MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

27-20 Chapter 27 Configuring, Managing, and Troubleshooting Security
B. Incorrect: This procedure would ensure that Scott’s profile settings match
Dave’s, but Scott’s account would not have access to shared folders and printers,
NTFS files and folders, and other resources that Dave’s account had access to.
Also, if Dave were still able to connect to the network, perhaps via a dial-up or virtual
private network (VPN) connection, he would still be able to gain access to
data on the network—this is a significant security risk.
C. Incorrect: These procedures would accomplish the desired goals, but there is a
much simpler way to give Scott the appropriate access to resources on the network.
D. Incorrect: These procedures would accomplish the desired goals, but there is a
much simpler way to give Scott the appropriate access to resources on the network.
4. Correct Answers: D
A. Incorrect: This security setting would not prevent users from logging on if they
previously had logged on to the computer, had their domain account removed,
and disconnected the computer from the network. In this scenario, the user could
authenticate by using locally cached credentials.
B. Incorrect: Requiring users to press Ctrl+Alt+Del does improve the security of the
system, but it might still allow users to log on without being authenticated by a
domain controller if that domain controller is unavailable.
C. Incorrect: The Interactive Logon: Require Domain Controller To Unlock Workstation
security policy causes Windows XP to reauthenticate a user with a domain
controller when he unlocks the workstation. The primary purpose of this security
setting is to prevent an attacker from guessing a user’s password when the workstation
has been locked by a screen saver. When this setting is disabled, authentication
attempts made at a locked workstation do not count against failed logon
attempts. Although enabling this security policy is an important security best practice,
it does not accomplish the goal outlined in this scenario.
D. Correct: Setting this security policy to 0 means that no user can log on unless a
domain controller is available to authenticate the user.
5. Correct Answers: B
A. Incorrect: Although adding the account to that group ensures that it has access
to all the local files, folders, and other resources that it might need, it probably
already had sufficient access because it was added to the Power Users group. This
step is unlikely to resolve the problem.
B. Correct: Services that run on Windows XP must run in the context of accounts
that have the user right called Log On As A Service. The account must also have
access to files, folders, and other resources utilized by that service.