup is made of the hard disks in each domain controller. You disable the local Administrator account in the Default Domain Policy Group Policy object (GPO). You discover that you are no longer able to log on to either domain controller as the Administrator from the domain. You need to ensure that you can log on to both domain controllers as the Administrator from the domain. What should you do?
How many security policies should you create?
Your company has a single Active Directory directory service domain. The company has the servers shown in the following table.
You intend to use the Security Configuration Wizard (SCW) to create security templates for domain controllers, DNS servers, and DHCP servers.
You need to create the minimum number of security policies.
How many security policies should you create?
You need to ensure that users cannot run any application that is not currently assigned to them
You are the network administrator for your company. Your network consists of a single Active Directory domain. All servers run Windows Server 2003. All client computers run Windows XP Professional. Employees use client computers and also use Remote Desktop to connect to a terminal server named TS1. All users in your company have user accounts in an organizational unit (OU) named Company Users. All users receive applications that are assigned to their user accounts by Group Policy objects (GPOs) linked to the Company Users OU. The GPOs use security filtering to control which security groups receive which applications. Users report that when using TS1, their assigned applications are not available. You need to configure your network so that the applications are available to users when they connect to TS1. You need to ensure that users cannot run any application that is not currently assigned to them. What should you do?

