Microsoft 70-685 - Questions & Answers

Chapter 10 p 467- 468
Understanding the difference between SRP and AppLocker You might want to deploy application control policies onto Windows operating systems earlier than Windows Server2008R2 or Windows7. You can use AppLocker policies only on the supported editions of Windows Server2008R2 and Windows7, but you can use SRP on supported editions of Windows beginning with Windows Server2003 and WindowsXP.
http://technet.microsoft.com/en-us/library/ee460955(WS.10).aspx
http://technet.microsoft.com/en-us/library/dd548340(WS.10).aspx

Chapter 8 Lesson 1 p 302 - 305

A. Configure event subscriptions.
Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers.
Windows 7 includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a
subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.

B. Configure the Advanced Audit Policy Configuration settings.
http://technet.microsoft.com/en-us/library/dd408940(WS.10).aspx

C. Create a custom view in Event Viewer.
You can create a filter that includes events from multiple event logs that satisfy specified criteria. You can then name and save that filter as a custom view. To apply the filter associated with a saved custom view, you navigate to the custom view in the console tree and click its name.

D. Create a user-defined Data Collector Set.
You can create a custom Data Collector Set containing performance counters and configure alert activities based on the performance counters exceeding or dropping below limits you define. After creating the Data Collector Set, you must configure the actions the system will take when the alert criteria are met.
Membership in the local Performance Log Users or Administrators group, or equivalent, is the minimum required to complete these procedures.

http://www.youtube.com/watch?v=4xxKPgT5irU
http://www.youtube.com/watch?v=fKelHBve57k

http://technet.microsoft.com/en-us/library/cc732092.aspx
Action: This type of preference item provides a choice of four actions: Create, Replace, Update, and
Delete.
The behavior of the preference item varies with the action selected and whether the printer connection already exists. Set this printer as the default printer - Select this check box to make the shared printer connection the default Windows printer for the current user. Only if a local printer is not present - Select this check box to bypass changing the default printer if there is a local printer configured on the computer. This setting is unavailable until you select the Set this printer as the default printer check box. Note: A local printer is any printer that is not connected to a shared network printer. This includes physical printers connected to parallel, serial, and USB ports, TCP/IP printers, and virtual printers installed through software.
To create a new Shared Printer preference item Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.
Right-click the Printers node, point to New, and select Shared Printer. In the New Shared Printer Properties dialog box, select an Action for Group Policy to perform. Enter shared printer settings for Group Policy to configure or remove. Click the Common tab, configure any options, and then type your comments in the Description box.
Click OK. The new preference item appears in the details pane.

Open Group Policy Management and edit the applicable GPO in your Active Directory.
Disable autorun:
Computer Configuration \ Administrative Templates \ Windows Components \ AutoPlay Policies Turn off Autoplay: Enabled

Limit to approved devices: Computer Configuration \ Administrative Templates \ System > Device Installation \ Device Installation Restrictions Allow installation of devices that match any of these device IDs: (add the corporate device)
Prevent installation of devices not described by other policy settings: Enabled

Testlet 1

City Power & Light

Scenario:

You are an enterprise desktop support technician for City Power & Light. City Power & Light is a utility company. The company has a main office and a branch office. The main office is located in Toronto. The branch office is located in Boston. The main office has 1,000 employees. The branch office has 10 employees.

Active Directory Configuration

The network contains a single Active Directory domain named cpandl.com. The functional level of the forest is Windows Server 2008 R2.

Server Configuration

All servers run Windows Server 2008 R2. The relevant servers in the main office are configured as shown in the following table.

All computers in the main office are configured to use DHCP. All computers in the branch office are configured to use static IP addresses.

User Information

All user accounts are standard user accounts.
All client computers run Windows 7 Enterprise.
Each portable computer has a PPT P-based VPN connection to the internal network.

Corporate Security Guidelines

All users must be granted the least privileges possible.
All locally stored documents must be encrypted by using Encrypting File System (EFS).
The hard disk drives on all port able computers must be encrypted by using Windows BitLocker Drive Encryption (BitLocker).
All encryption certificates must be stored on smart cards.

http://magalan.co.uk/install_software_via_group_policy.html

Chapter 6 Lesson 1 p 232 - 233
Internet Key Exchange version 2 (IKEv2) support was added in Windows Server2008R2 and Windows7 to accommodate a new VPN type that supports VPN Reconnect. VPN Reconnect refers to the ability of a VPN connection to survive short interruptions in network connectivity, such as when you move from one wireless access point to another, or when you switch from a wired to a wireless network adapter. By taking advantage of features in IKEv2, even changes in IP address at the client do not drop the VPN connection or require any user actions. As soon as connectivity to the RRAS VPN server is restored, then the VPN tunnel is automatically reestablished.

Troubleshooting item in Control Panel
To focus troubleshooting on DirectAccess and collect additional information, you can use the Connection to a Workplace Using DirectAccess troubleshooter in the Troubleshooting item of Control Panel.
To start the DirectAccess troubleshooter: Click Start, and then click Control Panel.
In System and Security, click Find and fix problems. Click Network and Internet, and then click Connection to a Workplace Using DirectAccess.

Note: For this troubleshooting tool to work correctly, you must configure the Computer Configuration/ Policies/Administrative Templates/Network/Network Connectivity Status Indicator/Corporate Website Probe URL Group Policy setting in the Group Policy object for DirectAccess clients.
http://technet.microsoft.com/en-us/library/ee624046(WS.10).aspx

http://technet.microsoft.com/en-us/library/dd875513(WS.10).aspx

Testlet 1

A. Datum Corporation

Scenario:

You are an enterprise desktop support technician for A. Datum Corporation.

Active Directory Configuration

The company has three offices. The offices are configured as shown in the following table.

The network contains a single Active Directory domain named adatum.com. Two Group Policy objects (GPOs) are configured as shown in the following table.

The relevant servers in the main office are configured as shown in the following table.

Wireless Network
A wireless network is implemented in the main office. The wireless network is configured to use WPA2-Enterprise security.

Client Configuration

All client computers run Windows 7 Enterprise and are configured to use DHCP. Windows Firewall is disabled on all client computers.
All computers in the research department have Windows XP Mode and Windows Virtual PC installed. You deploy a custom Windows XP Mode image to the research department computers.
An application named
App1 is installed in the image.

Each research department computer has the following hardware:

4 GB of RAM
Intel Core i7 processor
500 -GB hard disk drive

Corporate Security Policy

The corporate security policy includes the following requirements:

Users without domain accounts must be denied access to internal servers.
All connections to the company's wireless access points must be encrypted.
Only employees can be configured to have user accounts in the Active Directory domain.
The hard disk drives on all portable computers must be encrypted by using Windows BitLocker Drive Encryption (BitLocker).