70-293 Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure Certification Exam

Demo Question 11.

You work as the network administrator at EliteCertify.com. The EliteCertify.com network consists of a single Active Directory domain named EliteCertify.com. All domain controllers and servers on the EliteCertify.com network run Windows Server 2003. Half the client computers run Windows XP Professional and the rest run Windows Professional 2000. The EliteCertify.com domain only has the default Group Policy Objects (GPOs) applied. The updated EliteCertify.com written security policy only allows secure incoming and outgoing data communication connections to all EliteCertify.com servers. The default Secure Server (Require Security) IPSec policy is assigned to all servers. While monitoring network traffic, you notice that several unsecured data communications are being sent to and received by your network servers. You need to ensure that all servers only receive secure data communication by using IPSec. What should you do?

A. Deselect the Accept unsecured communication, but always respond using IPSec option
B. Deselect the Negotiate security option and select the Permit option.
C. Deselect the Negotiate security option and select the Block option.
D. Select the Allow unsecured communication with non-IPSec-aware computers option.


Display Answer

Answer: A

Explanation: The default configuration of the Secure Server (Require Security) IPSec policy has a Require Security filter action which allows incoming connection request packets. This results in a request being sent to the sender that initiated unsecured data communications. If negotiation for a secured connection fails, your server will continue to receive unsecured data communications that are attempting to negotiate security for a communication session. To stop this from happening, you need to deselect the Accept unsecured communication, but always respond using IPSec option. Incorrect answers: B. If you deselect the Negotiate security option and select the Permit option, then communications that are not secured will be allowed. This will allow traffic to pass through without applying any security rules. C. The Block option is used to block all traffic. D. The Allow unsecured communication with non-IPSec-aware computers option should only be enabled when you need to allow for unsecured communication with computers that do not support IPSec.