MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

26-36 Chapter 26 Implementing, Managing, and Troubleshooting Network Protocols and Services
Objective 6.6 Answers
1. Correct Answers: D
A. Incorrect: Windows Firewall cannot prevent this type of intrusion because the
Web server must be able to receive HTTP requests from legitimate users on the
public Internet. Windows Firewall is capable of stopping all HTTP requests, but
cannot distinguish between legitimate and malicious requests within a single protocol.
B. Incorrect: Windows Firewall filters packets as they are processed by a Windows
XP Professional network adapter. This particular scenario saturates your bandwidth
with incoming packets. The packets sent during the DoS intrusion saturate
the Internet connection before they reach hosts on the destination network. Windows
Firewall can filter the packets when they reach the Windows XP Professional
system; however, it cannot stop the Internet connection from being saturated.
C. Incorrect: Windows Firewall is capable of filtering connections only where the
Windows XP Professional computer is acting as the server. When users retrieve email
messages, the connection is initiated by the Windows XP Professional computer.
Further, Windows Firewall is capable of filtering only an entire protocol. ICF
is incapable of differentiating between legitimate and malicious requests within a
single protocol.
D. Correct: By default, Windows Firewall filters incoming FTP requests. In this scenario,
the FTP server was accidentally started. Windows Firewall is designed to
prevent this type of vulnerability. When Windows Firewall is enabled, only those
services explicitly enabled can receive traffic—even if they are accidentally
started.
2. Correct Answers: A and B
A. Correct: The source IP address is one of the fields of data collected in the Windows
Firewall security log.
B. Correct: The destination port is one of the fields of data collected in the Windows
Firewall security log.
C. Incorrect: The Windows Firewall security log does not contain the source’s host
name. The source IP address is included, however, so you can perform a reverse
DNS lookup based on the source IPs in the log.
D. Incorrect: Windows Firewall security logs do not contain the data that was contained
in the dropped packets. Only information contained in the header of packets
is recorded.