Related Exam

Related Posts

400$ [R2]route-policy med permit node 10 [r2-route-policy]if-match as-path-filter 1 [r2-route-policy]apply cost 20

A. Configure deterministic-med under the BGP process of R1.
B. Configure deterministic-med under the BGP process of R2
C. Configure compare-different-as-med in the BGP process of R1.
D. Configure compare-different-as-med under the BGP process of R2.
Answer: C



NEW QUESTION: 2
Eine Bank der Europäischen Union (EU) unterhält eine Korrespondenzbankbeziehung mit einer US-Bank. Gemäß Abschnitt 311 des USA PATRIOT Act hat die US-Regierung Sondermaßnahmen gegen eine benannte Stelle erlassen, die ein Durchzahlungskonto bei der EU-Bank hat. Welche der folgenden Maßnahmen muss die US-Bank möglicherweise in Bezug auf die Dienstleistungen der EU-Bank für das benannte Unternehmen ergreifen?
A. Stellen Sie sicher, dass die EU-Bank dem benannten Unternehmen dient.
B. Stellen Sie sicher, dass die vertraulichen Informationen der angegebenen Entität nicht mit anderen Entitäten geteilt werden.
C. Erhalten Sie zusätzliche Informationen zu Kunden, die dieses Konto verwenden dürfen.
D. Führen Sie eine erweiterte Due Diligence für die EU-Bank durch.
Answer: A



NEW QUESTION: 3
Your network contains two standalone servers named Server1and Server2 that have Active Directory
Lightweight Directory Services (AD LDS) installed.
Server1 has an AD LDS instance.
You need to ensure that you can replicate the instance from Server1 to Server2.
What should you do on both servers?
A. Register the service location (SRV) resource records.
B. Obtain a server certificate.
C. Import the MS-User.ldf file.
D. Create a service user account for AD LDS.
Answer: D
Explanation:
http://technet.microsoft.com/en-us/library/dd548356(v=WS.10).aspx
Or/And Considerations when using a domain-based service account with AD LDS
By Tony Murray on Monday, April 13, 2009 9:39 PM
When creating an AD LDS instance you are prompted to specify an account to use as the service account. At this point you can specify either the Network Service account or another account. Unless you have a particular need, you should choose the built-in Network Service account. If you opt for a domain-based service account you have to jump through a whole lot of hoops to get things working. Also, you typically end up giving your domain-based service account more permissions than are strictly necessary (as described later in this article). The Network Service account on the other hand provides an easy set up option and is a good choice from a security perspective given that the account has limited access to the local computer.

So why bother to use a domain-based service account at all? Well, if you have a number of services on your server all running under the context of the Network Service account there is potential for security compromise. In this scenario you may want to consider isolating the services from each other using dedicated service accounts. What follows is a discussion of the steps required to configure AD LDS to use a domain-based service account.
1. Create a user account in AD.
The account doesn't require any specific group memberships. As a service account, you may want to give some thought to the "Password Never Expires" setting, as well as password complexity.
2. Permission to create serviceConnectionPoint objects.
The account you have created requires the ability to create Service Connection Point objects in AD. These objects are typically created automatically as child objects of the AD LDS computer object when the service is started. The simplest method is to set the permission using DSACLS. You could alternatively use the security editor from within dsa.msc or adsiedit.msc, but you would first need to edit the %systemroot%\system32\dssec.dat file to expose the serviceConnectionPoint object.
Here's the syntax using DSACLS:
C:\>dsacls <DN_of_ADLDS_server> /G <Domain\User>:CC;"serviceConnectionPoint"
e.g.
C:\>dsacls "CN=ADLDS1,OU=Servers,DC=Widget,DC=com" /G MyDom
\ADLDS_SVC:CC;"serviceConnectionPoint"
The setting should appear similar to that shown in the screenshot below.

3. Permission to create servicePrincipalName objects.
Your service account also needs permissions to create Service Principal Name (SPN).
The SPNs are generated automatically as attributes of the service account itself in AD
when the service is first started. Note that this is different from the behaviour when
running the service under the Network Service account. When using Network Service,
the SPNs are created as attributes of the AD LDS server's computer object.
To set the permissions, assign the SELF account Read/Write servicePrincipalName. The
permissions are applied onto This object only on the service account object. Here's an
example using DSACLS.
C:\>dsacls <DN_of_Service_Account> /G SELF:RPWP;"servicePrincipalName"
e.g.
C:\>dsacls "CN=ADLDS_SVC,OU=Service Account,DC=Widget,DC=com" /G
SELF:RPWP;"servicePrincipalName"
The screenshot below shows how the permissions should appear.

4. Grant "Log on as a service" user rights
The service account requires Log on as service user rights on the server running the AD
LDS instance. You don't normally have to assign this right in advance because you will
be prompted when creating the instance using the setup wizard.
If you have to set this right manually, use the Group Policy Editor to edit the local policy,
or alternatively use the GPMC to edit an appropriate domain policy. The location of the
setting is:
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies ->
User Rights Assignment.
The screenshot below shows the setting.

5. Membership of the local Administrators group.
At the time of writing, the AD LDS product documentation indicates that the service
account is not required to be a member of the local Administrators group on server running the AD LDS instance. However, my experience is that without this, the following error is generated in the event log corresponding to the instance each time the service is re-started.
Log Name: ADAM (instance1) Source: ADAM [instance1] General Date: 6/04/2009 11:22:08 a.m. Event ID: 1168 Task Category: Internal Processing Level: Error Keywords: Classic User: ANONYMOUS LOGON Computer: ADLDS1.widget.com Description: Internal error: An Active Directory Lightweight Directory Services error has occurred.
Additional Data Error value (decimal): -1073741790 Error value (hex): c0000022 Internal ID: 3000715
The fact that the service account requires membership of the local Administrators group makes the choice to use Network Service even more compelling. The Network Service account has a lower level of privilege on the local machine than that of members of the Administrators group. This implies the potential for compromise is lower when using Network Service.
Conclusion
As you can see, using domain-based service accounts for your AD LDS instances requires a fair amount of extra work during setup. I recommend that you use Network Service unless your circumstances require you to use a domain account.



NEW QUESTION: 4
プロジェクトマネージャーは、利害関係者の関与計画を最終決定しています。プロジェクトマネージャーは、学習したレジスタを参照し、このプロジェクトに関与している1つの利害関係者とのコミュニケーションに問題があったことを発見しました。この利害関係者を関与させるアプローチのいずれも最適な結果を生み出しませんでした。
A. 同僚に働きかけて、利害関係者について詳しく学びます。
B. 利害関係者の行動の根本原因分析を実施し、リスクレジスターに文書化する
C. 利害関係者にプロジェクトを離れるよう依頼します。
D. 利害関係者の影響力を評価します。
Answer: B