Chapter 3

Question 1

True or False? In Windows, members of the IIS_IUSRS group may create and modify most types of accounts and can log in locally to domain controllers.

Answer 1

False

Question 2

True or False? In the Windows operating system environment, all users, groups, and computers have unique security identifiers (SIDs).

Answer 2

True

Question 3

What is Kevin defining when he uses security policy to detail what tasks the organization’s users can perform on their computers?

Answer 3

User rights

Question 4

What should Oscar do as a first step to prevent contractors from viewing each other’s project files?

Answer 4

Enable an expression-based security audit policy to track contractors’ access

Question 5

Which of the following stores all user and computer Kerberos master keys?

Answer 5

Key distribution center (KDC)

Question 6

True or False? Windows Event Viewer enables auditing of event records.

Answer 6

True

Question 7

What does Microsoft assign to distinguish objects that may originate from different computers?

Answer 7

Globally unique identifier (GUID)

Question 8

Which principle describes the best balance between providing necessary access for authorized subjects and denying unnecessary access?

Answer 8

The principle of least privilege

Question 9

Which command-line tool, first introduced with Windows 2000, is used to display or modify access control lists for files and folders?

Answer 9

Cacls.exe

Question 10

Which of the following describes a collection of features used to describe user and data attributes?
* Security Access Token (SAT)
* Effective permissions
* Dynamic Access Control (DAC)
* Rights Management Services (RMS)

Answer 10

Dynamic Access Control (DAC)

Question 11

True or False? Dynamic Access Control (DAC) can help a user identify and classify data.

Answer 11

True

Question 12

True or False? Providing just the necessary access required to carry out a task is called the principle of least privilege.

Answer 12

True

Question 13

True or False? Each entry in a discretionary access control list (DACL) is called an access control entry (ACE).

Answer 13

True

Question 14

True or False? The token that Windows uses to store security identifiers (SIDs) is called the Security Access Token (SAT).

Answer 14

True

Question 15

True or False? In Windows, the Security Access Token (SAT) contains Windows Registry information.

Answer 15

False

Question 16

An access control strategy that gives a user or group of users only those powers that are absolutely essential to do the job required is called the:

Answer 16

Principle of least privilege

Question 17

Which access control permission enables you to change the content of a file once it is saved?

Answer 17

Modify

Question 18

In Windows, ________control access to network resources, such as servers or printers.
* NTFS permissions
* folder-level permissions
* privileged permissions
* share permissions**

Answer 18

Share permissions

Question 19

Which icacls.exe command would allow members of the Managers group to modify, read, and execute files in the C:\LabDocuments\MGRfiles folder?
* icacls C:\LabDocuments\MGRfiles /set Managers:(M, RX)
* icacls C:\LabDocuments\MGRfiles /set Managers:(M, RE)
* icacls C:\LabDocuments\MGRfiles /grant Managers:(M, RE)
* icacls C:\LabDocuments\MGRfiles /grant Managers:(M, RX)

Answer 19

icacls C:\LabDocuments\MGRfiles /grant Managers:(M, RX)

Question 20

In the icacls.exe help file (icacls.txt), which symbol would grant no access to the file or folder?

Answer 20

N

Question 21

True or False? In Windows, the Security Access Token (SAT) is specific to a folder.

Answer 21

False

Question 22

Which feature do systems administrators need to manage account passwords automatically at the domain level?
* Universally unique identifiers (UUIDs)
* Kerberos keys
* Discretionary access control lists (DACLs)
* Managed service accounts

Answer 22

Managed service accounts

Question 23

True or False? In the context of access control, security controls must provide object access for all authorized subjects.

Answer 23

True

Question 24

True or False? A security identifier (SID) identifies a security subject or group of subjects.

Answer 24

True

Question 25

True or False? Microsoft refers to user accounts defined using the principle of least privilege as Administrators.

Answer 25

False

Question 26

Which Windows Server security feature includes automatic Rights Management Services (RMS) for encrypting sensitive documents? * Dynamic Access Control (DAC) * Discretionary access control list (DACL) * File Classification Infrastructure (FCI) * User Account Control (UAC)

Answer 26

Dynamic Access Control (DAC)

Question 27

In Windows, which group has a two-piece, or split, Security Access Token (SAT)?

Answer 27

Administrators

Question 28

Which default Active Directory security group in Windows Server has unrestricted access to the computer or domain?

Answer 28

Administrators

Question 29

Which term describes what a user can do to an object on a computer? * Rights * Permissions * Authentication * Access control

Answer 29

Permissions

Question 30

True or False? In Windows, auditing is the process of collecting performance information on actions taken and storing that information for later analysis.

Answer 30

True

Question 31

In the icacls.exe help file (icacls.txt), which symbol would grant modify access to the file or folder?

Answer 31

M

Question 32

Security practitioners help to create policies and controls that enforce a layered defense, referred to as: * user control. * defense control. * defense in depth. * essential defense.

Answer 32

Defense in depth