Microsoft 98-367 Online Practice Questions and Exam Preparation

Microsoft 98-367 Online Questions & Answers

• Question 171:

  Which of the following can be used to implement two-factor authentications? Each correct answer represents a complete solution. Choose all that apply.

  A. Firewall security rule
  B. Password
  C. Smart card
  D. Encrypted network configuration
  B. Password
  C. Smart card

  ---

  Answer: C and B

  Two-factor authentication is defined as a security process that is used to confirm user identities by using two individual factors as follows:

  Something they have such as token, smart cards, etc Something they know such as password.

• Question 172:

  Which of the following points has to be considered for using the BitLocker?

  A. The deployment of antivirus because BitLocker needs a a removal of buffer overflow.
  B. The deployment of SEAL because BitLocker needs an alternative encryption algorithm to software- based DES, 3DES, and AES. .
  C. The deployment of hardware because BitLocker needs a system reserved partition.
  D. The deployment of hard disk because BitLocker needs a bot.
  C. The deployment of hardware because BitLocker needs a system reserved partition.

  ---

  Answer: B is incorrect. SEAL is an alternative encryption algorithm to software- based DES, 3DES, and AES. It uses a 160-bit encryption key. SEAL provides less impact to the CPU than other software- based encryption algorithms. In Cisco IOS IPSec implementations, SEAL supports the SEAL algorithm. It can be configured through the command-line interface using the crypto ipsec transform-set command and the esp-seal transform option. Answer: A is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. It helps an attacker not only to execute a malicious code on the target system but also to install backdoors on the target system for further attacks. All buffer overflow attacks are due to only sloppy programming or poor memory management by the application developers. The main types of buffer overflows are: Stack overflow Format string overflow Heap overflow Integer overflow Answer: D is incorrect. A bot is defined as a program that is used to perform some task on a network especially a task that is repetitive or time-consuming such as spybot or tracking software that uses other forms of deceptive software and programs conducting some activities on a computer without getting appropriate consent from the users.

• Question 173:

  What are three examples of two-factor authentication? (Choose three.)

  A. A fingerprint and a pattern
  B. A password and a smart card
  C. A username and a password
  D. A password and a pin number
  E. A pin number and a debit card
  A. A fingerprint and a pattern
  B. A password and a smart card
  E. A pin number and a debit card

  ---

  At minimum two-factor authentication requires two out of three regulatory-approved authentication variables such as:

  Something you know (like the PIN on your bank card or email password).

  Something you have (the physical bank card or a authenticator token).

  Something you are (biometrics like your finger print or iris pattern).

• Question 174:

  On which of the following is the level of security set for an Internet zone applied?

  A. To the sites that you have specifically indicated as the ones that you trust.
  B. To all the Websites by default.
  C. To the sites that might potentially damage your computer, or your information.
  D. To the Websites and content that are stored on a corporate or business network.
  B. To all the Websites by default.

  ---

  The level of security set for an Internet zone is applied to all the Websites by default. Answer: C is incorrect. The level of security set for the restricted sites is applied to the sites that might potentially damage your computer, or your

  information.

  Answer: D is incorrect. The level of security set for the local intranet zone is applied to the Websites and content that are stored on a corporate or business network. Answer:

  A is incorrect. The level of security set for the trusted sites is applied to sites that you have specifically indicated as the ones that you trust.

• Question 175:

  Alice and Bob are exchanging messages with each other. Chuck modifies the messages sent between Alice and Bob as shown in the following image:

  

  Use the drop-down menus to select the answer choice that completes each statement. Each correct selection is worth one point.

  Hot Area:

  

  

• Question 176:

  You are taking over the security of an existing network. You discover a machine that is not being used as such, but has software on it that emulates the activity of a sensitive database server. What is this?

  A. A Polymorphic Virus
  B. A Honey Pot
  C. A reactive IDS.
  D. A Virus
  B. A Honey Pot

  ---

  A honey pot is a device specifically designed to emulate a high value target such as a database server or entire sub section of your network. It is designed to attract the hacker's attention.

• Question 177:

  Mark works as a Security Administrator for TechMart Inc. The company has a a Windows-based network. Mark has gone through a security audit for ensuring that the technical system is secure and protected. While this audit, he identified many areas that need improvement. He wants to minimize the risk for potential security threats by educating team members in the area of social engineering, and providing basic security principle knowledge and he also wants to stress the Con?dentiality, Integrity, and Availability triangle in his training. For this purpose, he plans to implement the principle of least privilege. In which of the following way, it will affect his team members?

  A. They are required to ask administrator every time when they want to access resources.
  B. They are granted with a smallest set of privileges to the resources
  C. They are required to log on as administrator to have access to their resources
  D. The current resource access of team members will not change.
  B. They are granted with a smallest set of privileges to the resources

  ---

  The principle of least privilege gives a user only those privileges that are essential to do his/her work. In information security, computer science, and other fields, the principle of least privilege, is also known as the principle of minimal privilege or least privilege. It define that in a particular abstraction layer of a computing environment, every module has to be able to access only the information and resources that are essential for its legitimate purpose. It needs that each subject in a system be granted the most restrictive set of privileges required for the authorized tasks.

• Question 178:

  You have an application that communicates by using plain text. You want to secure communications between the application and a server at the network layer. What should you implement?

  A. TLS
  B. SFTP
  C. SSH
  D. IPsec
  D. IPsec

  ---

  Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the packets of data sent over an Internet Protocol network. It operates at the network (layer 3 in the OSI model)

  Incorrect Answers:

  A, C: TLS and SSH are cryptographic protocols designed to provide communications security over a network. They operate at the application layer, or layer 7 of the OSI model.

  B: SFTP provides file access, file transfer, and file management over a reliable data stream. It operates at the application layer, or layer 7 of the OSI model.

  References: https://en.wikipedia.org/wiki/IPsec https://en.wikipedia.org/wiki/Transport_Layer_Security https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol

• Question 179:

  Humongous Insurance is an online healthcare insurance company. During an annual security audit a security firm tests the strength of the company's password policy and suggests that Humongous Insurance implement password history policy.

  What is the likely reason that the security firm suggests this?

  A. Past passwords were easily cracked by the brute force method.
  B. Past passwords of users contained dictionary words.
  C. Previous password breaches involved use of past passwords.
  D. Past passwords lacked complexity and special characters.
  B. Past passwords of users contained dictionary words.

• Question 180:

  Which of the following is a central, secure database in which Windows stores all hardware configuration information, software configuration information, and system security policies?

  A. Registry
  B. Program files folder
  C. DLL file
  D. Configuration file
  A. Registry

  ---

  The registry is a central, secure database in which Windows stores all hardware configuration information, software configuration information, and system security policies.

  The registry is the central storage for all configuration data. It stores Windows operating system configuration, computer hardware configuration, configuration information about Win32-based applications, and user preferences in a hierarchical

  database file.

  Answer: B, C, and D are incorrect. The Program files folder, DLL file, or Configuration file is not a central, secure database in which Windows stores all hardware configuration information, software configuration information, and system

  security policies.