98-367 Online Practice Questions and Answers

Correct Answer:

Correct Answer:

References: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/minimumpassword-length

Correct Answer: B

In Internet usage, an email bomb is a form of net abuse consisting of sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted in a denial-of-service attack.

Correct Answer: E

Reference: http://4sysops.com/archives/seven-reasons-why-you-need-bitlocker-hard-drive-encryption-for-your-whole-organization/

Correct Answer: A

Read-only Domain Controller (RODC) is a domain controller that hosts the read-only partition of the Active Directory database. RODC was developed by Microsoft typically to be deployed in a branch office environment. RODC is a good option to enhance security by placing it in a location where physical security is poor. RODC can also be placed at locations having relatively few users and a poor network bandwidth to the main site. As only the read-only partition of the Active Directory database is hosted by RODC, a little local IT knowledge is required to maintain it. Answer: C is incorrect. Windows Server Update Services (WSUS) is an add- on component of Windows Server 2008. It provides functionality to a server to run as a Windows Update server in a Windows network environment. Administrators can configure a WSUS server as the only server to download updates from Windows site, and configure other computers on the network to use the server as the source of update files. This will save lots of bandwidth as each computer will not download updates individually. WSUS 3.0 SP1 is the only version of WSUS that can be installed on Windows Server 2008. Earlier versions of WSUS cannot be installed on a server running Windows Server 2008. Answer: D is incorrect. DNS dynamic update is used to enable DNS client computers for registering and dynamically updating their resource records with a DNS server whenever any modification or change has been taken place. It is used to update the DNS client computers with the reflecting changes. Answer: B is incorrect. Microsoft Baseline Security Analyzer (MBSA) is a software tool of Microsoft to determine security state by assessing missing security updates and less-secure security settings within Microsoft Windows, Windows components such as Internet Explorer, IIS web server, and products Microsoft SQL Server, and Microsoft Office macro settings. Microsoft Baseline Security Analyzer (MBSA) includes a graphical and command line interface that can perform local or remote scans of Windows systems.

Correct Answer: A

An armored virus is designed to stop antivirus researchers from examining its code by using various methods to make tracing and disassembling difficult. This type of virus also protects itself from antivirus programs, making it more difficult to trace. Answer: D is incorrect. A macro virus is a virus that consists of a macro code which infects the system. A Macro virus can infect a system rapidly. Since this virus has VB event handlers, it is dynamic in nature and displays random activation. The victim has only to open a file having a macro virus in order to infect the system with the virus. DMV, Nuclear, and Word Concept are some good examples of macro viruses. Answer: C is incorrect. A boot sector virus infects the master boot files of the hard disk or floppy disk. Boot record programs are responsible for booting the operating system. The boot sector virus copies these programs into another part of the hard disk or overwrites these files. Answer: B is incorrect. A Master boot record (MBR) virus replaces the boot sector data with its own malicious code. Every time when the computer starts up, the boot sector virus executes.

Correct Answer: ABC

Answer: C, B, and A

The various features of security level in the Restricted Sites zone are as follows:

1.The default security level is high.

2.Most of the features are disabled.

3.The maximum safeguards are used.

4.The protection against harmful content is provided.

Correct Answer: D

A keylogger is a software tool that traces all or specific activities of a user on a computer. Once a keylogger is installed on a victim's computer, it can be used for recording all keystrokes on the victim's computer in a predefined log file. An

attacker can configure a log file in such a manner that it can be sent automatically to a predefined e-mail address. Some of the main features of a keylogger are as follows:

It can record all keystrokes.

It can capture all screenshots.

It can record all instant messenger conversations. It can be remotely installed.

It can be delivered via FTP or e-mail.

Answer: A is incorrect. Task Manager is a utility that is used for managing applications, processes, and the general system performance and also for viewing the networking and user statistics. The Task Manager utility is used to run or end

programs or applications. Administrators use this tool to quickly identify and terminate a rogue application.

This utility can be run by invoking a Windows Security menu by using the Ctrl+Alt+Delkey combination and then clicking the Task Manager button or by right- clicking the task bar and then clicking the Task Managermenu option. Answer: B is

incorrect. Event Viewer is an administrative utility that displays the event log of a computer running Windows NT. Event Viewer displays the following categories of events:

Error: These events show significant problems, such as loss of data or loss of functionality. Warning: These events are not necessarily significant but indicate possible problems. Information: These events describe the successful operation of

an application, driver, or service. Success Audit: These events show successful audited security access attempts.

Failure Audit: These events show failed audited security access attempts. Answer: C is incorrect. Network Monitor (Netmon) is a protocol analyzer. It is used to analyze the network traffic. It is installed by default during the installation of the

operating system. It can be installed by using Windows Components Wizard in the Add or Remove Programs tool in Control Panel. Network Monitor is used to perform the following tasks:

1.Capture frames directly from the network.

2.Display and filter captured frames immediately after capture or a later time. 3.Edit captured frames and transmit them on the network.

4.Capture frames from a remote computer.

Correct Answer: C

MAC address is a physical address stored in the Network Interface card on your system or any other device residing on your network. A Media Access Control (MAC) address is a numerical identifier that is unique for each network interface card (NIC). MAC addresses are 48-bit values expressed as twelve hexadecimal digits, usually divided into hyphen-separated pairs, for example, FF-00-F8-32-13-19. The MAC address consists of two parts. The first three pairs are collectively known as the Organizationally Unique Identifier (OUI). The remaining part is known as the device ID. The OUI is administered by IEEE. MAC addresses are also referred to as hardware addresses, Ethernet addresses, and universally administered addresses (UAAs). Answer: D is incorrect. Broadcast address is a special kind of IP address that is used to send packets to all the devices on a same segment of a network. For IP broadcasts, broadcast address is the address in which the host portion of the IP address consists of either all 0's or all 255's. For MAC broadcasts, all of the bet positions in the address are enabled, making the address FFFF.FFFF.FFFF in hexadecimal. Answer: A is incorrect. An IP address is a four-byte number that uniquely identifies a computer on a TCP/IP network. It is made up of 32 bits of information. These bits are divided into four sections, each section containing one byte (8 bits), also known as an octet. Each node on the TCP/IP network must be assigned a unique IP address. There are two types of IP addresses, i.e., Private and Public. Answer: B is incorrect. I/O address is a communication port between a device and the CPU. The CPU needs a memory address, known as Input/ Output (I/O) address, to communicate with any peripheral device. I/O address is a hexadecimal number that the CPU uses to identify a device. I/O address allows the CPU to send instructions to devices installed on the bus slot of a computer. Resources such as I/O addresses, IRQs, and DMAs are configurable aspects of communication between devices inside a PC. Whenever a component, such as a sound card or internal modem is installed in a PC, its I/O address, IRQ, and DMA channels must be correctly configured.

Correct Answer: C

References: https://blogs.msdn.microsoft.com/james_morey/2005/04/21/what-the-heck-is-domain-isolation/