Microsoft 98-367 Online Practice Questions and Exam Preparation

Microsoft 98-367 Online Questions & Answers

• Question 261:

  Which of the following protocols transmits user credentials as plaintext?

  A. CHAP
  B. MS-CHAP v2
  C. PAP
  D. MS-CHAP
  C. PAP

  ---

  Password Authentication Protocol (PAP) is the least sophisticated authentication protocol, used mostly when a client calls a server running an operating system other than Windows. PAP has a number of security vulnerabilities because it

  transmits user credentials as plaintext.

  Answer: A is incorrect. Challenge Handshake Authentication Protocol (CHAP) is an authentication protocol that uses a secure form of encrypted authentication. Using CHAP, network dial-up connections are able to securely connect to almost

  all PPP servers.

  Answer: B is incorrect. Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) is the new version of MS-CHAP. MS-CHAP v2 provides the highest level of security and encryption for dial-up connection in the

  environment consisting of both Windows NT and Windows 2000/XP dial-up clients. It provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving data. Answer: D is incorrect.

  Microsoft created the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) to authenticate remote Windows workstations. It is designed especially for Windows 95, Windows 98, Windows NT, and Windows 2000 networking

  products. This protocol provides data encryption along with password encryption.

• Question 262:

  The company that you work for wants to set up a secure network, but they do not have any servers. Which three security methods require the use of a server? (Choose three.)

  A. 802.1x
  B. WPA2 Personal
  C. WPA2 Enterprise
  D. RADIUS
  E. 802.11ac
  A. 802.1x
  C. WPA2 Enterprise
  D. RADIUS

• Question 263:

  Which enables you to change the permissions on a folder?

  A. Take ownership
  B. Extended attributes
  C. Auditing
  D. Modify
  D. Modify

• Question 264:

  Mark works as a Systems Administrator for TechMart Inc. The company has a Windows-based network. The company is adding an open, high-speed, wireless access for their customers and secured wireless for employees at all 37 branches. He wants to check the various security concerns for ensuring that business traffic is secured. He is also under pressure to make this new feature a winning strategy for a company. Which of the following is the most secure protocol that Mark can implement to ensure that the business-related traffic is encrypted?

  A. WiFi Protected Access (WPA) 2
  B. Extensible Authentication Protocol (EAP)
  C. Wired Equivalent Privacy (WEP)
  D. Service Set Identifiers
  A. WiFi Protected Access (WPA) 2

  ---

  WPA2 (Wi-Fi Protected Access 2) is used to provide network administrators with a high level of assurance that only authorized users are able to access the network. It provides government grade security by implementing the National Institute of Standards and Technology (NIST) FIPS 140-2 compliant AES encryption algorithm. Wireless Security Options are used to decrease the risk of data interception by a third party in Wireless Networking. Data can be protected by using encryption technologies. In Wireless Networking Connection, various methods are used to increase security as follows: Using Wired Equivalent Privacy: The goal is to allow only authorized users to connect to the wireless network. While initially configuring routers and network adapters, users create a WEP key. The level of security depends on the length of the key measured in bits. Another step is to share WEP keys to authorized users. Specifically, it is possible for unauthorized users to determine the mathematical value of a WEP key by monitoring a sufficient amount of networking traffic. WEP is an additional security, but it does not completely address all potential vulnerabilities. Using Wi-Fi Protected Access: The Wi-Fi Protected Access protocol is used to provide higher security over the WEP standard. It is considered as a replacement for the less secured WEP protocol. WPA security is configured on a wireless router or an access point. Using Service Set Identifiers: Service Set Identifiers are used to assist users to find and connect to a wireless network. Whenever a wireless network adapter is available on a computer, Windows Vista automatically identifies the available networks based on their SSID. Answer: B is incorrect. Extensible Authentication Protocol (EAP) is defined as an authentication framework providing for the transport and usage of keying material and parameters that are generated by EAP methods. EAP is not a wire protocol and it defines only message formats.

• Question 265:

  Which of the following is a US Federal government algorithm created to generate a secure message digest?

  A. DSA
  B. RSA
  C. Triple DES
  D. SHA
  D. SHA

  ---

  SHA is a Federal government algorithm created to generate a secure message digest. The Secure Hash Algorithm (SHA) is a cryptographic hash algorithm. It generates a fixed-length digital representation (message digest) of an input data sequence of any length. The SHA algorithm is very secure, as it is computationally very difficult to find a message that corresponds to a given message digest. In this algorithm, any change to a message will result in a completely different message digest. There are five SHA algorithms: SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. Answer: A is incorrect. Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. DSA is a public key algorithm; the secret key operates on the message hash generated by SHA-1; to verify a signature, one recomputes the hash of the message, uses the public key to decrypt the signature and then compares the results. The key size is variable from 512 to 1024 bits, which is adequate for the current computing capabilities as long as a user uses more than 768 bits. Answer: B is incorrect. RSA stands for Rivest, Shamir, and Adleman. It is an algorithm for public-key cryptography. It is the first algorithm known to be suitable for signing as well as encryption, and one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations. Answer: C is incorrect. Triple DES is the common name for the Triple Data Encryption Algorithm (TDEA). It is so named because it applies the Data Encryption Standard (DES) cipher algorithm three times to each data block. The Data Encryption Standard (DES) is a block cipher (a form of shared secret encryption), which is based on a symmetric-key algorithm that uses a 56-bit key. The algorithm was initially controversial with classified design elements, a relatively short key length, and suspicions about a National Security Agency (NSA) backdoor. Triple DES provides a relatively simple method of increasing the key size of DES to protect against brute force attacks, without requiring a completely new block cipher algorithm.

• Question 266:

  Your password is 1Vu*cI!8sT.

  Which attack method is your password vulnerable to?

  A. Rainbow table
  B. Brute force
  C. Spidering
  D. Dictionary
  A. Rainbow table

• Question 267:

  Mark works as a Security Officer for TechMart Inc. The company has a Windows- based network. He has bees assigned a project for ensuring the safety of the customer's money and information, not to mention the company's reputation. The company has gone through a security audit to ensure that it is in compliance with industry regulations and standards. Mark understands the request and has to do his due diligence for providing any information the regulators require as they are targeting potential security holes. In this situation, his major concern is the physical security of his company's system. Which of the following actions will Mark take to prevent the use of key loggers in the company?

  A. Provide protection against a Distributed Denial of Services attack.
  B. Call a team member while behaving to be someone else for gaining access to sensitive information.
  C. Ensure that the terminals are locked and perform a regular inspection of the ports on the systems.
  D. Develop a social awareness of security threats within an organization.
  C. Ensure that the terminals are locked and perform a regular inspection of the ports on the systems.

  ---

  To prevent the use of key loggers in the organization, user is required to ensure that the terminals are locked and to perform a regular inspection of the ports on the systems.

  Answer: A While stressing the Con? dentiality, Integrity, and Availability triangle in the training of users, the process of providing availability is related to security training to ensure the protection against a Distributed Denial of Services attack.

• Question 268:

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. Each correct selection is worth one point.

  Hot Area:

  

  

• Question 269:

  Which of the following states that a user should never be given more privileges than are required to carry out a task?

  A. Security through obscurity
  B. Segregation of duties
  C. Principle of least privilege
  D. Role-based security
  C. Principle of least privilege

  ---

  The principle of least privilege states that a user should never be given more privileges than are required to carry out a task. The user should not be logged on as an administrator, if the user is not doing administrative work on a computer. The

  administrator account should be used for performing tasks, such as changing system time, installing software, or creating standard accounts. Answer: D is incorrect. Role-based security provided by the .NET Framework allows, grants, or

  denies access to resources based on a Windows user's identity. It is built on the principle that the user is authenticated and can be authorized or assigned roles and permissions.

  Answer: B is incorrect. Segregation of duties is used to determine whether decision-making, executive tasks, or control tasks are carried out by a person to avoid unauthorized or unintended changes or the misuse of the organization's assets.

  Whether the person needs access to information can also be determined. The risk of information being intentionally or unintentionally used, altered, or destroyed is increased by unnecessary access. It is called the 'need to know' principle.

  Answer: A is incorrect. Security through obscurity is a principle in security engineering, which attempts to use secrecy (of design, implementation, etc.) to provide security. A system relying on security through obscurity may have theoretical or

  actual security vulnerabilities, but its owners or designers believe that the flaws are not known, and that attackers are unlikely to find them.

• Question 270:

  DRAG DROP

  Match the components of a secure website with their role in securing communication.

  Instructions: To answer, drag the appropriate component from the column on the left to its role on the right.

  Each component may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place: