Chapter 08

a. Local Administrators d. Local Non-Administrators

1. Which of the following is a local GPO on a Windows 8.1 computer? (Choose all that apply.) a. Local Administrators b. Local Default User c. Local Default Domain d. Local Non-Administrators

true

10. Objects in an OU with the Block Inheritance option set are affected by a domain-linked GPO with the Enforced option set. True or False?

c. Create a global group and add the three users as members. Configure GPO security filtering so that the global group is denied access to the GPO.

11. You have created a GPO named RestrictU and linked it to the Operations OU (containing 30 users) with link order 3. RestrictU sets several policies in the User Configuration node. After a few days, you realize the Operations OU has three users who should be exempt from the restrictions in this GPO. You need to make sure these three users are exempt from RestrictU's settings, but all other policy settings are still in effect for them. What's the best way to proceed? a. Move the three users to a new OU. Create a GPO with settings appropriate for the three users, and link it to the new OU. b. Create an OU under Operations, and move the three users to this new OU. Create a GPO, and link it to this new OU. Configure the new OU to block inheritance of the RestrictU GPO. c. Create a global group and add the three users as members. Configure GPO security filtering so that the global group is denied access to the GPO. d. Set the Enforced option on RestrictU with an Enforce filter that excludes the three user accounts.

a. Create a GPO, configure the policy, and link the GPO to the Domain object.

12. You want to make changes to policy settings that affect File Explorer. The settings are in the Administrative Templates folder of the User Configuration node. You want the settings to affect all users in the domain. Which of the following is the best way to accomplish this? a. Create a GPO, configure the policy, and link the GPO to the Domain object. b. Create a GPO, configure the policy, and link the GPO to the Users OU. c. Configure the policy in the Default Domain Controllers Policy GPO. d. Configure the policy in the Default Domain Policy GPO and set a security filter for the Domain Users group.

d. Move the Engineering Department computer accounts to a new OU named Eng. Create a new GPO, configure the AppController policy, and link the GPO to the Eng OU

13. In Active Directory, all your computer accounts are in the Computers folder, and all your user accounts are in the Users folder. You need to configure an AppController policy that affects users who log on to computers in the Engineering Department. Which of the following is the best way to accomplish this? a. Place the Engineering Department user accounts in a group. Create a new GPO, configure the AppController policy, and link the GPO to the group you created. b. Place the Engineering Department computer accounts in a group named Eng. Create a new GPO, configure the AppController policy, and link it to the domain object. Set a security filter for the Eng group. c. Move the Engineering Department user accounts to a new OU named Eng. Configure the AppController policy on the Default Domain Policy GPO. Set Block Inheritance on the Users folder. d. Move the Engineering Department computer accounts to a new OU named Eng. Create a new GPO, configure the AppController policy, and link the GPO to the Eng OU.

b. Create an ADMX store in the SYSVOL share, and copy the ADMX files to the ADMX store.

14. You have been working with ADMX files to modify existing Administrative Templates and create new templates. You work on different domain controllers, depending on your location. Despite a concerted effort, your ADMX files are getting out of sync. How can you solve this problem? a. Remove group policy management tools from all but one domain controller so that policies can be managed from only one computer. b. Create an ADMX store in the SYSVOL share, and copy the ADMX files to the ADMX store. c. Create an ADMX store in Active Directory, and move all your ADMX files to Active Directory. d. Share the %systemroot%\PolicyDefinitions folder on all your domain controllers, and set up Task Scheduler to copy ADMX files automatically from one system to all other systems.

c. WMI filtering

15. What Group Policy feature should you use if you have a policy linked to an OU that contains computer accounts but want the policy to affect only computers running Windows 7? You don't know exactly which computer accounts represent the computers running Windows 7. a. Disabling inheritance b. Policy enforcement c. WMI filtering d. Security filtering

b. Create a security database from a template and run secedit.exe.

16. You're concerned that some domain controllers and workstations don't meet security requirements. What should you do to verify security settings on a computer against a list of known settings? a. Create a security template and run Group Policy Modeling. b. Create a security database from a template and run secedit.exe. c. Load the Security Templates snap-in and use the Group Policy Results feature. d. Export the Security Settings node on the computer and run Security Configuration and Analysis.

b. The Computer Configuration settings are disabled. c. The computer accounts have Deny Read permission.

17. None of the computers in an OU seem to be getting computer policies from the GPO linked to the OU, but users in the OU are getting user policies from this GPO. Which of the following is a possible reason that computer policies in the GPO aren't affecting the computers? (Choose all that apply.) a. The GPO link is disabled. b. The Computer Configuration settings are disabled. c. The computer accounts have Deny Read permission. d. The OU has the Block Inheritance option set.

d. The Network Location Awareness feature

18. Which of the following sets the profile for each network connection on your computer? a. The Network Connection policy under the Software Settings node b. The Windows Firewall with Advanced Security policy c. The Properties dialog box of each network interface d. The Network Location Awareness feature

a. Allow the connection if it is secure

19. You want to configure an inbound firewall rule that allows a connection only if the computer trying to make the connection is authenticated. What option should you select? a. Allow the connection if it is secure b. Block unauthenticated connections c. Isolation mode d. Allow Domain connections

c. In a folder named the same as the GUID of the GPO in the SYSVOL share

2. Where is a GPT stored? a. In a folder named the same as the GPO in the SYSVOL share b. In a folder named the same as the GUID of the GPO in Active Directory c. In a folder named the same as the GUID of the GPO in the SYSVOL share d. In a folder named the same as the GPO in Active Directory

c. Tunnel

20. You want to configure an encrypted and authenticated connection between two gateway computers. What rule type should you configure in the New Connection Security Rule Wizard? a. Isolation b. Server-to-server c. Tunnel d. Authentication exemption

false

3. A user-specific local GPO takes precedence over a site-linked GPO. True or False?

a. Check the versionNumber attribute of the GPC and open the GPT.INI file.

4. You're having replication problems with your GPOs and suspect that the version numbers have somehow gotten out of sync between the GPT and the GPC. What can you do to verify the version numbers on a GPO? a. Check the versionNumber attribute of the GPC and open the GPT.INI file. b. Check the versionNumber attribute of the GPT and open the GPC.INI file. c. Right-click the GPO in the Group Policy Management console, click Properties, and view the version in the General tab. d. Right-click the GPO in the Group Policy Management Editor, click Properties, and view the version in the General tab.

c. Verify that DFSR is operating correctly.

5. All your domain controllers are running Windows Server 2012 R2. You're noticing problems with GPT replication. What should you check? a. Verify that Active Directory replication is working correctly. b. Verify that FRS is operating correctly. c. Verify that DFSR is operating correctly. d. Check the GPOReplication flag for the GPT in the Attribute Editor.

a. Program b. Port

6. Which of the following is an inbound and outbound rule type you can create with Windows Firewall with Advanced Security? (Choose all that apply.) a. Program b. Port c. Server d. Isolation

c. Link the new GPO to the domain, and then right-click the new GPO and click Enforced.

7. You have created a GPO that defines settings only in the Local Policies node. You want the settings to apply to all computers in the domain and take precedence over any other GPOs.Which of the following is the best approach? a. Link the new GPO to the domain, and unlink the Default Domain Policy. Right-click the domain object and click Enforced. b. Link the new GPO to each OU containing computer accounts, and make sure it has link order 1. c. Link the new GPO to the domain, and then right-click the new GPO and click Enforced. d. Link the new GPO to the domain, make sure it has the highest link order, and then right-click the domain object and click Block Inheritance.

d. Local GPOs, site, domain, OU

8. Which of the following represents the correct order in which GPOs are applied to an object that falls within the GPO's scope? a. Site, domain, OU, local GPOs b. Local GPOs, domain, site, OU c. Domain, site, OU, local GPOs d. Local GPOs, site, domain, OU

b. Create three GPOs, one for each site, with the appropriate security settings. Apply the GPOs to the corresponding site, and enforce the GPO.

9. Your network consists of three sites and two domains, with some computers from both domains at each site. Each site has certain security settings that should apply to all computers from both domains when they're located at the site. What's the best way to ensure that the correct security settings are applied to the computers at each site? a. Create three OUs in each domain, one for each site. In both domains, place the computer accounts in the OU corresponding to the site where the computer is located. Apply a GPO with the appropriate security settings to each OU in both domains. b. Create three GPOs, one for each site, with the appropriate security settings. Apply the GPOs to the corresponding site, and enforce the GPO. c. Create three GPOs, one for each site. Apply the GPOs to the domain object in both domains. Create three groups, one for each site, and place the computer accounts in the appropriate groups. Use GPO filtering to make sure the policy configured for each site affects only the corresponding group of computers. d. On each computer in each site, configure the local GPO in GPOE with the appropriate security settings. In the Group Policy Object Editor, right-click the Computer Configuration node and click Block Inheritance.