Ch16
1. B –
Ch16 – Page 462-463 - Under – Understanding Group Policy Objects – There are 3 subheadings listed as Local GPOs, Domain GPOs, and Starter GPOs. The differences between these groups are explained here.

2. B –
Ch16 – Page 463 – Under – Viewing the Group Policy Container - By default, installing Active Directory Domain Services on Windows Server 2012 creates two GPOCs, corresponding to two default GPOs: Default Domain Policy and Default Domain Controller Policy. The two GPCs are named using globally unique identifiers (GUIDs) assigned to the GPOs during their creation.

3. D –
Ch16 – Page 482 – Under – Create Local GPO – After logging on to a Windows Computer using an account with Administrative privileges, the Server Manager Console appears and the steps to create Local GPO, then Secondary GPO, then a Tertiary GPO and the policy settings for each GPO are outlined here.

4. A –
Ch16 – Page 485 – Under – Skill Summary - Group Policies applied to parent containers are inherited by all child containers and objects. You can alter inheritance by using the Enforce, Block Policy Inheritance, or Loopback settings.

5. B –
Ch16 – Page 462 – Under Local GPO - All Windows operating systems have support for local Group Policy objects, sometimes known as LGPOs. Windows versions Windows Server 2008 R2 and Windows Vista support multiple local GPOs and enables you to specify a different local GPO for administrators or to create specific GPO settings for one or more local users configured on a workstation.

++++++++++++++++++++++++++++++++++++++++++++++++++

Ch17

1. C –
Ch17 – Page 507 - Under – Using the User Control Panel – WS 2012 creates 2 local user accounts during operating system installation process; the Administrator and Guest accounts. The setup program prompts installer for Administrator password during installation, whereas Guest account is disabled by default. When installation process is complete, system restarts. Because only the Administrator account is available, computer logs on using that account. This account has administrative privileges, so at this point you can create additional user accounts or modify the existing ones.

2. C –
Ch17 - Page 503 – Under – Planning a Security Template Strategy - When planning a security template strategy, think in terms of computer roles, rather than individual computers. It is possible to create a separate template for each computer and customize the settings for that particular computer’s needs and apply them to multiple computers, using combinations in cases where computers perform multiple roles

3. A –
Ch17 - Page 503 – Under – Planning a Security Template Strategy – It’s possible to create separate templates for a domain controller role and a server role, and apply different security requirements by determining the security levels required by each role.

4. B –
Ch17 - Page 505 – Under – Maintaining and Optimizing Group Policy – Windows reapplies most Group Policy settings during a refresh, although there are some policy settings that process only during an initial startup or during the first user logon.

5. D –
Ch17 - Page 507 – Under – Configuring Local Users and Groups – Windows Server 2012 provides two separate interfaces for creating and managing local user accounts: the User Accounts control panel and the Local Users and Groups snap-in for MMC. Both interfaces provide access to the same Security Account Manager (SAM) where user and group information is stored; any changes made using one interface will appear in the other.

+++++++++++++++++++++++++++++++++++++++++++++++++

Ch18
1. A –
Ch18 – Page 545 – Under – Skill Summary- Using Organizational Units - The Windows Installer service supports three types of package files: .msi files for standard software installation, .mst files for customized software installation, and .msp files for patching .msi files at the time of deployment

2. C –
Ch18 – Page 524 - Under - Deploying Software Using Group Policy - Before deploying software using Group Policy, you must create a distribution share. This shared folder, also called a software distribution point, is a network location from which users can download the software that they need.

3. A –
Ch18 – Page 531-532 – Under - Customizing Software Installation Packages - If the package is set to Assigned, the Install This Application At Logon option is available. This option enables the application to be installed immediately, rather than advertised on the Start menu. If users have slow links between their workstations and the software distribution point, this option should be avoided. Installation can take a lot of time when performed using a slow link.

4. A –
Ch18 – Page 525 – Under – Publishing an application – The Publish method of distributing applications also enables a file-activated installation to take place. When a user opens a file associated with an application that does not currently exist on that user’s workstation, the application is installed.

5. C –
Ch18 – Page 535-536 – Under – Configuring software restriction rules – The most common way to implement software restriction policies is through Group Policy objects linked to Active Directory Domain Services containers, so that you can apply their policy settings to several computers simultaneously. However, it is also possible to configure software restriction policies on individual computers by using Local Security Policy.

+++++++++++++++++++++++++++++++++++++++++++++++++

Ch19
1. B –
Ch19 – Page 551 – Under –Building a Firewall – Firewall, a software program protecting a computer or a network allows certain types of network traffic in and out of the system while blocking others. It’s essentially a series of filters that examine contents of packets and traffic patterns to and from the network to determine which packets should pass through the filter.

2. A –
Ch19 – Page 556 - Under – Customizing Settings - Windows Firewall uses these profiles to represent the type of network to which the server is connected, as follows:
Public: is intended for servers that are accessible to unauthenticated or temporary users, such as computers in an open lab or kiosk.
Private: is intended for a server on an internal network that is not accessible by unauthorized users.
Domain: applies to servers that are members of an Active Directory Domain Services domain, in which all users are identified and authenticated.

3. D –
Ch19 – Page 566 – Under – Import Windows Firewall Rules - When you import policies from a file, the console warns you that all existing rules and settings will be overwritten. You must therefore be careful not to create custom rules on a computer, and then expect to import other rules using a policy file.

4. B –
Ch19 – Page 558 – Under – Using the windows firewall with advanced setting console - Windows Firewall control panel is designed to enable administrators and advanced users to manage basic firewall settings. For full access to the Windows Firewall configuration settings, you must use the Windows Firewall with Advanced Security snap-in for the Microsoft Management Console

5. B –
Ch19 – Page 557 – Under – Allowing Applications –
Opening a port - Opening a port in a server’s firewall is an inherently dangerous activity. The more open doors you put in a wall, the more opportunities that intruders can exploit to get in.

Allowing application - Administrators might be required to modify the firewall settings in other ways, typically because a specific application requires access to a port not anticipated by the firewall’s default rules.