Objective 2.1 Questions | MCSA/MCSE Self-Paced Training Kit (Exam 70-299): Implementing and Administering Security in a MicrosoftВ® Windows Server(TM) 2003 Network (Pro-Certification)

< Day Day Up >

You are the systems administrator for five servers on a network of Windows Server 2003 systems. Server one runs Windows Server 2003 Web Edition. Server two runs Windows Server 2003 with SQL Server 2000. Server three runs Windows Server 2003 with ISA Server 2000 and has been upgraded from Windows 2000 Server. Server four runs Windows Server 2003 with Microsoft Exchange Server 2003 installed. Server five is a Windows Server 2003 domain controller that has been upgraded from Windows 2000 Server.

You are reviewing some of the latest security updates. The bulletin number, KB (Knowledge Base) article number, and products affected by the update are listed in the following table:

Bulletin	KB	Products Affected
MS03-039	824146	Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003.
MS03-037	822715	Microsoft Visual Basic for Applications SDK 5.0, 6.0, 6.2, and 6.3. Office 97, Windows 2000, and Windows XP. Visio 2000 and Office Visio 2003. Project 2000 and 2002. Publisher 2002.
MS03-031	815495	Microsoft SQL Server 7.0, Microsoft Data Engine 1.0 (MSDE 1.0), Microsoft SQL Server 2000, Microsoft Desktop Engine 2000 (MSDE 2000), Microsoft SQL Server 2000 Desktop Engine (Windows).
MS03-028	816456	Microsoft Internet Security and Acceleration Server 2000 (ISA Server).
MS03-025	822679	Windows 2000.

You are planning to deploy the relevant updates to the five servers you are responsible for. Which of the following correctly lists the security updates, by KB number, that need to be applied to each Windows Server 2003 system? (Select all that apply.)

Server one: 824146
Server two: 824146, 822715, and 815495
Server three: 824146, 816456, and 822679
Server four: 824146
Server five: 824146 and 822679

Foley is planning the phased deployment of a new service pack for Windows XP Professional across the A. Datum Corporation organization. A. Datum Corporation has 700 users whose accounts are all contained within the default Users container of Active Directory directory service. The 700 computer accounts of the systems that these users use are located in the default Computers container. The users are divided into four domain global security groups. The Engineers group has 400 members, the Sales group has 150 members, the Secretarial group has 100 members, and the Management group has 50 members. Employees at A. Datum Corporation use their own workstations. In consultation with management, Foley has decided to split the deployment of the service pack into four phases. These phases are as follows:

Phase One: 200 members of the Engineers group
Phase Two: The rest of the Engineers group
Phase Three: Sales group and Secretarial group
Phase Four: Management group

Which of the following plans would allow Foley to carry out this phased deployment plan with the minimum of administrative effort?

Create two new global security groups: ENG-PH1 and ENG-PH2. Create a GPO that assigns the service pack in the Computer Configuration\Software Settings\Software Installation node. For Phase One, apply this GPO to the ENG-PH1 group. For Phase Two, apply this GPO to the ENG-PH2 group. For Phase Three, apply this GPO to the Sales and Secretarial groups. For Phase Four, apply this GPO to the Managers group.
Create two new global security groups: ENG-PH1 and ENG-PH2. Create a GPO that assigns the service pack in the User Configuration\Software Settings\Software Installation node. For Phase One, apply this GPO to the ENG-PH1 group. For Phase Two, apply this GPO to the ENG-PH2 group. For Phase Three, apply this GPO to the Sales and Secretarial groups. For Phase Four, apply this GPO to the Managers group.
Create four new global security groups: Phase1, Phase2, Phase3, and Phase4. Add the computer accounts for the systems that the first 200 groups of engineers use to the Phase1 group. Add the computer accounts for the rest of the engineers’ systems to the Phase2 group. Add the computer accounts for the systems that the sales and secretarial groups use to the Phase3 group. Add the computer accounts for the systems that the managers use to the Phase4 group. Create a GPO that assigns the service pack in the User Configuration\Software Settings\Software Installation node. Assign this GPO to the default Users container, but in the Group Policy properties make sure that the Authenticated Users group does not have the Read and Apply Group Policy Allow check boxes checked. For each phase, add a security group and assign the Read and Apply Group Policy (allow) permission.
Create four new global security groups; Phase1, Phase2, Phase3, and Phase4. Add the computer accounts for the systems that the first 200 groups of engineers use to the Phase1 group. Add the computer accounts for the rest of the engineers’ systems to the Phase2 group. Add the computer accounts for the systems that the sales and secretarial groups use to the Phase3 group. Add the computer accounts for the systems that the managers use to the Phase4 group. Create a GPO that assigns the service pack in the Computer Configuration\Software Settings\Software Installation node. Assign this GPO to the default Users container, but in the Group Policy properties make sure that the Authenticated Users group does not have the Read and Apply Group Policy Allow check boxes checked. For each phase, add a security group and assign the Read and Apply Group Policy (allow) permission.
Create four new organizational units called Phase1, Phase2, Phase3, and Phase4. Move the computer accounts for the systems that the first 200 engineers use to the Phase1 OU. Move the rest of the engineers’ computer accounts to the Phase2 OU. Move all the computer accounts for the systems that the Sales and Secretarial group use to the Phase3 OU. Move all of the computer accounts for the systems that the managers use to the Phase4 OU. Create a new GPO named XPSP_DEPLOY. Configure the GPO so that it assigns the Windows XP service pack in the Computer Configuration\Software Settings\Software Installation node. For phase one, assign the XPSP_DEPLOY GPO to the Phase1 OU. For phase two of the deployment, assign the XPSP_DEPLOY GPO to the Phase2 OU. For phase three, assign the XPSP_DEPLOY GPO to the Phase3 OU. To finalize the deployment, assign the XPSP_DEPLOY GPO to the Phase4 OU.

Rooslan is planning on installing a new Windows Server 2003 system that will run Microsoft SQL Server 2000. At the time he is performing the installation, Windows Server 2003 has one service pack released and six relevant hotfixes. SQL Server 2000 is up to Service Pack 3 and has five relevant hotfixes. Of the options listed, which represents the best way for Rooslan to install the server software, the service packs, and the hotfixes?

Rooslan should install in the following order: Windows Server 2003; Windows Server 2003 Service Pack 1; all six relevant Windows Server 2003 hotfixes; the five relevant SQL Server 2000 hotfixes; SQL Server 2000.
Rooslan should install in the following order: Windows Server 2003; SQL Server 2000; Windows Server 2003 Service Pack 1; SQL Server 2000 Service Pack 1; SQL Sever 2000 Service Pack 2; SQL Server 2000 Service Pack 3; the five SQL Server 2000 hotfixes; the six Windows Server 2003 hotfixes.
Rooslan should install in the following order: Windows Server 2003; SQL Server 2000; Windows Server 2003 Service Pack 1; SQL Server 2000 Service Pack 1; SQL Sever 2000 Service Pack 2; SQL Server 2000 Service Pack 3; five SQL Server 2000 hotfixes; six Windows Server 2003 hotfixes.
Rooslan should install in the following order: Windows Server 2003; Windows Server 2003 Service Pack 1; the six Windows Server 2003 hotfixes; SQL Server 2000; SQL Server 2000 Service Pack 3.
Rooslan should install in the following order: Windows Server 2003; Windows Server 2003 Service Pack 1; the six Windows Server 2003 hotfixes; SQL Server 2000; SQL Server 2000 Service Pack 3; the five SQL Server 2000 hotfixes.

You are considering a pilot program for the rollout of the first service pack for Office 2003 in your organization. All of the workstations in your organization are running Windows XP Professional. Your organization has five departments. There is also a small IT unit with five staff members. Each department has its own OU within the Active Directory structure. Approximately 100 user accounts reside in each OU. Because the requirements for each department are different, each department’s OU has an individualized Group Policy Object applied. You want the pilot program to run for a month before you deploy Office 2003 Service Pack 1 across the rest of your organization. You want to make sure that all applications currently used in the organization are compatible with the service pack. Which of the following is the best suggestion for membership of the pilot program?

Create a lab with five different workstations running Windows XP. Add each of these workstations to the OU that corresponds to each department.
Select one user from each department to be a member of the pilot program.
Select five users from each department to be members of the pilot program.
Have each member of IT join a corresponding departmental OU. Deploy the service pack to each IT staff member’s system.

You have three hotfixes that you need to apply to the workstations running Windows XP Professional in your domain. Each hotfix requires the system to be rebooted. Rather than force your users to endure three reboots in a row, you want to configure a script that will install these hotfixes, which were released in early 2004:

WindowsXP-KB812345-x86-ENU.exe WindowsXP-KB812346-x86-ENU.exe WindowsXP-KB812347-x86-ENU.exe

You then want the computer to reboot. Which of the following scripts will perform this function?

@echo off

       setlocal        set PATHTOFIXES=E:\hotfix        %PATHTOFIXES%\WindowsXP-KB812345-x86-ENU.exe /Z /Q        %PATHTOFIXES%\WindowsXP-KB812346-x86-ENU.exe /Z /Q        %PATHTOFIXES%\WindowsXP-KB812347-x86-ENU.exe /Z /Q        shutdown -r   @echo off

       setlocal        set PATHTOFIXES=E:\hotfix        %PATHTOFIXES%\WindowsXP-KB812345-x86-ENU.exe        %PATHTOFIXES%\WindowsXP-KB812346-x86-ENU.exe        %PATHTOFIXES%\WindowsXP-KB812347-x86-ENU.exe   @echo off

       setlocal        set PATHTOFIXES=E:\hotfix        QCHAIN.EXE %PATHTOFIXES%\WindowsXP-KB812345-x86-ENU.exe        QCHAIN.EXE %PATHTOFIXES%\WindowsXP-KB812346-x86-ENU.exe        QCHAIN.EXE %PATHTOFIXES%\WindowsXP-KB812347-x86-ENU.exe

This cannot be done. The changes for each hotfix must be processed before the next hotfix can be installed.

Oksana works as the systems administrator in the contoso.com domain. At present, service packs on the network are rolled out by assigning the appropriate file to a specific set of computers in the software installation and maintenance area of Group Policy. Which of the following options must Oksana set so that the service pack can be uninstalled by using Group Policy settings at a later date?

This is not possible. Service packs can only be uninstalled manually.
Oksana needs to make sure that she publishes the service pack rather than assigning it.
Oksana needs to make sure that she assigns the service pack rather than publishing it.
Oksana needs to ensure that, in the Deployment tab of the service pack software deployment properties, the option Uninstall This Application When It Falls Out Of The Scope Of Management is enabled.

Which of the following methods will allow you to roll back a hotfix that has been installed on 500 workstations running Windows XP Professional that are located in three domains of a single Windows Server 2003 functional level forest?

Write a script that calls the spuninst.exe utility from the particular service pack uninstall directory located under the %systemroot% directory of each workstation running Windows XP. Assign this script to run during startup on each system.
Place the hotfix on an accessible network share in each domain. Write a script that calls the hotfix on the network share with the /uninstall and /quiet switches. Assign this script to run during startup on each system.
Revoke the publication of the hotfix.exe in the Active Directory software deployment for the OU hosting all 500 computers running Windows XP.
Write a script that manually deletes all files and folders that the hotfix updated. Restore these from a pre-hotfix backup.
Use the driver rollback facility of Windows XP to roll back to the pre-hotfix system state.

You have recently deployed a hotfix named WindowsServer2003-KB828035-x86- ENU.exe by means of a startup script to 40 computers running Windows Server 2003 in a domain. There have been several problems and you want to remove this particular hotfix from all computers running Windows Server 2003. Your login script works by means of a batch file. All hotfixes are located on a network share assigned to the Z: drive of each computer running Windows Server 2003. Which command should you add to the startup script applied by a GPO to the OU containing all 40 computers running Windows Server 2003 to remove this hotfix without requiring any administrator interaction? (Select two.)

Z:\WindowsServer2003-KB828035-x86-ENU.exe /uninstall /quiet
Z:\WindowsServer2003-KB828035-x86-ENU.exe –m –y
%systemroot%\$NtUninstallkb828035$\spuninst\spuninst.exe /u
%systemroot%\$NtUninstallkb828035$\WindowsServer2003-KB828035-x86- ENU.exe –m –y

Answers

1.	Correct Answers: A and D Correct Of the updates listed above, only 824146 is relevant to Windows Server 2003 Web Edition. Incorrect This particular server only requires update 824145 and update 815495. Update 824146 is required for Windows Server 2003. Update 815495 is required for SQL Server 2000. Update 822715 is designed for systems running Microsoft Office, Visio, Project, and Publisher. Incorrect This particular server only requires updates 824146 and 816456. Update 824146 is required for Windows Server 2003. Update 816456 is required for ISA Server 2000. Although this server was upgraded from Windows 2000 Server, it no longer requires hotfixes for that product, hence update 822679 is not necessary. Correct Only the Windows Server 2003 hotfix, 824146, is relevant to server four. None of the security updates mention Exchange Server 2003. Incorrect Only the Windows Server 2003 hotfix, 824146, is relevant to server four. Although the server has been upgraded from Windows 2000 Server, this does not mean that hotfixes relevant to only Windows 2000 should be installed on this type of machine.
2.	Correct Answers: E Incorrect Group Policy objects cannot be assigned to global security groups. GPOs can only be assigned to sites, domains, and organizational units. Incorrect Group Policy objects cannot be assigned to global security groups. GPOs can only be assigned to sites, domains, and organizational units. Incorrect Group Policy Objects cannot be assigned to the default Users container in Active Directory. Also, GPOs cannot be assigned to the default Computers container, to the Builtin container, or to the ForeignSecurityPrinciples container. Incorrect Group Policy Objects cannot be assigned to the default Users container in Active Directory. Also, GPOs cannot be assigned to the default Computers container, to the Builtin container, or to the ForeignSecurityPrinciples container. Correct As the computer accounts were all in the Computers container, there was existing infrastructure where GPOs were being applied to computers at the OU level. This leaves open the option of shifting the computer accounts into specific computer OUs and then assigning service packs via GPO. The same GPO can be applied to multiple OUs within a domain.
3.	Correct Answers: E Incorrect SQL Server hotfixes should be installed after SQL Server 2000 is installed. Incorrect If he installs SQL Server Service Pack 3, there is no need to install Service Pack 1 or Service Pack 2 because Service Pack 3 is cumulative and contains all of the fixes from the first two service packs. Also, in this answer he does not install all of the necessary hotfixes for Windows Server 2003. Incorrect Although this will bring the system up to date, it is not necessary to install SQL Server 2000 Service Pack 1 and Service Pack 2 because Service Pack 3 is cumulative and contains all of the fixes from the first two service packs. Incorrect This will not install the five relevant SQL Server 2000 hotfixes. Correct This installs all relevant service packs and hotfixes in a logical way, without the redundancy of installing prior service packs. Before you install software it is wise to check if there is any special install order. Generally with Microsoft this is not a problem, though with some other vendors problems can arise if you do not follow a specific checklist (installing the application before applying the Windows service pack, and then patching the application).
4.	Correct Answers: C Incorrect Although you have added a computer to each OU, a pilot program should test the change in a normal everyday environment under normal usage conditions. Incorrect Although this is a good start, pilot programs should include more than one user from a particular environment. It may be that the user you have chosen from a particular environment uses a computer in an unusual way. Correct This will create a pilot program of 25 users. By having five users participate from each department, you will avoid the problem of perhaps selecting a single user with unique habits. Incorrect Members of IT staff rarely make good members of pilot programs, unless the rollout is specifically targeted at them. IT staff use their computers and applications differently from the way workers in other departments do. When running a pilot program you want to simulate day-to-day usage patterns; you don’t want people guessing how day-to-day usage occurs.
5.	Correct Answers: A Correct Hotfixes released after mid-2001 have the qchain.exe functionality used on Windows 2000 and Microsoft Windows NT 4.0 built into them. This means that you can install multiple hotfixes as long as you remember to append them with the Do Not Reboot switch (/z). To initiate a reboot, issue the shutdown –r command. Incorrect This script will not work as directed by the question because each hotfix will reboot the computer. Incorrect Qchain functionality was included in all hotfixes released after mid- 2001. This script will not execute properly. Incorrect Hotfixes released after mid-2001 have built-in qchain functionality, which means that they process updates in an orderly manner that does not require a reboot after each hotfix has been installed.
6.	Correct Answers: D Incorrect This is not true, as long as you deploy the service pack with the Uninstall This Application When It Falls Out Of The Scope Of Management option enabled. This option can be found in the Deployment tab of the service pack software deployment properties. Incorrect This makes no difference. Whether published or assigned, service packs can be removed as long as the Uninstall This Application When It Falls Out Of The Scope Of Management option is enabled upon deployment. Incorrect This makes no difference. Whether published or assigned, service packs can be removed as long as the Uninstall This Application When It Falls Out Of The Scope Of Management option is enabled upon deployment. Correct If this option is enabled, the service pack can be uninstalled by means of Group Policy settings at a later date.
7.	Correct Answers: A and B Correct When a hotfix is installed, a corresponding uninstallation directory is created off the %systemroot% directory. This directory is called $NtUninstallkbhotfixnumber$, where hotfixnumber is the KB hotfix number. KB can also be replaced by Q, which refers to a QFE (Quick Fix Engineering). Within this directory is an uninstallation directory that hosts a utility that will remove the hotfix if executed by a script. Correct Hotfixes can be uninstalled by executing the hotfix by a script and using the /uninstall and /quiet switches. Incorrect Hotfixes (unlike service packs) are not installed by using the software deployment options of Active Directory. Active Directory can be used to assign a script that will uninstall the hotfix. Incorrect This would most likely break a lot of systems. It is also unlikely to work reliably. Finally, performing a software restore on each of 500 workstations running Windows XP would be somewhat tedious. Incorrect The driver rollback facility cannot be used in this way. Hotfixes tend to have little to do with drivers. The driver rollback facility is used when a new driver creates problems on your computer, not when you want to uninstall a troublesome hotfix.
8.	Correct Answers: A and C Correct Running this command will remove the hotfix and reboot the server if required. On the next startup, the command will be ignored because the hotfix has been removed. Newer Windows Server 2003 hotfixes have different syntax from those used on Windows 2000 and Windows NT 4.0. Incorrect This procedure would work with a Windows 2000 or Windows NT 4.0 hotfix, but it does not work with a Windows Server 2003 hotfix because the syntax has changed. To find the correct syntax, use the /help switch after the hotfix name. Correct Although from the outset this may seem difficult, every hotfix that is installed on a system can be uninstalled by running the spuninst.exe utility located in an individual directory off %systemroot%. This directory is called $NtUninstallkbhotfixnumber$, where hotfixnumber is the KB hotfix number. KB can also be replaced by Q, which refers to a QFE. Hotfixes can also be uninstalled by using Add/Remove Programs in Control Panel, though only on a per-system basis. Incorrect Unlike prior versions of Windows, Windows Server 2003 does not store the hotfix in the uninstallation directory. It stores a program called spuninst.exe, which can be used to remove any installed hotfix.

< Day Day Up >