Microsoft-Designing Security for a Windows Server 2003 Network Set 1

Question 04 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to design security changes that provide maximum protection for customer data and courier assignments. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 05 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to improve the company's security patch management process. Your solution must meet existing business requirements and it cannot increase the number of employees or unnecessarily increase ongoing administrative effort. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 01 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- The company wants to evaluate making all business office users administrators on their client computers. You need to design a method to ensure that this change can be made in a manner that meets business and security requirements. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Written Security Policy Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 02 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to identify potential security threats. Which of the following security breaches might occur under the current IT and security practices? (Choose all that apply) Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 03 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to design a method for junior IT administrators to perform more IT support tasks. Your solution must meet business and security requirements. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 04 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to design security changes that provide maximum protection for customer data and courier assignments. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 05 Case Study #9, Consolidated Messenger ---------------------------------------------------------------- You need to improve the company's security patch management process. Your solution must meet existing business requirements and it cannot increase the number of employees or unnecessarily increase ongoing administrative effort. What should you do? Case Study Title (Case Study): Case Study #9, Consolidated Messenger Overview Consolidated Messenger is a large courier service company in New York. The company dispatches messengers throughout the city to pick up packages for immediate delivery elsewhere in the city. Physical Locations The main office is near the center of the city. The main office includes a business office and a courier dispatch lounge where couriers pick up their assignments. Business Processes Business staff handles customer billing, accepts phone calls for new courier assignments, and enters the assignments into a custom, Active Directory-integrated, client-server application. Couriers use Web kiosk in the lounge to pick up their assignments. The Web kiosks run only Internet Explorer. Couriers use a password to log on to the subsystem, and they are supposed to log off after they read their assignments. Because couriers are paid by the assignment, they must log in and mark each assignment as complete to be paid. Couriers do not have physical access to the business office. The company always experiences a high rate of turnover among the courier staff. The information technology (IT) department has one senior administrator and two junior administrators who provide all IT support for company users and couriers. Business staff requires access to mail servers, file servers, and client-server applications on the company LAN. Couriers need access to only the specialized Web-based application that is available to them on the Web kiosk in the dispatch lounge. Currently, access to resources is secured by using NTFS permissions and Active Directory-integrated application-specific authentication. All customer billing and contact information must remain confidential. Directory Services The company's network consists of a single Active Directory domain. All users have domain user accounts. The senior IT administrator centrally manages all accounts. Network Infrastructure The network consists of the following three segments: * Segment 1 contains all server computers. * Segment 2 contains all business staff client computers. * Segment 3 contains all dispatch lounge courier kiosks. A router connects the three segments. The router also connects the LAN to the Internet and provides basic firewall services. The Internet connection has a range of 64 to 256 Kbps of bandwidth. There are five Windows Server 2003 computers on Segment 1. The courier dispatch lounge contains only Windows XP Professional client computers. The business office contains client computers that run the following operating systems: * Windows 2000 Professional * Windows 98 Second Edition * Windows NT Workstation 4.0 * Windows XP Professional * Windows 95 Problem Statements Access to customer data and courier assignments is not sufficiently secure. Couriers use simplistic passwords and often guess other couriers' passwords. In the past, couriers have gained unauthorized access to confidential customer data. The company has no means of discovering who gained unauthorized access. Chief Executive Officer Though some of our data is not confidential, we need to increase security for our data that is confidential. We have had major security problems in the past, including compromised confidential customer data. This is a problem because we are contractually obliged to protect customer data. We also need to able to identify users who do gain unauthorized access. To achieve our goals, we can spend money on security, but we cannot increase the number of employees. Chief Information Officer Our IT staff use their administrative accounts for everything which is acceptable on their own client computers. However, they often log on to business office client computers with their own administrative account, and they forget to log off after they are done. Consequently, business office users can perform tasks by using administrator privileges, which creates network problems. We also struggle to main client computers and services with current security patches. Though IT staff test security patches when they come out, they cannot always find the time to deploy them. We cannot use Windows Update on client computers because of our low Internet bandwidth. To conserve bandwidth, our firewall prevents client computers from accessing Windows Update. So, although servers have access to Windows Update administrators often forget to run it. Solutions to these problems cannot require any more ongoing work from IT staff. Senior IT Administrator The junior administrators need to help to create new user accounts. However, they are not currently authorized to create new administrative staff accounts or to edit any existing accounts. Although company policy allows junior administrators to only reset passwords, the domain permissions do not currently allow them to do so. Junior IT Administrator Our biggest security patch management problem is that our users are not administrators on their computers. Though we would need to track user administrative actions, I think we should make users administrators on their own computers. Courier Even though I know I should pick a difficult password, I can only remember so much. To simplify my life, I use the same password at every job. I have heard that couriers watch and steal other courier's passwords, but it has never happened to me. Consolidated Messenger's written security policy contains the following requirements: * We must monitor and track when business office users attempt to make system registry configuration changes to their computers. We do not need to monitor or track everyday actions on client computers. * We must monitor and track all access to sensitive company data, including most customer data and courier assignments. * We must maintain all computers with current security patches for critical updates. The senior IT administrator is responsible for first testing all patches and then releasing them to all client and server computers in the company. * We must limit the use of user accounts that have domain administrators or other administrator privileges. Only IT staff will have access to domain administrative accounts.

Question 03 Case Study #10, Fabrikam ---------------------------------------------------------------- You need to design a patch management strategy that meets business requirements. What should you do? Case Study Title (Case Study): Overview: Fabrikam, Inc., is a personnel recruiting agency for contract employees. The company supports technology companies' needs for contract consultants, network administrators, and information technology (IT) professionals. Physical Locations: The company's main office is located in London. The company has two branch offices. For each of its largest customers, Fabrikam, Inc., provides one to five on-site employees from the sales department to work full-time at the customer's office. Existing Environment Business Processes: The London office consists of the following departments:

Question 08 Case Study #10, Fabrikam ---------------------------------------------------------------- You need to design an access control strategy for the financial data used by the accounting department. Your solution must meet business requirements. What should you do? Case Study Title (Case Study): Overview: Fabrikam, Inc., is a personnel recruiting agency for contract employees. The company supports technology companies' needs for contract consultants, network administrators, and information technology (IT) professionals. Physical Locations: The company's main office is located in London. The company has two branch offices. For each of its largest customers, Fabrikam, Inc., provides one to five on-site employees from the sales department to work full-time at the customer's office. Existing Environment Business Processes: The London office consists of the following departments:

Question 01 Case Study #10, Fabrikam ---------------------------------------------------------------- You need to design a security solution for the internally developed Web applications that meets business requirements. What should you do?(Case Study missing} Case Study Title (Case Study): Overview: Fabrikam, Inc., is a personnel recruiting agency for contract employees. The company supports technology companies' needs for contract consultants, network administrators, and information technology (IT) professionals. Physical Locations: The company's main office is located in London. The company has two branch offices. For each of its largest customers, Fabrikam, Inc., provides one to five on-site employees from the sales department to work full-time at the customer's office. Existing Environment Business Processes: The London office consists of the following departments: