Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

70-744 > Implment Server Hardening Solutions > Flashcards

Implment Server Hardening Solutions Flashcards

Secure Boot BitLocker EFS Malware/Defender CredGuard DeviceGuard Security Baselines

1
Q

What is Secure Boot?

A

SecureBoot is part of UEFI 2.3.1 that ensures a server only boots using trusted hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How does Secure Boot work?

A
  • Secure Boot checks each piece of software used in boot, including ROMs and the OS, against a database containing the signatures of well-known signatures kept in firmware.
  • If the software is valid, boot proceeds.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does Secure Boot protect against?

A

The execution of unsigned (malicious) code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the requirements of Secure Boot?

A

UEFI Version 2.3.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Secure Boot boot sequence?

A
  1. PC is powered on. Signature databases are checked against the platform key.
  2. If the firmware is not trusted, UEFI must initiate OEM-specific recovery to restore trusted firmware.
  3. If a problem with the Windows Boot Manager, firmeware will boot to a copy.
    3a. If this Fails - Firmware initiates firmware recovery.
  4. Once Windows Boot Manager is running, if there are drive issues or kernel issues, WinRE is booted so the image/drivers can be recovered.
  5. Windows loads AntiMalware
  6. Windows loads other kernel drivers and initializes user mode.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the benefits of UEFI?

A
  • Security: Secure Boot, Device Guard, Credential Guard, Exploit Guard, etc. all require secure boot, which requires UEFI.
  • Faster Boot
  • Support for larger hard drives (+2TB) and drives with more partitions.
  • Support for multicast deployments
  • Support for better UEFI drivers, applications, and ROMs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How does AV play into secure boot?

A

Antivirus is signed by MS verifying it is a trusted boot critical driver and launches early in the boot process. This ensures that no processes are able to get in the middle of AV startup and prevent AV from protecting a system early.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What versions of TPM are supported by Server 2016?

A

TPM 1.2 and TPM 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is TPM 2.0 backwards compatible with 1.2?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you verify whether a system has an available TPM?

A
  • Device Manager \ Security Devices

- UEFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Is a TPM always a physical piece of hardware?

A

No. Some TPMs are firmware based. Windows works with either hardware or firmware-based TPMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is required before a TPM can be used?

A

It must be installed and provisioned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is required to manually provision a TPM?

A

Server 2016+ automatically provisions a TPM, however, if the OS is being reinstalled the TPM may need cleared before utilizing the TPM for the OS to take full advantage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the advantages of TPM 2.0 over TPM 1.2?

A
  • TPM 1.2 only supports RSA and SHA-1. TPM 2.0 supports newer algorithms (e.g. SHA-256)
  • TPM 2.0 enables greater crypto agility by being more flexible with the different crypto algorithms.
  • TPM 2.0 is more consistent across different implementations.
  • TPM 2.0 has a default lockout configured by Windows
  • TPM 1.2 always was a discrete component. TPM 2.0 can be implemented as a single package on the board and integrated into other components or run as firmware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Can TPM 2.0 work with BIOS?

A

No. TPM 2.0 only supports UEFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What different implementation options exist for TPMs?

A
  • Discrete TPMs - Separate components on the board
  • Integrated TPMs - Use dedicated hardware integrated into other hardware
  • Firmware TPM - Runs in Trusted Execution Mode
    NOTE: Windows is compatible with all these TPM implementations.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which versions of Windows support TPM 2.0?

A
  • All versions of Windows 10
  • IoT Core (optional)
  • Server 2016 +
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What different windows features are available with TPM 2.0 over 1.2?

A
  • Windows Defender System Guard
  • AutoPilot
  • SecureBIO
  • DRTM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which Windows features/components require TPM of any variety?

A
  • Measured Boot
  • BitLocker
  • Drive Encryption
  • Windows Defender System Guard
  • Device Health Attestation
  • TPM Platform Crypto Provider Key Storage Provider
  • Virtual Smart Card
  • AutoPilot
  • SecureBIO
  • DRTM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which Windows Features/components do not require a TPM of any variety?

A
  • Windows Defender Application Control (Device Guard)
  • Credential Guard
  • Windows Hello
  • UEFI Secure Boot
  • Certificate Storage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which versions of Windows 10 and Server 2016 support BitLocker?

A
  • All editions of Server 2016

- All versions excluding Windows 10 Home support BitLocker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can you BitLocker Windows 10 Home?

A

No. It does not support BitLocker. It does support a stripped down version of BitLocker called “Device Encryption.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does BitLocker protect against?

A
  • Lost, stolen or inappropriately decommissioned devices

- BitLocker also verifies the boot process integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is required on a system for BitLocker to offer the most protection?

A

TPM 1.2 or later

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Can BitLocker be implemented on a device without TPM 1.2 or newer?

A
  • Yes. However, it will require either a USB key to start or resume from hibernation.
  • Windows 8 and Newer may use a password to protect systems without TPMs
  • Without a TPM, there are no pre-startup system integrity verification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is BitLocker Recovery Password Viewer?

A
  • An extension to AD that enables locating and viewing BitLocker Drive Encryption recovery passwords that have been backed up to AD
  • Can be used to help recover data that is stored on a drive encrypted with BitLocker
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How do you view BitLocker Recovery Passwords stored in AD?

A
  • Right Click the computer object in AD \ Properties

- Right-Click the domain container and search for the recovery password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

To view BitLocker recovery passwords, by default, what permission is required?

A

Domain Administrator. This can be delegated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What tools are provided with the BitLocker Drive Encryption Tools?

A
  • Command Line: manage-bde and repair-bde

- Powershell Cmdlets for Powershell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Repair-BDE used for?

A

Disaster recovery scenarios where a BitLocker protected drive cannot be unlocked normally using the recovery console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the BitLocker hardware requirements?

A
  • For system integrity check: Use TPM 1.2 or newer
  • Without a TPM, BitLocker requires a startup key on a removable drive (e.g. USB)
  • TPMs must have a TCG-compliant BIOS or UEFI (not required for non-TPM)
  • BIOS must support usb mass storage, inlucidng reading small files in a pre-OS environment.
  • Hard disk must be partitioned with at least 2 partitions/volumes
    • OS (Boot) Drive must be NTFS
    • System drive with files used to load Windows after firmware has prpared the drive. Not BitLocker protected. Must be formatted FAT32 (UEFI) or NTFS (Bios). Recommended size 350MB
    • Windows should be able to create these partitions automatically.
  • When installing BitLocker on a server OS use the Enhanced Storage Feature for hardware encryption drive support.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What new BitLocker features were introduced in Server 2016?

A
  • XTS-AES Support
  • Encrypt and recover device with Azure AD
  • DMA Port protection
  • GPO for Configuring Pre-Boot Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the differences between different encryption version types offered by BitLocker?

A
  • AES-128: Default
  • AES-256: Same as 128 but double cipher length
  • XTS-AES-128: FIPS Compliant, Incompatible with pre-Server 2016
  • XTS-AES-256: Same as XTS-AES-128 but double cipher length
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Why is it recommended to not use a kernel debugger while BitLocker is enabled?

A
  • Kernel debugger may be able to access BitLocker keys and other sensitive data
  • If a debugger is used, OS will automatically restart after every boot.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

With Server 2008 and Windows Vista, how do you configure BitLocker if the computer already has an OS installed?

A

Utilize the “BitLocker Drive Preparation Tool” to configured required volumes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What different key protectors are available with BitLocker?

A
  • TPM
  • PIN (Numeric)
  • Enhanced PIN (Alphanumeric)
  • Startup Key
  • Recovery Password
  • Recovery Key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

You have deployed systems that do not have TPM 1.2 or higher and would like to secure them with BitLocker. What key protector/authentication method should be used?

A

Startup Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which BitLocker protection method provides the least amount of data protection and why? How can this be mitigated?

A

TPM-only. TPM-only protects against attacks to modify the early boot components. It encrypts drives, but, as in the case with a laptop, the TPM would still allow an attacker to boot the system and potentially compromise the storage within. This is mitigated by incorporating other factors to provide multi-factor access to the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the most transparent BitLocker authentication method that still offers MFA?

A

TPM + Network Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

To use Windows RE along with BitLocker, what must be done?

A

The Windows RE boot image must reside on the volume not protected by BitLocker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Can a system be BitLocker protected before the OS install?

A

yes. Using WinPE a randomly generated key can be applied to the formatted volume and encrypt it prior to the Windows install.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What different encryption options are available for BitLocker?

A

(Hint: What portion of the drive can be encrypted)

  • Used Space Only - Encrypts only used space. Useful for systems with freshly provisioned drives. Faster
  • Full encryption - Encrypts entire drive. Used for repurposed drives.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which GPO setting will ensure BitLocker data is backed up by AD?

A

Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ \ Choose how BitLocker protected drives can be recovered?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What data is stored for each computer object with BitLocker recovery information in AD?

A
  • 48-digit recovery password

- Key package data. Can be used to decrypt the drive if it is severely damaged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

When was FIPS support for the recovery password protector introduced?

A

Server 2012 R2/Windows 8.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the FIPS Standard?

A
  • US Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems used by the US Federal Government.
  • FIPS 140 defines approved cryptographic algorithms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How did BitLocker behave before FIPS support was introduced when it was placed in FIPS mode?

A
  • BitLocker would prevent the creation or use of recovery passwords and force users to create recovery keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How do servers running with FIPS support behave when in FIPS mode?

A
  • FIPS compliant recovery passwords can be created
  • FIPS compliant recovery passwords can be distinguished from those created with other systems.
  • FIPS compliant recovery passwords will unlock a drive and allow read/write access even while in FIPS mode
  • FIPS compliant recovery passwords may be exported to and stored in AD
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Can you use recovery passwords generated on FIPS mode systems from versions of Windows prior to Server 2012 R2 on servers running Server 2012 R2?

A

No. These are incompatible with one another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

If a computer was configured with a single partition, can BitLocker still be installed and configured?

A

Yes. BitLocker does require at least two partitions on a drive, however, the drive can be repartitioned without using data using the Bdehdcfg tool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What different tools can be used to turn on BitLocker Drive Encryption?

A
  • BitLocker Control Panel
  • Windows Explorer
  • Manage-bde command line
  • BitLocker Windows Powershell cmdlets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How do you enable BitLocker from the control panel?

A

Choose the Manage BitLocker option in the control panel. Select “Turn on BitLocker”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

When enabling BitLocker in the control panel, which drives show up?

A

Only formatted drives with assigned drive letters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

How do you utilize hardware encrypted drives as the boot drive with BitLocker?

A
  • Drive must be in an uninitialized state and in the security inactive state
  • System must also always boot with UEFI 2.3.1 or higher and the CSM should be disabled.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Where should a BitLocker recovery key be stored?

A
  • Should be printed, saved on removable media, or on a network folder.
  • Key cannot be stored in the root-directory of a non-removable drive on on the encrypted drive.
  • Ideally the key should be stored separate from the computer.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

You have a sensitive system which is being retired. You intend to reuse the hardware from this system in a new system. You need to ensure that even the deleted data is protected by BitLocker on the new system. How would you accomplish this?

A

Encrypt the whole drive. While encrypting only used space is faster, but in this scenario full encryption ensures even deleted files are encrypted and secured.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

You have just installed BitLocker on a system and rebooted to start the initia encrypt. When you go to manage BitLocker, the only options are for the password, recovery key, or for disabling BitLocker. Why aren’t there more options?

A

Until BitLocker encryption is complete the options for management are limited. Wait until encryption has completed (manage-bde -status) and you will be able to do more after that.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

How do you check the status of a BitLocker encryption from the command line?

A

CMD: manage-bde -status
PS: Get-BitLockerVolume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What unlock drive options are available for securing a data volume with BitLocker?

A
  • Password
  • Smart Card
  • Automatically unlock this drive on this computer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

With a BitLocker protected data volume, how does the “automatically unlock this drive on this computer” unlock option work?

A

The drive will be unlocked if the system drive is unlocked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the requirements for storing BitLocker recovery keys in OneDrive?

A
  • Computers cannot be domain joined

- User must be using a Microsoft account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

When can you utilize BitLocker encryption from Windows Explorer?

A

This is available on client OSes by default and can be added to Server OSes by installing the BitLocker and Desktop Experience role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

You have an encrypted Disk you’ve swung over from and older system a new system. BitLocker says the dirve is “encrypted on write.” What does this mean?

A

The drive was encrypted on Windows 8 using “Used Space Only”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Does BitLocker work with cluster-aware disks?

A

Yes. BitLocker can protect cluster-aware disk by adding protects to the Cluster Name Object that allow the disk to properly failover and be unlocked by any member computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Can you use a SID-based password protector to protect the OS volume?

A

Yes. It will require an additional protector (TPM, PIN, RecoveryKey, etc).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What happens if you take a partially encrypted drive from Windows 7 and move it to Windows 10? How will BitLocker handle it?

A

BitLocker in Windows 8+ will complete the encryption regardless of policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are the limitations of protecting the OS volume with the BitLocker SID-based protector?

A

An additional protect is required and the SID-based protector does not unlock the OS in the pre-boot environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a common use case for AD-based protectors with BitLocker?

A

Unlocking Failover Cluster enabled volumes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are some methods to check the status of BitLocker for a given volume?

A
  • Control Panel
  • Windows Explorer
  • Manage-BDE
  • WIndows Powershell (Get-BitLockerVolume)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

You go into the Control Panel to check the status of the BitLocker volume. You see the status is “Waiting for Activation.” What needs done?

A
  • BitLocker is enabled with a clear protector key and it requires further action to be fully protected.
  • Add the keys via Control Panel, Manage-BDE, or WMI and it should start working.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Is decrypting a volume a volume a valid troubleshooting step?

A

No. Decryption should only be done at the end of a drive’s life or if there is an issue with BitLocker that prevents the volume from being encrypted or unlocked readily.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

How do you mark an attribute as confidential in AD?

A

In the schema, modify the searchFlags on the object and enable bit 7 (128 decimal)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are the BitLocker Recovery AD attributes?

A
  • msTPM-OwnerInformation
  • msFVE-KeyPackage
  • msFVE-RecoveryPassword
  • msFVE-RecoveryInformation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What does the attribute msTPM-OwnerInformation represent in AD?

A

This attribute contains the owner information of a computer’s TPM module. This attribute is applied to the computer object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What does the attribute msFVE-KeyPackage represent in AD?

A

This attribute contains the BitLocker encryption key secured by the corresponding recovery password. This attribute is applied to the msFVE-RecoveryInformation object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What does the attribute msFVE-RecoveryPassword represent in AD?

A

This attribute contains the BitLocker encryption key secured by the corresponding recovery password. This is applied to the msFVE-RecoveryInformation object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the msFVE-RecoveryInformation object?

A

This object is created for every encrypted volume and is stored as a sub-attribute of the computer’s objec where the volume was encrypted. Contains the recovery attributes associated with a BitLocker recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What permission allows a user to read a confidential attribute?

A

Control_Access Extended right (viewable/settiable via LDP)

Also grants permission to LAPS passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What permission must be granted to the BitLocker recovery information in AD to allow a non-Domain Admin to read the attributes?

A
  • Read

- Control_access (set via LDP or script)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

You receive the error “The numerical password was not added. The FIPS Group Policy setting on the compute prevents recovery password creation” when you attempt to add a recovery password a BitLocker volume. How is the error corrected?

A

Go into Group Policy. Modify the policy that configures “Computer Configuration \ Windows Security \ Security Settings \ Local Policies \ Security Options \ System Cryptography: Use FIPS Compliant Algorithms for encryption, hasing, and signing” and disable the setting.

Note: This error may also present as “Cannot decrypt disk. Policy requires a password which is not allowed with the current security policy about use of FIPS algorithms.”

This error may appear when a drive is encrypted and an recovery key is created but no password is created as its protector or when the recovery password is not archived in AD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is the difference between Symmetric and Asymmetric encryption?

A

Symmetric uses a single key to encrypt and decrypt.

  • Often referred to as single-key, secret-key, shared-key, or private-key
  • AES, DES, or 3DES are examples

Asymmetric uses two keys: one for encrypting and one for decrypting.

  • Often called public key cryptography
  • SSL/TLS and PGP are examples of protocols that use asymmetric keys
  • Common encryption methods are Diffe-Hellman and RSA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Which version of Windows was BitLocker Drive Encryption (BDE) introduced?

A

Server 2008 / Windows Vista

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

In which version of Windows was the ability to use XTS-AES introduced into BitLocker?

A

Windows 10 version 1511 / Server 2016

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is required before you can enable BitLocker with TPM + Startup Key + Startup Pin?

A

“Require additional authentication at startup” is required via GPO. Located under “Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What happens if you runt he command ‘manage-bde -on’ on a data drive with no other information?

A

This will enable BitLocker on the data drive. However, the drive will not be protected as no authenticating protector is installed. You’ll need to enable a protector after the fact to fully protect the drive. The drive is encrypted, just not protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

You ran the command “manage-bde -on C:” what will happen after this command?

A

Assuming C: is the OS volume and a TPM is installed, the OS volume will be encrypted with TPM-only and no recovery key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What command will allow you to determine the encryption status on a target system?

A

manage-bde -status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What command will enable BitLocker on C and utilize a USB drive (E:) as the startup key?

A

manage-bde -Protectors -add C: -StartupKey E:

manage-bde -on C:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What command will list the protectors configured for a volume?

A

manage-bde -protectors -get $VolumeLetter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

How would you enable encryption on a volume without TPM available that uses password and SID-based protectors?

A

manage-bde -protectors -add $VolLetter -pw -sid $UserOrGroupSid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Using the command line, how would you ensure a data volume is encrypted using a password protector?

A

manage-bde -protectors -add -pw C:

manage-bde -on C:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

How do you decrypt a BitLocker drive using the command line?

A

manage-bde -off C:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What Powershell cmdlet will remove an existing protector from a BitLocker volume?

A

Remove-BitLockerKeyProtector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What is the process to remove a BitLocker protector using Powershell?

A
  1. First identify the key protector ID
    $Volume = Get-BitLockerVolume
    $KeyProtectors = $Volume.KeyProtector
  2. Identify the KeyProtectorID that needs removed and remove it.
    Remove-BitLockerKeyProtector $VolumeLetter -KeyProtectorId $KeyProtectorID
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

How do you enable BitLocker using just a TPM protector with Powershell?

A

Enable-BitLocker $VolumeLetter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Which switch should be used with Enable-BitLocker to skip any hardware checks so the system doesn’t require a reboot before starting encryption?

A

-SkipHardwareTest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

How would you enable the password/SID-based BitLocker protection using Powershell?

A

Enable-BitLocker $DriveLetter -AdAccountOrGroupProtector -AdAccountOrGroup $GroupOrUserOrSid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

How would you check the status of a BitLocker Volume using Powershell?

A

Get-BitLockerVolume $VolumeLetter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

How do you decrypt a BitLocker volume with Powershell?

A

Disable-BitLocker $VolumeLetter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is an easy way to better ensure that ASLR (Address Space Layout Randomization) is supported by the CPU?

A

Select a 64-bit CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What versions of Windows include protections against DMA-enabled devices when the computer is locked or no one has logged in?

A

Windows 10 Pro, Enterprise, or Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What different devices are vulnerable to DMA attacks?

A 
FireWire
ThunderBolt
ExpressCard
PCI Express
PCMCIA
PCI
PCI-X
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What are some countermeasures for DMA-Attacks?

A

Block DMA via Policy
WIndows 10 - Automatically blocks DMA from being installed until the computer is unlocked
“Instant Go” devices do not have DMA ports
IO-MMU prevents DMA attacks when running a Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Is USB susceptible to DMA attacks?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What can prevent “cold boot” attacks?

A

Secure Boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Where are TPM Settings stored in Group Policy?

A

Computer Configuration \ Policies \ Administrative Templates \ System \ Trusted Platform Module Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What different TPM Settings can be set via GPO?

A

Turn on TPM backup to Active Directory Domain Services
Configure the list of blocked TPM commands
Configure the level of TPM owner authorization information available to the OS
Configure standard user lockout duration
Standard User individual lockout threshold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

In which versions of Windows is Secure Boot supported?

A

Windows 8 / Server 2012 +

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Which versions of Linux support Secure Boot?

A 
Fedora 18+
openSUSE 12.3+
RHEL 7+
CentOS 7+
Unbuntu 12.04.2+
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

How do you enable Secure Boot for platform and BCD integrity validation?

A

GPO: Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives
- Configure “Allow Secure Boot for integrity validation”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

You decide no to turn on Secure Boot-based integrity validation via GPO yet you notice it is still being used. Why is this?

A

By default, BitLocker will use Secure Boot-based integrity validation unless policy is set to disabled via GPO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What generation VMs support Secure Boot?

A

Generation 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

How do you enable Secure Boot on a VM in Hyper-V?

A

VM Settings \ Security node \ select “Enable Secure Boot”

This feature is enabled by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Can you enable TPMs on Hyper-V VMs if the hardware doesn’t have a physical TPM?

A

Yes. By enabling TPMs on the Hyper-V VMs without a physical TPM, you utilize a virtual TPM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

How do you gather information about the TPM from Powershell?

A

Get-TPM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Can MBR disks be used as boot disks with UEFI?

A

No. Only GPT disks are supported with UEFI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

How can you see the number of bad attempts a TPM will allow before locking someone out?

A

Get-TPM | Select-Object LockoutMax

Note: LockoutCount shows how many attempts have been made and LockedOUt will show if the TPM is locked out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

How do you adjust the lockout threshold on a TPM 1.2 device?

A

You do not, this can only be adjusted with a TPM 2.0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

How do you view if the TPM is 1.2 or 2.0?

A

Get-WmiObject -Class Win32_TPM -Namespace root\cimv2\Security\MicrosoftTPM | Select-Object SpecVersion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What kind of protectors may be used in BitLocker protected drives that are not OS drives?

A

Password
Smart Card
Automatic Unlock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

How do you enable BitLocker to utilize Secure Boot for integrity validation?

A

GPO: Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives

  • Enable the setting “Allow Secure Boot for integrity validation”
  • Note: This feature is enabled by default. Use this policy to enforce the setting.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

What is the benefit of using Secure Boot-based integrity validation?

A

BCD Settings can be repaired during boot without triggering a recovery event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

You have a company that utilizes both Windows 8.1 and Windows 10. You have a BitLocker encrypted drive that gets moved from system to system. Which BitLocker encryption method should be used?

A

AES-128 or AES-256

Support for XTS-AES came later in Windows 10 and drives equipped with the newer protocols do not work on older systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

What options are available for BitLocker in the control panel after a drive is encrypted?

A 
Backup your recovery key
Change password
Remove password
Add smart card
Turn on auto-unlock
Turn off BitLocker
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Who can change the PIN for passwords for an encrypted volume?

A

Users have the ability to do this, however, they must first know the existing PIN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

What happens if a user enters a BitLocker PIN/Password too many times incorrectly in an attempt to reset the the PIN/Password of a BitLocker volume?

A

A user has five tries before BitLocker locks out the account and an administrator must reset the PIN or password.

The system can be rebooted to reset the counter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

How do you set the complexity of BitLocker PINs/Passwords?

A

Group Policy: Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption
Modify “Configure use of passwords for fixed drives”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

What is BitLocker To Go?

A

Enables users to encrypt removable USB drives without requiring the device go through recovery on the other systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

What are the requirements for BitLocker To Go?

A

Server 2008 R2 / Windows 7
Insert USB and configure encryption
No TPM Required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

How do you control which drive encryption options are available to users for BitLocker?

A

Group Policy: Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

What are some different settings that can be configured for BitLocker using Group Policy? (General, not actual settings)

A
  • Require all removable drives to be BitLocker-protected before data can be saved to them
  • Require or disallow specific methods for unlocking BitLocker-Protected Drives
  • Configure methods to recover data from BitLocker-protected drives
  • Configure the BitLocker recovery passwords that is stored in ADDS
  • Require or disallow different types of recovery password storage or make them optional.
  • Prevent BitLocker from activating if it is not able to backup keys to AD DS.
  • Choose drive encryption method and cipher strength.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

In which version of Windows was the ability to encrypt BitLocker volumes used with Failover Clusters and Cluster Shared Volumes introduced?

A

Server 2016

133
Q

Why is it recommend to BitLocker volumes before placing them in the storage pool with the cluster?

A

If you don’t protect volumes prior to this, the resource will need to be placed in maintenance mode later to complete the operation.

134
Q

If storage is thinly provisioned, by default what BitLocker encryption mode is used?

A

Used Disk Space Only

135
Q

When attempting to unlock a protected volume without user interaction, what order does BitLocker follow?

A
  1. Clear Key
  2. Driver-based auto-unlock key
  3. ADAccountOrGroup Protector (Service context then user context)
  4. Registry-based auto-unlock key
136
Q

In which version of Windows as the ability to pre-provision drives with BitLocker enabled introduced?

A

Server 2012 / Windows 8

137
Q

How do we pre-provision a drive with BitLocker prior to OS install?

A

In WinPE execute the following command: Manage-bde -on X:

138
Q

What is network unlock?

A

Network Unlock provides an automatic unlock of OS volumes at system reboot when connected to a trusted, wired corporate network.

139
Q

What are the requirements for Network Unlock?

A
  • Windows 8 / Windows Server 2012 with UEFI Support
  • Any OS must have UEFI DHCP Drivers
  • Unlock clients require TPM and at least one TPM protector
  • BitLocker Network Unlock Feature installed
  • Server 2016 WDS Role
  • DHCP, separate from WDS and the DC
  • A Network Unlock Certificate
  • Network Unlock GPO settings
140
Q

What happens if you are unable to communicate with the WDS server and Network Unlock is enabled for BitLocker?

A

BitLocker displays the startup key unlock screen.

141
Q

What high-level steps are required to deploy Network Unlock?

A
  1. Install WDS Role
  2. Ensure WDS is running
  3. Install Network Unlock feature
  4. Create/Install Network Unlock Certificate
  5. Deploy Private Key and Certificate to WDS
  6. Configure GPO for Network Unlock
  7. Require TPM + PIN protectors at startup
142
Q

What are the requirements for a Network Unlock Certificate?

A

Duplicate the User Template and change the following

  • Certificate Recipient: Server 2012/Windows 8
  • Enable publishing to AD
  • Purpose: Encryption
  • Allow private key to be exported
  • Minimum Key Size: 2048
  • Subject Name: Supply in request
  • Extensions - Remove: Client Authentication, Encrypting File System, Secure Email
  • Extensions - Add: BitLocker Network Unlock (this may need to be created)
  • Key Usage: Allow key exchange with key encryption.
143
Q

What format should a Network Unlock private key be exported in?

A

Personal Information Exchange - PKCS #12 (.PFX)

144
Q

Where do you configure the Network Unlock certificate to be used by BitLocker?

A

GPO: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Public Key Policies \ BitLocker Drive Encryption Network Unlock Certificate

145
Q

What is the Microsoft BitLocker Administration and Monitoring tool (MBAM)?

A

MBAM tool provides a single interface to manage BitLocker encryption policies; simplifies deployment and key recovery; centralizes provisioning; and assesses compliance and encryption stations across the organization.

146
Q

How do you install the MBAM tool?

A

Microsoft BitLocker Administration and Monitoring (MBAM) is part of the Microsoft Desktop Optimization Pack (MDOP)

147
Q

What are the components of MBAM?

A

Administration and monitoring server
MBAM Client
Policy Template

148
Q

In MBAM what is the Recovery and Hardware Database?

A

The Recovery and Hardware Database is part of the MBAM Administration and monitoring server.

It maintains the recovery key and the hardware information collected from the MBAM agents managed by MBAM.

149
Q

What does the MBAM Compliance and Audit Database do?

A

The compliance and audit database holds information for the OS drive, fixed data drives, and removable storage drives.

It uses GPO to enforce encryption parameters and to send recovery, hardware, and compliance information to the appropriate entities.

150
Q

What does the Policy Template in MBAM do?

A

It is used to configure BitLocker Administration and Monitoring client policies used to determine the encryption policy options for BitLocker Drive Encryption.

151
Q

Which tool in the MBAM allows for monitoring compliance with BitLocker GPOs?

A

Policy Template

152
Q

How would you provide a self service tool to users to be able to acquire their own recovery keys if they forget or do not know their recovery password?

A

MBAM.

It includes a self-service portal.

153
Q

What tool would you use to report on the compliance status of BitLocker deployments and the settings that systems have related to BitLocker?

A

Utilize the MBAM it has several compliance reporting features, most notably the Policy Template feature.

154
Q

In which version of Windows Server were the BitLocker AD extensions made available?

A

Server 2008, however, they were not built-in and had to be installed manually.
Server 2012, however, included them by default.

155
Q

How do you enable storage of BitLocker Recovery information to AD?

A

Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Store BitLocker Recovery Information in Active Directory

  • Require BitLocker Backup to AD DS
  • Set BitLocker recovery information to store recovery passwords and key packages.

For each type of drive being backed up configure the following

  • Allow data recovery agent
  • Save BitLocker Recovery information to AD DS for drives
  • Set Configure storage of BitLocker Recovery information to AD DS to backup recovery passwors and key packages
156
Q

What is the BitLocker Data Recovery Agent?

A

A DRA is a user account that is an administrator who is authorized to recover BitLocker fixed drives for the entire or using a certificate on a smart card.

157
Q

How do you configure a BitLocker Data Recovery Agent?

A

In “Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Public Key Policies \ BitLocker Drive Encryption \ Provide the unique identities for your organization” add the user account.

Enable DRA recovery for each type of BitLocker resourced you wish to recover.

Note: The BitLocker DRA certificate template is not available by default in Server 2016 but can be downloaded.

158
Q

In which version of Windows was Network Unlock introduced?

A

Windows 8 / Server 2012

159
Q

Does Network Unlock support IPv6?

A

Yes. It utilizes the link-local address to create DHCPv6 packets needed without the need for setting up DHCPv6 servers.

160
Q

How would you get Network Unlock to work with computers across multiple subnets?

A

DHCP Relay needs configured to forward DHCP info across subnets.

161
Q

If you have an existing WDS installation and wish to incorporate Network Unlock, what is required?

A

Make sure that WDS is not hosted alongside DHCP: the two roles must be separate for Network Unlock

Install the Network Unlock Feature

162
Q

What Powershell Cmdlet will install the Network Unlock Feature?

A

Install-WindowsFeature -Name BitLocker-NetworkUnlock

163
Q

Can Network Unlock work over wifi?

A

Yes. but it is not recommended due to potential for WIFI spoofing, the difficulty in preventing relay attacks, and wifi goes beyond the physical boundaries of the building.

164
Q

For Network Unlock to work, must TPM + PIN be configured for BitLocker?

A

No. It does not. However, TPM plus one other protector is a requirement.

165
Q

What command will verify the BitLocker Network Unlock Certificate is present?

A

certutil -verifystore FVENKP

166
Q

Which certificate should be uploaded to the Network Unlock GPO to ensure devices can utilize Network Unlock?

A

The WDS Certificate (public key) should be uploaded to “Computer Configuration \ Policies \ WIndows Settings \ Security Settings \ Public Key Policies \ BitLocker Drive Encryption Network Unlock Certificate”

167
Q

How would you configure Network Unlock WDS certificates without using Group Policy?

A

Registry - HKLM:\Software\Policies\Microsoft\SystemCertificates\FVE_NKP

168
Q

How does Network Unlock behave if multiple PXE servers are used on the network?

A

Only the servers with the network provider will respond as it is the only one capable of analyzing network unlock packets.

169
Q

How would you build redundancy for Network Unlock?

A

Ensure that multiple WDS servers are configured with he unlock certificate.

170
Q

How do you configure Network Unlock for MBR partitions?

A

You don’t. BitLocker utilizes Secure Boot which requires GPT drives.

171
Q

What is the most common use case for Network Unlock?

A

To allow enterprises to unlock BitLocker protected systems for patching unattended workstations and remotely managed servers.

172
Q

WHat is required to enable DHCP support in UEFI?

A

UEFI must be in native mode without a compatibility support mode (CSM) enabled (UEFI cannot be in legacy mode)

173
Q

Why is it important that DHCP be enabled on the primary/first network adapter in a system for Network Unlock?

A

Network Unlock stops enumerating adapters when it reaches on with a DHCP port failure for any reason.

This is important on system with multiple adapters. Ensure the first adapter is DHCP enabled.

174
Q

What is the process of installing Network Unlock?

A
  1. Install WDS Role Feature (Network Unlock will do this if it isn’t already done)
  2. Configure WDS to communicate with DHCP
  3. Verify WDS is working
  4. Install Network Unlock Feature
  5. Create certificate template for Network Unlock
  6. Create Network Unlock Certificate
  7. Deploy Certificate with Private Key to WDS Server
  8. Configure Network Unlock GPO
  9. [Optional] Configure subnet policy on WDS
175
Q

How would you restrict WDS - Network Unlock Server to only be able to serve specific subnets?

A

Modify the configuration file %windir%\System32\bde-network-unlock.ini to list subnets that Network Unlock will respond to.

176
Q

How would you disable Network Unlock?

A

Unregister the PXE provider from WDS.

Remove/Disable the GPO that provides the ‘Allow Network Unlock at startup’ setting.

177
Q

How do you update Certificates for Network Unlock?

A

Import/Generate new certificates for the server and update the certificate in group policy.

178
Q

How would you verify that the Network Unlock Protector is listed on a target system?

A

manage-bde -protectors -get C:

179
Q

How do you enable WDS Debug Logging?

A

Event Viewer \ Applications and Services Log \ Microsoft \ Windows\ Deployment-Services-Diagnostics \ Debug

Right-Click \ Enable Log

Note: This can also be done with wevtutil

180
Q

You are attempting to configure BitLocker for all OS drives using Group Policy. You are running a mix of Server 2008 R2 and Server 2016. You configure the policy setting “Store BitLocker recovery information in Active Directory Domain Services.” BitLocker recovery information is not being backed up. Why?

A

The “Store BitLocker recovery information in Active Directory Domain Services” is only used for Windows Vista and Server 2008.

To configure BitLocker backup to AD for new OSes use “Choose how BitLocker-protected Operating System Drives can be recovered” setting.

181
Q

Why would you want to prevent users from configuring BitLocker on their own?

A

If you allow users to configure BitLocker and they cannot create the recovery options, the system could be permanently locked out and unrecoverable.

182
Q

What settings need configured to prevent users from configuring BitLocker on their own?

A

GPO: Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption

  • Operating System Drivers \ Require Additional authentication at startup
    • Set all settings to “Do not allow”
  • Fixed Data Drives
    • Configure use of smart cards on fixed data drives \ Disabled
    • Configure use of passwords for fixed data drives \ Disabled
  • Removable Data Drives \ Control use of BitLocker on removable driver \ Disabled. `
183
Q

Which versions of WIndows support BitLocker recovery information in AD?

A

Server 2008 and Newer

- Server 2008 will require some extensions

184
Q

What schema version is required to support BitLocker Recovery from Active Directory ?

A

Schema version 39

Note: Check this with Get-ADObject

185
Q

How do you allow a device without a TPM to enable BitLocker?

A

GPO: Computer Settings \ Policies \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Require additional authentication at startup
- Check “Allow BitLocker with compatible TPM”

186
Q

If you configure the BitLocker GPO Setting “Allow BitLocker without a compatible TPM”, what other kind of protector should be used?

A

Either a USB Startup key or a Password should be configured.

187
Q

What needs done to run a CHKDSK against a BitLocker protected volume?

A

Start WinRE and enter the BitLocker recovery key

Run CHKDSK as normal

188
Q

How do you enable a Data Recovery Agent for BitLocker?

A

GPO: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Public Key Policies \ BitLocker Drive Encryption

  • Choose how BitLocker Protected drives can be recovered \ Check “Allow Data Recovery Agent”
  • Provide the unique identifiers for your organization
    • BitLocker Identification Field
    • Allowed BitLocker Identification Field

Configure a recovery certificate (PFX)

GPO: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Public Key Policies \ BitLocker Drive Encryption \ \ R-Click “Add Data Recovery Agent” \ Select DRA certificate

189
Q

How do you tell if a drive has a Data Recovery agent associated with it?

A

View the volumes BitLocker information and you should see “Data Recovery Agent” listed.

190
Q

How would you use a Data Recovery Agent to unlock a drive using the command line?

A

manage-bde -unlock $DriveLetter -cert -ct $DRACertThumbprint

191
Q

You attempt to recover a BitLocker drive using an existing DRA certificate and receive an error saying the unlock failed. What needs done to access the drive?

A

Ensure the certificates;s private key is actually installed into your certificate stores.

192
Q

How do you destroy the key data on a BitLocker protected volume?

A

Boot into WinPE and execute a format against the disk. This removes the information and leave the drive encrypted.

193
Q

How do you grant the Control_Access right to a user/group?

A

dsacls $Object /G $User:CA;$objType

Note: The CA in the permission above indicates Control_Access

194
Q

How do you set an object as confidential?

A

Configure the schema searchFlags to decimal 128 (0x00000080).

195
Q

Can you utilize dynamic disks with BitLocker?

A

No. It only supports basic disks.

196
Q

When implementing BitLocker, of the following which is required for BitLocker to work: TPM, Drive Partitions, Security Key, or Group Policy?

A

For BitLocker to function, the bare minimum would be drive partitions. TPM and security key are neither required by themselves and Group Policy is not required but does help manage BitLocker.

197
Q

You wan to configure BitLocker Encryption for a Cluster Shared Volume. The volume is already created and the role service installed on the cluster nodes. What must be done first?

A

Place the CSV in maintenance mode.
Get-ClusterSharedVolume $ResourceName | Suspend-ClusterResource

Note: Traditional PDRs will use the Get-ClusterResrouce command instead. This command does not show Cluster Shared Volumes

198
Q

You run the Powershell command Get-ClusterResource to locate the Cluster Shared Volume you wish to encrypt. However, the volume doesn’t show in the list. What’s wrong?

A

Nothing. Cluster Shared Volumes are exposed via the Get-ClusterSharedVolume cmdlet and do not show in Get-ClusterResource.

199
Q

What is the process for configuring BitLocker on a Cluster Shared Volume before adding disks to the cluster?

A
  1. Install BitLocker Drive Encryption Feature
  2. Ensure Disks are formatted NTFS and have drive letters.
  3. Identify the cluster: Get-Cluster
  4. Enable BitLocker on the volume of choice: Enable-BitLocker -ADAccountOrGroupProtector -ADAccountOrGroup $Group
  5. Repeat for each disk
  6. Add the volumes to the cluster
200
Q

What are the requirements for using the ADAccountOrGroup Protector with BitLocker?

A

Server 2012 or Newer DCs

201
Q

What is required for a BitLocker Protected CSV to failover in a traditional cluster when using ADAccountOrGroup Protector?

A

The Cluster Name Object (CNO) is configured in the protect or a member of the group the protector is using.

202
Q

What command would you use to enable BitLocker on a Cluster Shared Volume?

A

Enable-BitLocker -MountPoint $CSVPath -ADAccountOrGroupProtector -ADAccoutOrGroup $CNO

203
Q

How would you recover data off a BitLocker protected drive that is no longer bootable?

A

Repair-BDE

204
Q

How do you run Repair-BDE to fix a BitLocker volume?

A
  • You first need the recovery and an external disk which needs to be wiped
  • Repair-BDE $SourceDisk $ExternalDisk -rp $RecoveryKey [-lf $LogPath]
  • This will take awhile to run and give information about what it could salvage.
205
Q

How do you delegate the reading of BitLocker recovery information in Active Directory?

A

Manage-bde -protectors -adbackup C: -id $RecoveryPasswordId

206
Q

How would you get information about the Recovery Password for storing it in AD using the command line?

A

Manage-bde -protectors -get C:

207
Q

What command can be used to add a group or an account to a volume protected by BitLocker?

A

Add-BitLockerProtector $DriveLetter -AdDAccountOrGroupProtector -ADAccountOrGroup $Identity

208
Q

How would you test an AppLocker that doesn’t apply to your system against an executable you wish to run on your system?

A
  • $GPOPath = (Get-GPO -Name $GPOName).Path
  • $XML = Get-AppLockerPolicy -Domain -LDAP “LDAP:\$GPOPath” -XMl
  • Test-AppLockerPolicy -XmlPolicy $Xml -Path $ExecutiblePath
209
Q

In Windows Defender what all can be done from the Home tab?

A

Check status of Windows Defender

Initiate a Scan

210
Q

You configure the following AppLocker setting. Will you be able to run the FireFoxInstall.exe located at .\Desktop\TestAppLocker\Subtest?

Allow - Everyone - %OSDRIVE%\Users\Administrator.CONTOSO\Desktop\TestAppLocker\F*

A

No. The rule blocks any files that match that name in the entire hierarchy beneath where the rule is configured.

211
Q

In Windows Defender what does it mean when Real Time Protection is on?

A

That Defender is monitoring and attempting to catch malware behavior.

212
Q

What are some examples of suspicious behavior that may be caught by Windows Defender Heuristics?

A

Programs copying themselves into other programs

Programs that try to write to the disk directly

Programs trying to manipulate critical system files

213
Q

WIth Windows Defender, what is the difference between a Quick Scan and a Full Scan?

A

Quick scans check areas that malicious software is likely to infect.

Full scan checks all files on the disk and running programs.

214
Q

What different sections are located on the Windows Defender Home tab?

A
  • Real-time Protection Status
  • Virus and Spyware definitions status
  • Scan Options
  • Scan Details - When the last scan was run
215
Q

What are the different categories of items in Windows Defender?

A
  • Quarantine Items
  • Allowed Items
  • All Detected Items
216
Q

What are quarantined items in Windows Defender?

A

Items that are not allowed to run but are not removed from the computer.

217
Q

What is the process of removing a quarantined item in Windows Defender?

A
  1. Launch Windows Defender
  2. History Tab
  3. Quarantined Items
  4. View Details
  5. Select the Item
  6. Click Remove
218
Q

What items can be modified via the Settings Applet for Windows Defender?

A
  • Enable/disable real-time protection
  • Enable/disable cloud-based protection (this controls the sending of items to Microsoft)
  • Enable/disable automatic sample submission
  • Select files, folders, file types, etc. to exclude from scans.
219
Q

What items can be modified via the Settings Applet for Windows Defender?

A
  • Enable/disable real-time protection
  • Enable/disable cloud-based protection (this controls the sending of items to Microsoft)
  • Enable/disable automatic sample submission
  • Select files, folders, file types, etc. to exclude from scans.
220
Q

How would you configure a Windows Defender Scheduled scan?

A

Task Scheduler \ Task Scheduler Library \ Microsoft \ Windows \ Windows Defender

Configure the “Windows Defender Scheduled Scan”

221
Q

How would you centrally manage definition updates for Windows Defender?

A

WSUS

222
Q

What is required in WSUS to ensure Windows Defender definition updates can be downloaded?

A

Launch WSUS \ Options \ Products and Classifications \ Classifications Tab \ Check “Definitions Updates”

223
Q

What are some settings that can be configured for Windows Defender via GPO?

A
  • Enable Headless UI Mode
  • Suppress Notifications
  • Suppress reboot notifications
  • Exclusions (Extension, Path, and Process)
  • Configure removal of items from quarantine
  • Scheduled Scans
  • Turn Windows Defender on and off
224
Q

What are some settings that can be configured for Windows Defender via GPO?

A
  • Enable Headless UI Mode
  • Suppress Notifications
  • Suppress reboot notifications
  • Exclusions (Extension, Path, and Process)
  • Configure removal of items from quarantine
  • Scheduled Scans
  • Turn Windows Defender on and off
225
Q

What Powershell cmdlet will get the Windows Defender status on a system?

A

Get-MpComputerStatus

226
Q

What Powershell cmdlet will list threats that have been detected on a system?

A

Get-MpThreat

227
Q

What Powershell Cmdlet is used to remove detected threats from Windows Defender?

A

Remove-MpThreat

228
Q

What Powershell Cmdlet will initiate a Windows Defender scan of a system?

A

Start-MpScan

229
Q

What Powershell Cmdlet will cause Windows Defender to initiate a definition update?

A

Update-MpSignature

230
Q

What is an offline scan in Windows Defender?

A

A scan that occurs after a reboot and before an OS is fully initialized. It is intended to capture rootkits and other highly persistent malware.

231
Q

How would you initiate a Windows Defender quick scan via Powershell?

A

Start-MpScan -ScanType QuickScan

232
Q

How would you initiate a Windows Defender full scan using Powershell?

A

Start-MpScan -ScanType FullScan

233
Q

What Powershell cmdlet will configure settings in Windows Defender?

A

Set-MpPreference

234
Q

Which tab in Windows Defender will show quarantined items?

A

History Tab

235
Q

What is Windows Defender Offline?

A

A scanning tool that runs from a trusted environment without the OS starting up.

236
Q

Which versions of Windows support Windows Defender Offline?

A

Windows 10/8.1/7

237
Q

When should Windows Defender Offline be run?

A

If Windows detects a rootkit or other highly persistent malware on your system it will alert you to use Windows Defender Offline.

If you suspect your system has malware hiding but the security software isn’t detecting it.

238
Q

How do you initialize a WIndows Defender Offline Scan?

A
  1. Start \ Settings \ Update and Security \ Windows Security \ Virus and Threat Protection
  2. Current Threats
  3. Select “Windows Defender Offline Scan” \ Scan Now
  4. Reboot the system
239
Q

What combination of Defenses will prevent users from installing unapproved applications, including malware on systems?

A

Restricting /Removing Admin Rights

Configure AppLocker

240
Q

In which version of Windows was AppLocker introduced?

A

Server 2012 / Windows 7

241
Q

What service must be running for AppLocker to work?

A

Application Identity Service

242
Q

You have configured AppLocker policies via GPO. However you notice that even though enforcement is enabled, none of the AppLocker policies are being enforced. What should you check?

A

Application Identity Service needs to be running.

243
Q

Where are the AppLocker settings located?

A

Group Policy: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Application Control Policies \ AppLocker

244
Q

What are the different rule types in AppLocker?

A
  • Executable Rules
  • Windows Installer Rules
  • Packaged App Rules
  • Script Rules
245
Q

What file extensions would be associated with AppLocker executible rules?

A

.EXE

.COM

246
Q

What file extensions would be associated with AppLocker script rules?

A 
.ps1
.bat
.js
.cmd
.vbs
247
Q

What file extensions would be associated with AppLocker Windows installer rules?

A

.MSI
.MST
.MSP

248
Q

What file extensions would be associated with AppLocker packaged app installer rules?

A

.APPX

249
Q

What is the default configuration mode for AppLocker?

A

Audit Mode

No rules configured for any rule types

250
Q

What are the different methods for creating rules in AppLocker?

A

Create New Rule
Automatically Generate Rules
Create Default Rules

251
Q

What should you expect if you use the “Create new Rule” option when creating AppLocker rules?

A

The wizard will walk you through the process of creating and AppLocker rule one rule at a time.

You will manually configure permissions, publishers, exceptions, and provide a name for the rule.

252
Q

What should you expect if you use the “Automatically Generate Rules” option when creating AppLocker rules?

A

The wizard creates rules for many apps in a single step.

You select a folder and let the wizard create rules for that folder or for all packaged apps on a system.

253
Q

What should you expect if you use the “Create Default Rules” option when creating AppLocker Rules?

A

The wizard creates rules meant to ensure that key Windows Paths are allowed (C:\Windows and C:\Program FIles).

Without default rules in place, when creating a new rule, AppLocker will prompt to create default rules.

254
Q

What are the four stages of creating AppLocker rules?

A
  • Set Permissions
  • Set Conditions (Publisher, Path, or File Hash)
  • Add exceptions
  • Name the rule
255
Q

What different permissions can be configured as part of an AppLocker rule?

A

Allow
Deny
Exceptions

256
Q

What different conditions can be configured as part of an AppLocker rule?

A

Publisher
File Hash
Path

257
Q

What is the difference between the different conditions that are configurable as part of an AppLocker rule?

A
  • Publisher identifies an application based on the manufacturer’s digital signature. The advantage of this option is that the rule can survive the update of the application as well as a location change. The disadvantage is some manufacturers change their signature periodically.
  • Path identifies applications based on the physical location in the file system. This is less secure as files can simply be moved to this secure path to run. This risk is mitigated by limiting administrative access.
  • File Hash causes the system to compute the hash of the application. Each time the application is upgraded or patched, a new hash is needed making this method difficult to maintain.
258
Q

When creating default rules in AppLocker, what all is included in the default rules?

A
  • Allow everyone to run files found in C:\Program Files
  • Allow everyone to run files found in C:\Windows
  • Allow BUILTIN\Administrators to run all files.
259
Q

You are configuring AppLocker. You create the default rules. You need to block users from using calc.exe. What needs to be done?

A

You’ll need to configure an exception to the default rules that allows for blocking calc.exe since it is part of the default rule set.

260
Q

You have configured AppLocker rules ad-hoc on multiple systems via Local Policy. You engineering team is ready to deploy it across the enterprise and would like to use your built-in policy to start. How would you get the settings from the local policy?

A

Export the policy and import it into AD.

  • GPEdit; Computer Configuration \ Windows Settings \ Security Setting s\ Application Control Policies
  • R-Click “AppLocker” \ Export Policy
  • Rename the Policy \ Save
261
Q

What Powershell cmdlet would display the configured Applocker policy? What are some relevent switches?

A

Get-AppLockerPolicy

  • Local retrieves the local policy
  • Effective retrieves the system’s configured total policy
  • Domain retrieves the domain policy
  • Xml displays the results in XML format
262
Q

How would you obtain the required information to create an Applocker rule for a file (i.e. Hash, Publisher, or Path) using Powershell?

A

Get-AppLockerFileInformation

263
Q

What is the default action of Applocker: allow or deny?

A

Deny. AppLocker operates using the “block by default, allow by exception” principle.

264
Q

When AppLocker processes rules, what order are the rules processed?

A
  • Check for explicit deny actions (these always in)
  • Check for explicit allows
  • If no rule matches, apply the default deny action.
265
Q

How does the link order of different AppLocker policies affect how AppLocker works?

A

Last-write is preserved for enforcement. If a high-level enables AppLocker enforcement and a lower-level policy configures Audit Only, Applocker is placed in Audit Only Mode.

As far as the configured rules, these rules are cumulative across linked GPOs with last-writer determining conflicts.

266
Q

What are some considerations to make when configuring AppLocker via GPO?

A
  • Rule collections that are not configured will be enforced
  • Group Policy does not overwrite or replace rules from already linked GPOs.
  • AppLocker processes the explicit deny rule before allow rules.
  • For rule enforcement, the last writer policy applies.
267
Q

What Powershell cmdlet can be used to determine if a specific user or group of users will be able to perform an action based on the specified AppLocker policy?

A

Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path $Executible -User $TargetUser

268
Q

What are some technologies that fall under Virtualization Based Security?

A
  • Code Integrity (Device Guard)
  • Credential Guard
  • Control Flow Guard
269
Q

What is another name for Code Integrity?

A

Device Guard

270
Q

What does Code Integrity do when configured?

A
  • Code Integrity (Device Guard) helps harden against malware by running only trusted applications.
  • Server 2016 uses virtualization-based security to isolate the code integrity service from Windows.
271
Q

What does Credential Guard do?

A

Credential Guard isolates and hardens key system and user identity information (LSA credentials).

272
Q

How does Virtual Secure Mode (VSM) work?

A

OS components and security tokens (among other things) are isolated from one another using Windows containers under the hood. If one piece is compromised the other is not necessarily compromised.

273
Q

What are the requirements for Virtual Secure Mode (VSM)?

A
  • UEFI running in Native Mode (Legacy/Compatibility/CSM are not supported)
  • x64 Windows 10 Enteprrise / Server 2016
  • x64 CPU with SLAT and Virtualization extensions (Intel VT or AMD-V)
  • Physical systems need to have hardware that is Windows 10 Enterprise ready or Server 2016 Ready
  • Virtual Systems must use Hyper-V Generation 2 VMs with Secure Boot and TPM
274
Q

How do you enable both Device Guard and Nested Virtualization together?

A

You do not. They are incompatible.

275
Q

How do you enable Secure Boot and vTPM for Hyper-V VMs?

A 
Hyper-V Manager \ Locate a Gen 2 VM
Turn off the VM
R-Click VM \ Settings \ Security
Select "Enable Secure Boot"
Select "Enable Trusted Platform Module"
276
Q

How do you enable Device Guard?

A

Group Policy: Computer Configuration \ Policies \ Administrative Templates \ System \ Device Guard \ Turn on Virtualization Based Security

  • Click Enabled
  • Under “Virtualization Based Protection of Code Integrity” choose “Enable with UEFI Lock”
277
Q

How can you tell if Device Guard is enabled on a system?

A

Launch System Information \ Look for “Device Guard Virtualization Based Security” to show if it is running.

278
Q

How would you launch system information from the command line?

A

Msinfo32.exe

279
Q

If you have Device Guard enabled and attempt to run software that is not digitally signed, what happens?

A

There is a chance the software won’t run. Code integrity policies must be configured to account for these scenarios.

280
Q

When Device Guard is first configured, what mode is it in by default?

A

Audit Mode.

This mode allows for fine-tuning the policy before enabling enforcement.

281
Q

You have Device Guard configured in audit mode. What is the next step to getting a valid enforcement policy built?

A

Create a trusted code integrity policy. Typically the first one is created to only allow trusted publisher-signed apps.

282
Q

How do you create a code integrity policy that allows for only trusted publisher-signed software?

A

New-CIPolicy -Level Publisher -FilePath C:\CI\Audit-Publisher.xml -UserPES Audit

283
Q

After creating a code integrity policy XML file what needs done?

A

The XML needs converted to binary and copied to the code integrity folder.
CopyFrom-CIPolicy $CIXml $NewCIBin
Copy-Item $NewCIBinPath C:\Windows\System32\CodeIntegrity\sipolicy.p7b

284
Q

What happens when you run software not in the CI Policy while Device Guard is in Audit mode?

A

An event is logged to the event log.

285
Q

How would you combine the capture policies for Device Guard from multiple servers into a single file?

A

Merge-CIPolicy

286
Q

What Powershell cmdlet will allow you configure Device Guard?

A

Set-Rule

287
Q

What are some different configurations that can be set via Set-Rule for Device Guard?

A
  • 0 Enabled UMCI - Restricts both user and kernel-mode binaries. Default restricts kernel only.
  • 2 Required WHQL - Requires every driver to be WHQL signed. No legacy.
  • 3 Enable Audit Mode - Enables execution of binaries outside of CI Policies but logs them. Remove this to enforce policies.
  • 4 Disabled Flight Signing - Code Integrity will not trust flightroot-signed binaries
  • 6 Enable Unsigned System Integrity Policy - Allows the policy to remain unsigned. If removed, the policy must be signed and have UpdatePolicySigners added to enable modifications.
  • 8 Required EV Signers - Requires that drives be both WHQL signed and have Extended Verification (EV) certificates. All Win10 drivers have this.
  • 9 Enabled Advanced Boot Options Menu - F8 menu is disabled by default. This turns it on.
  • 10 Enabled Boot Audit On Failure - Used with enforcement mode. If the driver hangs on start, CI is placed in audit mode so Windows boots.
288
Q

After you have validated your Device Guard Settings with Audit Mode, what must be done to move it to enforcement mode?

A

Set-RuleOption -Option 3 -FilePath $CIPolicyPath -Delete

ConvertFrom-CIPolicy C:\CI\MergePolicy.xml C:\CI\AuditPublisher.bin

289
Q

Which types of stored credentials does Credential Guard protect?

A 
Unconstrained Kerberos Delegation
NTLMv1
MS-CHAPv2
Digest Authentication
CredSSP
Kerbers DES Encryption
290
Q

What different methods exist for enabling credential guard?

A

Registry
Group Policy
Device Guard and Credential Guard Readiness Tool

291
Q

How can you view the status of Credential Guard?

A

System Information (Msinfo32)

292
Q

How do you enable Credential Guard via GPO?

A

GPMC: Computer Configuration \ Policies \ Administrative Templates \ System \ Device Guard \ Turn on Virtualization Based Security \ Enabled

GPMC: Computer Configuration \ Policies \ Administrative Templates \ System \ Device Guard \ Turn on Virtualization Based Security \ “Credential Guard” \ Enable with UEFI Lock

293
Q

How do you enable Credential Guard via the Registry?

A

HKLM:\System\CurrentControlSet\Control\DeviceGuard

  • Add the DWORD “Enable VirtualizationBasedSecurity” with a value of 1
  • Add the DWORD “RequirePlatformSecurityFeatures” and give it the value of 1 for Secure Boot or 2 for Secure Boot and DMA protection

HKLM:\System\CurrentControlSet\Control\Control\LSA
- Add the DWORD “LsaCfgFlags” with the value of 1 to enable Credential Guard with UEFI Lock or the value of 2 for Credential Guard without UEFI lock.

294
Q

How would you enable Credential Guard using Device Guard and Credential Guard readiness tool?

A

Download the tool and unzip

Run the following Powershell: DG_Readiness_Tool_v3.2.ps1 -Enable -Autoreboot

295
Q

What types of information is stored in the isolated LSA process?

A

Only a subset of OS binaries needed for security. Nothing more (especially no drivers)

296
Q

Which authetnication protocols do not work with Credential Guard enabled?

A

NTLMv1, MS-CHAPv2, Digest, and CredSSP

Apps may still use credentials stored in the WIndows Vault that are not protected by Credential Guard

297
Q

How would you use unconstrained Kerberos delegation with Credential Guard Enabled?

A

You don’t. Credential Guard disallows the use of Kerberos unconstrained delegation.

298
Q

How would you use DES encryption with Credential Guard?

A

You wouldn’t. DES is not supported with Credential Guard Enabled.

299
Q

What is NTLM?

A

NTLM is a suite of security protocols that provide authentication, integrity, and confidentiality to users.

NTLM is an integrated SSO mechanism built into Windows Authentication and is part of Integrated Windows HTTP Authentication.

Provides the maximum compatibility across Windows platforms compared to Kerberos and is easier to implement

300
Q

What authentication protocol is used by integrated WIndows HTTP Authentication?

A

NTLM

301
Q

What authentication protocol is used when authenticating a sever that belongs to a different AD forest?

A

NTLM

302
Q

How do you configure NTLM Traffic Auditing?

A

GPMC: Computer Configuration \ Policies \ WIndows Settings \ Security Settings \ Local Policies \ Security Options

  • Configure the following for all systems in the domain
    • Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers - Audit All
    • Network Security: Restrict NTLM: Audit Incoming NTLM Traffic - Enable Auditing for all accounts
  • Configure the following on Domain Controllers
    • Network Security: Restrict NTLM: Audit NTLM Authentication in this Domain - Enable All
303
Q

When NTLM traffic auditing is enabled, where are NTLM events captured?

A

Event Viewer \ Applications and Services Log \ Microsoft \ Windows \ NTLM \ Operations

304
Q

What different GPO settings are available for NTLM restriction?

A

GPMC: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options

  • Network Security: LAN Manager Authentication Level
  • Network Security: Restrict NTLM: Add remote server exceptions for NTLM Authentication
  • Network Security: Restrict NTLM: Add server exceptions in this domain
  • Network Security: Restrict NTLM: Incoming NTLM Traffic
  • Network Security: Restrict NTLM: NTLM Authentication in this domain
  • Network Security: Restrict NTLM: Outgoing NTLM Traffic to remote servers
305
Q

How would you add a server or system to be able to utilize NTLM even after it has been restricted and disabled?

A

GPMC: Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options
- Network Security: Restrict NTLM: Add server exceptions for NTLM authentication.

306
Q

Why is it unadvised to outright block NTLM as the first step in eliminating NTLM?

A

Applications may break. Many applications, especially third party ones, have dependencies or default configurations built around NTLM

307
Q

When configuring or auditing NTLM, what kinds of applications are likely to still be using it?

A
  • Apps that allow various security configurations (e.g. IIS)
  • Apps that have not been correctly configured with SPNs (e.g. Sharepoint and SQL)
  • Apps that use IPs instead of DNS names
  • Apps with legacy code that only supports NTLM
308
Q

What is the process of blocking NTLM on versions of Windows prior to Server 2003?

A

It is discouraged. Kerberos was not in wide use at this time and there are likely compatibility issues.

309
Q

Which events would show the workflow a user is using that would show how NTLM is being used to better identify where it is being used?

A
  • Event 8004 on the Domain Controller
  • Event 8003 on the member server
  • Event 8001 on the client workstation
310
Q

What is a security baseline?

A

A collection of configuration items from Microsoft for a product that provides prescribed values to help maintain the security of a system or solve a specific use case.

311
Q

What are the key features of the Microsoft Security and Compliance Toolkit?

A
  • Policy Analyzer (PolicyAnalyzer.exe) compares and analyzes GPOs and shows redundant settings, differences, etc.
  • LGPO (LGPO.exe) is a tool for transferring GPOs directly between a host’s registry and a GPO backup. Allows for some level of testing prior to deployment.
312
Q

What are the high-level steps for using Secuirty Compliance Toolkit?

A
  1. Download the toolkit with the necessary baselines
  2. Backup GPOs
  3. Load an existing GPO backup and baseline into Policy Analyzer
  4. Edit existing GPO Backup with Policy Analyzer \ Save
  5. Use LGPO to load the revised backup into a host for testing
  6. Restore revised backup as the new GPO for deployment
313
Q

Where is the Microsoft Security Compliance Toolkit obtained from?

A

Download from Microsoft

314
Q

What versions of WIndows are supported by the Microsoft Security and Compliance Toolkit?

A

Windows 10
Server 2012 R2
Server 2016

315
Q

Does the Microsoft Security and Compliance Toolkit have any requirements or prerequisites?

A

.NET Framework 4.6

316
Q

What types of GPOs can be imported by the Security Compliance Toolkit?

A
  • Registry Policy Files
  • Security Templates
  • Audit Policy Backup Files
317
Q

Where are the registry.pol files located on a system?

A

C:\Windows\System32\GroupPolicy

318
Q

What command line tool will parse registry.pol files into text files?

A

LGPO.exe /parse /m C:\Windows\System32\GroupPolicy\Machine\registry.pol

319
Q

How would you export the local computer security policy as a GPO backup and include the GPO display name via command line?

A

LGPO.exe /b $Path /n $DisplayName

320
Q

What are the key features of the Policy Analyzer tool?

A
  • Highlight when a set of GPOs have redundant settings or internal inconsistencies.
  • Highlight differences between versions of GPOs
  • Compare GPOs against current local policy and local registry
  • Export results to Excel
321
Q

What different items are included in the Microsoft Security Compliance Toolkit download?

A 
Windows 10 Baselines (multiple versions)
Windows Server Baselines (2012 R2, 2016, and 2019)
Office Security Baselines (Office 2016)
Policy Analyzer
LGPO
322
Q

What are the main features of the LGPO tool?

A
  • LGPO is a command-line utility designed to help automate the management of local group policy
  • LGPO can import registry.pol files, security templates, advanced auditing backup files, and formatted LGPO text files.
  • It can export LGPO to a GPO backup
  • It can convert a Local GPO to a LGPO text file.
323
Q

What tool did Microsoft Security Compliance Toolkit replace?

A

Microsoft Security Compliance Manager

- Note: Not all the features of SCM aren’t replicated in SCT (DCM and SCAP are unsupported)

324
Q

What is Control Flow Guard?

A

Control Flow Guard is a highly optimized platform security feature that is used to combat memory corruption vulnerabilities.

CFG is compiled into a program which prevents programs from executing code outside of their memory space by extending DEP.

325
Q

What happens if an application compiled with Control Flow Guard is run on a system that doesn’t support it?

A

The application will run but the CFG features will not be used.

326
Q

What is the Enhanced Mitigation Experience Toolkit (EMET)?

A

EMET is a free security tool that is designed to protect software from undiscovered zero-day exploits without fixes.

It cannot prevent 100% of attacks but it does reduce the attack surface.

327
Q

Which versions of Windows support EMET?

A

Vista SP2+ / Server 2008 R2+

Windows 10/ Server 2016 support mitigated for untrusted fonts.

328
Q

What is required for EMET to work?

A

.NET Framework 4

329
Q

What are the different components of EMET?

A
  • Attack Surface Reduction (ASR) Mitigation
  • Data Execution Prevention (DEP) Mitigation
  • Structured Execution Handling Overwrite Protection (SEHOP) Security Mitigation
  • Heapspray Allocation Security Mitigation
  • NullPage Security Mitigation
  • Export Address Table Filtering (EAF) Security Mitigation
  • Mandatory Address Space Layout Randomization (ASLR) Security Mitigation
  • Bottom Up ASLR Security Mitigation
  • Load Library Check [ Return Oriented Programming (ROP) Security Mitigation]
  • Memory Protection [ROP Security Mitigation]
  • Caller Checks [ROP Security Mitigation - x86 only]
  • Simulate Execution Flow [ROP Security Mitigation - x86 only]
  • Stack Pivot [ROP Security Mitigation]
  • Windows 10 Untrusted Fonts
  • Certificate Trust

70-744 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions