Case Study

---

You should give yourself 20 minutes to review this testlet, review the table, and complete the questions.

Background

T&C Incorporated manufactures and markets sporting goods across the U.S. The company has four offices. The main office is in Philadelphia, PA, and it has branch offices in Wilmington, DE, Minneapolis, MN, and Los Angeles, CA. The company’s employees and departments are distributed as shown in the following table:

Location	Employees	Departments
Philadelphia	1,000	Executive and Information Technology (IT)
Wilmington	75	Sales and Marketing
Minneapolis	5,000	Manufacturing
Los Angeles	30	Customer Support

Existing Environment

The IT staff in the Philadelphia office uses client computers to remotely administer all of the T&C servers, including domain controllers. Employees use the corporate workstations to access the sales material and marketing data as well as domain controllers. Most of the corporate information is hosted on an internal website that is running Internet Information Services (IIS) 6.

T&C’s network is contained within a single Active Directory domain named tandc.com. All of the servers are running Windows Server 2003, Enterprise Edition. Administration of the Active Directory is centralized in Philadelphia. Wilmington and Los Angeles user and computer accounts are located in child OUs for their location.

All client computers are running Windows XP Professional. All sites are connected using VPNs across the Internet. Wilmington is connected directly to the Philadelphia office with a dedicated T1 line.

The following business problem must be considered: Executives connect to network resources using laptops that need to be secured differently than the desktop computers in the executive’s office.

Interviews

Chief Information Officer Security is a major concern here at T&C. We must make the security much stronger on client computers, servers, and especially domain controllers.

System Administrator Different departments will require different security patches. We will need to evaluate the patches before we deploy them to the computers. After the patches are tested, they need to be deployed to the servers in each department. You need to use as little network bandwidth as possible for deploying security patches.

Chief Security Officer We need to verify that the appropriate security patches are applied to the computers in our organization.

Business Requirements

A standard set of written security settings must be defined and configured from a central location and deployed to all servers and client computers in the marketing and customer support departments. The IIS and SQL Server machines must be routinely evaluated for missing patches. Internet traffic must be kept to a minimum.

---