MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

Objective 7.2 Configure, Manage, and Troubleshoot a Security Configuration and Local Security Policy
27-13
Objective 7.2 Answers
1. Correct Answers: B and E
A. Incorrect: Although you use Event Viewer to view the Security log, you cannot
configure auditing settings here.
B. Correct: This is one of the two steps you must perform to enable failure auditing
for specific files and folders. In this scenario, this setting is stored in the LGPO; it
can also be configured in a Windows 2000 domain environment by using Active
Directory-based GPOs.
C. Incorrect: The problems described in this scenario were caused by improperly
set NTFS permissions—configuring Software Restriction policies does not correct
them.
D. Incorrect: You can use this snap-in to compare the current NTFS permissions
with those contained in a security template, but the HISECWS.INF security template
does not include any NTFS permissions settings. Also, the scenario states that
you want to configure auditing, which you cannot accomplish by analyzing the
computer.
E. Correct: This is the second step you must perform to enable failure auditing for
specific files and folders. When this step is combined with setting auditing policy,
an event is written to the local Security log each time an account attempts an
unauthorized access on an audited object.
2. Correct Answers: A
A. Correct: The Local Security Policy console contains the Security Settings extension
of the LGPO. You configure settings for stand-alone and workgroup computers
using this console; the settings made apply to the local computer, therefore
you must log on to each targeted computer to make the settings.
B. Incorrect: You can add and remove users and groups, set properties for users
and groups, and reset passwords for users using the Local Users and Groups snapin,
but you cannot configure account lockout policies with this tool.
C. Incorrect: The User Accounts program located in Control Panel includes some of
the features available through the Local Users And Groups snap-in, but you cannot
use it to configure account lockout policies.
D. Incorrect: The Accessibility Options program is for configuring Windows XP for
people with disabilities; it is not used for configuring account lockout policies.