70-299 Implementing and Administering Security in a Microsoft Windows Server 2003 Network Exam Questions

Demo Question 9.

You are a security administrator for EliteCertify.com. The network consists of a single Active Directory domain named EliteCertify.com. All servers run Windows Server 2003. You plan to deploy remote access to the network for users that work from home. The EliteCertify.com written security policy states the following remote access requirements: 1. Users are allowed to use remote access during the day only. 2. Enterprise Admins are never allowed to use remote access. 3. Domain Admins are always allowed to use remote access. 4. A user who is a member of both the Enterprise Admins group and the Domains Admins group is not allowed to use remote access. You configure and enable Routing and Remote Access on a member server named EliteCertify 1. You delete the predefined remote access polices. The remote access permission for all user accounts in the domains is set to use remote access polices. You must apply the appropriate Remote Access polices in the correct order so as to comply with the EliteCertify.com written security policy. Following are the Remote Access Polices: 1. Domain Users/during day - Allow access 2. Domain Users/during night - Deny access 3. Domain Admins/all times - Allow Access 4. Enterprise Admins/all times - Deny access 5. Enterprise Admins/during day - Deny access You need to ensure that the remote access polices on EliteCertify 1 comply with the written security policy and thus need to make a decision on how to apply these remote access polices. What should you do?

A. You should apply the remote access policies as follows: first - Enterprise Admins/during day - Deny access second - Domain Admins/all times - Allow Access third - Domain Users/during day - Allow access
B. You should apply the remote access policies as follows: first - Enterprise Admins/ during day - Deny access second - Domain Admins/all times - Allow Access third - Domain Users/during day - Allow access
C. You should apply the remote access policies as follows: first - Enterprise Admins/all times - Deny access second - Domain Admins/all times - Allow Access third - Domain Users/ during night - Deny access
D. You should apply the remote access policies as follows: first - Enterprise Admins/all times - Deny access second - Domain Admins/all times - Allow Access third - Domain Users/during day - Allow access


Display Answer

Answer: D

Explanation: The remote access polices are tried in order. The more specific remote access policies are placed in order ahead of the more general remote access policies. If the first policy in the ordered list of remote access policies does not match the connection attempt, the next policy is tried. The most specific policy is Enterprise Admins/all times Deny access, so it should be placed first. The next most specific policy is Domain Admins/all times Allow access. This policy should be placed second. The most general remote access policy is Domain Users/during day - Allow Access. This policy should be placed last. The reason for this is that everyone by default is part of the Domain Users group. If this was first or second, Enterprise Admins would be allowed to connect and Domain Admins would only be able to connect during the day.