Network security Chapter 4

Which Microsoft tool can be used to review a system's security configuration against recommended settings?

• Registry Editor
• Windows Defender
• Microsoft Security Compliance Toolkit
• Microsoft Internet Explorer

Answer explanation

The Microsoft Security Compliance Toolkit allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products. Internet Explorer is a web browser. Registry Editor is used to change settings in the Windows Registry. Windows Defender uses signatures to identify malicious applications.

Which type of update should be prioritized even outside of a normal patching window?

• Security updates
• Critical updates
• Monthly updates
• Microsoft updates

Answer explanation

The correct answer is critical updates. These updates are often marked critical because of the severity of the exploit or how widespread it is. Microsoft, monthly, and security updates do not necessarily demand to be installed outside of a normal patching window.

Prepare to Document means establishing the process you will use to document your network. Which of the following makes this documentation more useful?

• Identify the choke points on the network.
• Identify who is responsible for each device.
• Automate administration as much as possible.
• Have a printed hard copy kept in a secure location.

Answer explanation

Prepare to Document means establishing the process you will use to document your network. A useful document: Is easy to use Includes enough detail Documents the important things Uses timestamps Is protected with restricted access and possibly encryption Has a printed hard copy kept in a secure location Identifying who is responsible for each device is included in the Map Your Network milestone. Identifying the choke points on the network is included in the Protect Your Network milestone. Automating administration as much as possible is included in the Reach Your Network milestone.

Documenting procedures and processes are part of which milestone in the NSA's Manageable Network Plan?

• Document Your Network
• Prepare to Document
• Control Your Network
• Reach Your Network

Answer explanation

Milestone 8 (Document Your Network) is the milestone of the plan that includes documenting procedures and processes. Milestone 1 (Prepare to Document) establishes the guidelines for how to create documentation. Milestone 4 (Reach Your Network) defines how to maintain secure access to network devices. Milestone 5 (Document Your Network) defines how to limit access to network devices.

In which milestone should you use a network scanner and then confirm the scan manually with a room-by-room walkthrough?

• Reach Your Network
• Prepare to Document
• Map Your Network
• Protect Your Network

Answer explanation

The Map Your Network milestone ensures that you are aware of all the components of the network and that you know where the physical devices are. The steps are: Create a map of the network topology. Create a list of all devices. Don't forget to include wireless devices. Use a network scanner and then confirm the scan manually with a room-by-room walkthrough. Identify who is responsible for each device and detail other information, such as IP address, service tag, and physical location. Consider using a database file to store the information. Create a list of all protocols being used on the network by using a network analyzer. Consider removing unauthorized devices and protocols from your network. The Prepare to Document milestone means establishing the process you will use to document your network. The Protect Your Network (network architecture) milestone identifies the necessary steps to protect your network. The Reach Your Network (device accessibility) milestone helps to ensure that all of the devices on your network can be easily accessed while still maintaining each device's security. Accessibility includes physical access as well as remote access.

Windows Server Update Services (WSUS) is used to accomplish which part of a manageable network?

• Device accessibility
• User access
• Documentation
• Patch management

Answer explanation

Patch management is managed by Windows Server Update Services (WSUS) by keeping Windows systems up to date. WSUS does not help with documentation, controlling user access, or ensuring devices are accessible.

You have recently been hired as the new network administrator for a startup company. The company's network was implemented prior to your arrival. One of the first tasks you need to complete in your new position is to develop a manageable network plan for the network. You have already completed the first and second milestones, in which documentation procedures were identified and the network was mapped. You are now working on the third milestone, which is identifying ways to protect the network.

• Physically secure high-value systems.
• Create an approved application list for each network device.
• Apply critical patches whenever they are released.
• Set account expiration dates.
• Identify and document each user on the network.

Answer explanation

In the third milestone (Protect Your Network), you should take the following steps: Identify and document each user on the network and the information he or she has access to. Identify high-value network assets. Document the trust boundaries. Identify the choke points on the network. Segregate and isolate networks. Isolate server functions. Physically secure high-value systems. Setting account expiration dates is part of the fifth milestone (Control Your Network). Applying critical patches and creating an approved application list are both tasks associated with the sixth milestone (Manage Your Network).

For Milestone 4 (Reach Your Network), which of the following would be considered a secure protocol to use to reach your network?

• SSH
• Telnet
• HTTP
• FTP

Answer explanation

Of the protocols listed, only Secure Shell (SSH) is encrypted. The other protocols would expose data to being easily intercepted.

As you go through the process of making your network more manageable, you discover that employees in the sales department are on the same network segment as the human resources department. Which of the following steps can be used to isolate these departments?

• Implement the principle of least privilege for the human resources department.
• Identify the choke points on your network.
• Create a separate VLAN for each department.
• Move the sales department into the DMZ.

Answer explanation

VLANs can be used to isolate these departments. The sales department is not a lower-trust part of the network, so they do not belong in the DMZ. You would identify choke points as part of the process of limiting the number of internet access points on your network in order to decrease the attack surface. The principle of least privilege is used to control user access to network resources. However, this principle does not segregate and isolate network segments from each other.

Which of the following tools can you use on a Windows network to automatically distribute and install software and operating system patches on workstations? (Select two.)

• Security Configuration and Analysis
• Security Templates
• WSUS
• Group Policy

Answer explanation

Windows Software Update Services (WSUS) is a patch management tool that allows clients on a network to download software updates from an internal WSUS server in their organization. The WSUS server receives a list of available updates from Microsoft. On the WSUS server, you identify allowed or required patches for your organization. Clients download only approved patches from an internal WSUS server or directly from Microsoft. You can also use Group Policy to distribute and automatically install patches. You must use Group Policy to install updates to non-Microsoft software that is not supported with WSUS. Use the Security Templates snap-in to create and edit templates that enforce system security settings. Use the Security Configuration and Analysis snap-in to compare the existing settings with the template or to apply a template to a single device. Use Group Policy to automatically apply security templates.