You need to design a security patch management strategy. You

第1题：

You are the network administrator for your company. Your network consists of a single Active   Directory domain. Three security groups named Accountants， Processors， and Management are located in an organizational unit （OU） named Accounting. All of the user accounts that belong to these three  groups are also in the Accounting OU. You create a Group Policy object （GPO） and link it to the  Accounting OU. You configure the GPO to disable the display options under the User Configuration  section of the GPO. You need to achieve the following goals： You need to ensure that the GPO applies to  all user accounts that are members of the Processors group. You need to prevent the GPO fromapplying  to any user account that is a member of the Accountants group. You need to prevent the GPO from  applying to any user account that is a member of the Management group， unless the user account is also  a member of the Processors group. What should you do？（）

• A、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants and Management security groups the Deny - Read and the Deny - Apply Group Policy permissions. Modify the DACL of the GPO to assign the users who are in both the Accountants and Management security groups the Allow - Read and the Allow - Apply Group Policy permissions.
• B、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants and Management security groups the Deny - Read and the Deny - Apply Group Policy permissions. Create a new security group named Mixed that contains all the user accounts from the Processors group and the specific user accounts from the Management group to which you want the GPO to apply. Modify the DACL of the GPO to assign the Mixed security group the Allow - Read and the Allow - Apply Group Policy permissions.
• C、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants security group the Deny - Read and the Deny - Apply Group Policy permissions. Modify the DACL settings of the GPO to remove the Authenticated Users special group. Modify the DACL settings of the GPO to add the Processors group and assign the Allow - Read and the Allow - Apply Group Policy permissions.
• D、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants security group the Deny - Read and the Allow - Apply Group Policy permissions. Modify the DACL settings of the GPO to assign the Management security group the Deny - Read and the Deny - Apply Group Policy permissions.

第2题：

You need to design a method to log changes that are made to servers and domain controllers. You also need to track when administrators modify local security account manager objects on servers. What should you do？（）

• A、Enable failure audit for privilege user and object access on all servers and domain controllers
• B、Enable success audit for policy change and account management on all servers and domain controllers
• C、Enable success audit for process tracking and logon events on all servers and domain controllers
• D、Enable failure audit for system events and directory service access on all servers and domain controllers

第3题：

第4题：

You have an Exchange Server 2010 organization.  You have a global security group named Legal that contains all the members of your companys legaldepartment.  The companys security policy states that the Legal group must be able to search all mailboxes for e-mailmessages that contain specific keywords.  You need to recommend a solution for the organization that complies with the security policy.  What should you include in the solution？（）

• A、a Discovery Management role group
• B、a legal hold
• C、administrator audit logging
• D、Mailbox journaling

第5题：

You need to design a security patch management strategy. Your solution must meet business and security requirements， and it must accommodate the company’s resource restrictions. What should you do？（）

• A、Test and manually deploy updates
• B、Deploy a Software Update Services （SUS） server. Test all updates and then approve them. Configure all client computers to automatically obtain updates from the server
• C、Test all updates and then use a third-party utility to repackage updates in a Windows Installer file. Deploy the -.msi files by using Group Policy
• D、Configure all client computers to use Automatic Updates to obtain security updates from the Windows Update Web site. Test all updates posted to the Windows Update Web site

第6题：

You are the network administrator for your company. The network consists of a single Active Directory domain. The network contains 50 application servers that run Windows Server 2003.   The security configuration of the application servers is not uniform. The application servers were deployed by local administrators who configured the settings for each of the application servers differently based on their knowledge and skills. The application servers are configured with different authentication methods， audit settings， and account policy settings.   The security team recently completed a new network security design. The design includes a baseline configuration for security settings on all servers. The baseline security settings use the Hisecws.inf predefined security template. The design also requires modified settings for servers in an application role. These settings include system service startup requirements， renaming the administrator account， and more stringent account lockout policies. The security team created a security template named Application.inf that contains the modified settings.   You need to plan the deployment of the new security design. You need to ensure that all security settings for the application servers are standardized， and that after the deployment， the security settings on all application servers meet the design requirements.   What should you do？ （）

• A、 Apply the Setup security.inf template first， the Hisecws.inf template next， and then the Application.inf template.
• B、 Apply the Application.inf template and then the Hisecws.inf template.
• C、 Apply the Application.inf template first， the Setup security.inf template next， and then the Hisecws.inf template.
• D、 Apply the Setup security.inf template and then the Application.inf template.

第7题：

You need to design a method to address the chief information officer’s security concerns. What should you do？（）

• A、Configure Windows Management Instrumentation （WMI） filtering options in the Default Domain Policy GPO
• B、Use the gpresult command
• C、Use Mbsacli.exe
• D、Configure software restriction policy options in the Default Domain Policy GPO

第8题：

You need to design a method to standardize and deploy a baseline security configuration for servers. You solution must meet business requirements. What should you do？（）

• A、Create a script that installs the Hisecdc.inf security template
• B、Use a GPO to distribute and apply the Hisec.inf security template
• C、Use the System Policy Editor to configure each server’s security settings
• D、Use a GPO to distribute and apply a custom security template

第9题：

You have an Exchange Server 2010 organization that consists of 50 Exchange Server 2010 servers. Your companys security policy states that approved Exchange and Windows Server patches and securityupdates must be applied to all Exchange servers within one week of being released.  You need to recommend a patch management solution that meets the following requirements： .Allow administrators to manually approve patches and security updates .Allow only the installation of approved patches and security updates  .Minimize the administrative effort to deploy patches  .Minimize the deployment costs What should you include in the solution？（）

• A、Microsoft Update
• B、Microsoft System Center Configuration Manager
• C、Windows Server Update Services
• D、Windows Update

第10题：

You have a server that runs Windows Server 2003 Service Pack 2 (SP2).You need to compare the current security settings of the server to a security template. Which tool should you use?（）

• A、Security Templates snap-in 
• B、Group Policy Management Console 
• C、Security Configuration and Analysis snap-in 
• D、Microsoft Baseline Security Analyzer (MBSA)