Information Technology Reference
In-Depth Information
Objective 2.4: thought experiment
Correct answers:
C, D, E. Answers A and B affect
all
removable drives, including
backup tapes and cell phones. Answers F, G, and H explicitly allow USB drive access.
1.
Correct answers:
E, F. Answers A and B affect
all
removable drives, including backup
tapes and cell phones. Answers C and D explicitly prohibit the use of cell phones or
media devices.
2.
Correct answers:
A, B, D. Both B and D are required to audit failures, C isn't required
to audit USB drive access success, and E and F are not directly related to USB drives.
3.
4.
I have significant concerns about a policy that allows cell phones and media players
because both can have significant file system access. By enabling auditing, you can
mitigate this somewhat because you'll get an audit event if someone uses any USB
device. A more restrictive policy that prohibits
all
removable devices, including Win-
dows Portable Devices (WPDs), would be more effective in preventing data theft and
malware insertion.
Objective 2.4: review
Correct answer:
C
1.
Incorrect
. This would capture all successful account management changes and
hide the events of interest in the overall noise level.
A.
Incorrect
. This would capture all failures to change account management and
would not capture successful changes. It would also be hidden in the overall noise
level.
B.
Correct
. This would capture only the successful changes to distribution groups.
C.
Incorrect
. This would capture attempts to change distribution groups, but only if
they failed.
D.
Correct answer:
A
2.
Correct:
This uses the Advanced Auditing Policy setting to enable auditing of
Logoff events.
A.
Incorrect:
This is not an Advanced Auditing Policy setting and only audits success
or failure of logon.
B.
Incorrect.
All logon and logoff events are Computer Configuration policies, not
user configuration policies.
C.
Incorrect.
All logon and logoff events are Computer Configuration policies, not
user configuration policies.
D.
