70-293 Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure Test Real Exam

Demo Question 17.

You work as the network administrator at EliteCertify.com. The EliteCertify.com network consists of a single Active Directory domain named EliteCertify.com. Half the servers on the EliteCertify.com network run Windows Server 2003 and the rest run Windows 2000 Server or Windows NT 4.0. Half the client computers run Windows XP Professional, and the rest Windows 2000 Professional or Windows NT 4.0 Workstation. EliteCertify.com has its headquarters in Chicago and branch offices in Dallas, Houston, and Miami. All servers located at the Chicago headquarters premises run Windows Server 2003 and all client computers run Windows XP Professional. T3 lines currently connect each branch office to the Chicago headquarters office. Users at the three branch offices send data over the T3 line to the Chicago headquarters office. An attacker has managed to intercept and tamper with data as it transversed over the WAN link connecting the Dallas office and Chicago headquarters office. You are instructed to secure all data communications occurring over WAN links between the Chicago headquarters office and all three branch offices. The security breach incident must not occur in the future. You are also instructed to minimize any expenses incurred as a result of implementing your solution. You upgrade all WAN routers that connect the T3 lines to routers at the Chicago headquarters office to Windows Server 2003. You must still perform the configuration that will secure data communications between the Chicago headquarters office and the three branch offices. You want to use the least amount of administrative effort to accomplish your task. How should you configure the WAN routers?

A. Configure the routers to utilize IPSec in Transport Mode.
B. Configure the routers to utilize IPSec in Tunnel Mode.
C. Configure the routers to utilize IPSec Authentication Header (AH. in Transport Mode
D. Configure the routers to utilize IPSec Authentication Header (ESP) in Transport Mode.


Display Answer

Answer: B

Explanation: The question states that you have upgraded the WAN routers that connect the T3 lines to routers at the Chicago headquarters office to Windows Server 2003. This basically allows you to configure the WAN routers to use IPSec in Tunnel Mode. IPSec tunnel mode can be used to provide security for WAN and VPN connections that use the Internet as the connection medium. In tunnel mode, IPSec encrypts the IP header and the IP payload. With tunneling, the data contained in a packet is encapsulated inside an additional packet. The new packet is then sent over the network. Tunnel mode is typically used for the following configurations: server to server, server to gateway, and gateway to gateway. Tunnel mode only requires the WAN routers at each end of the connection to support IPSec. No computers need to support IPSec. This is especially relevant in your case because there are both Windows NT 4.0 servers and client computers at the branch offices. Windows NT 4.0 servers and client computers do not support IPSec. Incorrect answers: A, C, D. Transport mode is used to provide end-to-end communication security between two computers on the network, which means that your computers must support IPSec.