70-293 Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure Training Boot Camp

Demo Question 8.

You work as the network administrator at EliteCertify.com. The EliteCertify.com network consists of a single Active Directory domain named EliteCertify.com. All servers on the EliteCertify.com network run Windows Server 2003 and all client computers run Windows XP Professional. The EliteCertify.com network also contains a perimeter network. The EliteCertify.com intranet Web site is hosted on a Web server named EliteCertify -SR17. EliteCertify -SR17 resides on the perimeter network. Other servers hosted on the perimeter network, also available to the public, are the company e-mail and FTP servers. The EliteCertify.com written security policy requires you to secure the most vulnerable element of all servers hosted on the perimeter network, so as to secure the EliteCertify.com network from attacks originating from the Internet. You must implement a solution which will decrease the identified vulnerability. You do not want to move any public servers to the internal network. What should you do?

A. Configure Kerberos authentication.
B. Install a firewall and configure packet filtering to filter traffic from the Internet.
C. Install a PKI and digital certificates on your public servers.
D. Configure NTFS permissions.


Display Answer

Answer: B

Explanation: The biggest vulnerability you have is that there is no firewall between the Internet and your perimeter network. This basically means that an attack can be launched from the Internet to take control your server computers on the perimeter network. The attacker can then use one of your public servers to access the corporate network. You can mitigate this risk by implementing a firewall between your perimeter network and the Internet. You should configure packet filtering to filter all traffic passing from the Internet to the perimeter network. Incorrect answers: A. Kerberos authentication will not stop an attack from the internet. C. You need to secure the network, and not specifically ensure that data can be encrypted through SSL or IPSec. D. NTFS permissions are configured to control access to file system resources. You should be more concerned with securing your network from attacks from Internet users.