MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

Objective 7.4 Configure, Manage, and Troubleshoot Internet Explorer Security Settings
27-25
Objective 7.4 Answers
1. Correct Answers: C
A. Incorrect: By default, sites that are placed in the Internet zone have unsigned
ActiveX controls disabled. If an ActiveX control has been signed, the user is
prompted to download it. This ensures that the user is kept safe from potentially
dangerous unsigned ActiveX controls on the public Internet. Users can change this
default by choosing Internet Options in Internet Explorer, clicking the Security tab,
clicking the Internet zone, and clicking the Custom Level button.
B. Incorrect: By default, sites that are placed in the Local Intranet zone have
unsigned ActiveX controls disabled. If an ActiveX control has been signed, the
user is prompted to download it, which ensures that users are kept safe from
potentially dangerous unsigned ActiveX controls on their local intranet. Users
can change this default by choosing Internet Options in Internet Explorer, clicking
the Security tab, clicking the Local Intranet zone, and clicking the Custom
Level button.
C. Correct: By default, sites that have been placed in the Trusted Sites zone prompt
the user to download an unsigned ActiveX control. Signed ActiveX controls are
automatically downloaded, which provides users with the convenience of skipping
prompts to install controls from a Web server that they feel confident will
never present potentially dangerous ActiveX controls for download.
D. Incorrect: Restricted Sites have both signed and unsigned ActiveX controls disabled.
The user is not prompted to download any ActiveX controls, ever. Sites
placed in the Restricted Sites zone are assumed to have potentially dangerous
code. Users can change this default by choosing Internet Options in Internet
Explorer, clicking the Security tab, clicking the Restricted Sites zone, and clicking
the Custom Level button.
2. Correct Answers: A
A. Correct: This is the best choice among the answers given. This process would be
greatly simplified if the network were running Active Directory. The certificate
from Contoso can be added to the list of trusted root CAs using domain-based
GPOs instead.
B. Incorrect: Microsoft has tough requirements that must be met before adding new
trusted root CAs to the list shipped with its operating systems. There must be compelling
evidence that a wide range of users from many different organizations will
benefit from the new CA being added to the list.