Download Testout Labs Exam Questions & Answers | 85 Questions with 100% Correct Answers | Verified and more Exams Computer Applications in PDF only on Docsity! Testout Labs Exam Questions & Answers | 85 Questions with 100% Correct Answers | Verified | Updated 2023 | 121 Pages 2.2.6 Configure Microsoft Defender You recognize that the threat of malware is increasing. As such, you would like to use Windows Virus & Threat Protection to protect your computer from malware. In this lab, your task is to enable and configure Windows Virus & Threat Protection as follows: 1. Add a file exclusion for D:\Graphics\cat.jpg. 2. Add a process exclusion for welcome.scr. 3. Locate the current threat definition version number. 4. Answer Question 1. 5. Check for updates. 6. Answer Question 2. Perform a quick scan - Correct answer Complete this lab as follows: 1. Access the Virus & threat protection options. a. Right-click Start; then select Settings. b. Select Update & Security. c. From the left pane, select Windows Security. d. Select Virus & threat protection. 2. Add a file exclusion for D:\Graphics\cat.jpg. a. Under Virus & threat protection settings, select Manage settings. b. Scroll down to Exclusions and then select Add or remove exclusions. c. Select Add an exclusion; then select File. d. From the left pane, browse to and select Data (D:) > Graphics > cat.jpg, and then select Open. 3. Add a process exclusion for welcome.scr. a. From the Exclusions dialog, select Add an exclusion; then select Process. b. In the Enter process name field, type welcome.scr; then select Add. 4. Check for protection updates. a. In the top left, select the back arrow twice to return to the Virus & threat protection page. b. Scroll down to Virus & threat protection updates and then select Check for updates to access the Protection updates page. c. In the top right, select Answer Questions. d. Answer Question 1. e. Select Check for updates. f. Answer Question 2. 5. Perform a quick virus scan. a. In the top left of the Windows Security dialog, select the back arrow to return to the Virus & threat protection page. b. Select Quick scan. c. Wait for the scan to complete. 6. From the Lab Questions dialog, select Score Lab. 2.3.11 ResourcesIMPORTANT NOTICE-Action RequiredSafeKeepWhile this email appears very urgent, it doesn't ask you to click on anything or run any attachments. It does inform you that you need to go a website that you should already know and make sure your courses are complete.Activities CommitteePumpkin ContestSafeKeepThis email doesn't ask you to click on anything or run any attachments.Robert WilliamsPresentationSafeKeepThis email doesn't ask you to click on anything or run any attachments. 3.1.3 Implement Physical Security Based on a review of physical security at your office, you have recommended several improvements. Your plan includes installing smart card readers, IP cameras, signs, and an access log book. In this lab, your task is to: Implement your physical security plan by dragging the correct items from the shelf onto the various locations in the building. As you drag the items from the shelf, the possible drop locations are highlighted. To implement your plan, you must: Install two IP security cameras in the appropriate location to record which employees access the key infrastructure. The security cameras should operate over the TCP/IP network. Install the smart card key readers in the appropriate location to control access to key infrastructure. The key card readers should be contactless and record more information than the card's ID. Install a Restricted Access sign on the networking closet door to control access to the infrastructure. Install the visitor log on the lobby desk. - Correct answer Complete this lab as follows: Install the IP security cameras:From the Shelf, expand CCTV Cameras.Drag the IP Security Camera from the shelf to the highlighted circle inside the networking closet.Drag the IP Security Camera from the shelf to the highlighted circle just outside the networking closet. Install the smart card key readers:From the Shelf, expand Door Locks.Drag a smart card reader from the shelf to the highlighted location outside the building's front door.Drag a smart card reader from the shelf to the highlighted location outside the networking closet's door. Install the Restricted Access sign:From the Shelf, expand Restricted Access Signs.Drag the Restricted Access sign from the shelf to the networking closet door. Install the visitor log:From the Shelf, expand Visitor Logs.Drag the visitor log from the shelf to the lobby desk. 4.2.5 Configure Automatic Updates You need to customize how Windows Update checks for and installs updates on the ITAdmin desktop system. In this lab, your task is to: Configure Windows Update to:Install updates for other Microsoft products when Windows is updated.Allow the installation of feature updates to be deferred 60 days.Allow quality updates to be deferred 30 days. Configure Windows to automatically download manufacturers' apps and custom icons for devices. - Correct answer Complete this lab as follows: Configure the Windows Update settings.Right-click Start and then select Settings.Select Update & Security.From the right pane, select Advanced options.Under Update Options, turn on Receive updates for other Microsoft products when you update Windows by sliding the switch to On.Under Choose when updates are installed, configure each option as follows:A feature update includes new capabilities and improvements. It can be deferred for 60 days.A quality update includes security improvements. It can be deferred for this many days: 30Close the Settings window. Configure Windows to automatically download the manufacture's apps and custom icons.In the search field on the Windows taskbar, type Control.From Best match, select Control Panel.Select System and Security.Select System.From the left pane, select Advanced system settings.Select the Hardware tab.Select Device Installation Settings.Select Yes and then select Save Changes.Select OK. 4.2.7 Configure Microsoft Defender Firewall You have a new laptop that is running Windows 10. You notice a security message that indicates that Windows Firewall has been disabled. The laptop is currently connected to your organization's network, and the Domain network profile settings are in effect. You Remove the Users group from the access control list.In Permission entries, select Users.Select Remove to remove the group from the access control list.Select OK. Add a new group to the access control list and allow Full Control.Select Edit to add a group to the access control list.Select Add.Enter the name of the group you want to add and then select Check Names.Select OK.With the newly added group selected, under the Allow column, select Full control and then select OK.Select OK to close the properties dialog. Repeat steps 2 - 4 to modify the permissions for the additional folder. 4.3.6 Disable Inheritance Confidential personnel data is stored on the CorpFiles file server in a shared directory named Personnel. You need to configure NTFS permissions for this folder so that only managers are authorized to access it. In this lab, your task is to perform the following: Grant the Managers group the Full Control permission to the D:\Personnel folder. Remove all inherited permissions that are flowing to the D:\Personnel folder. - Correct answer Complete this lab as follows: Open the Data (E:) drive.From the Windows taskbar, select File Explorer.From the left pane, expand and select This PC > Data (D:). Configure NTFS permissions.From the right pane, right-click Personnel and select Properties.Select the Security tab.Select Edit.Select Add.Enter Managers as the group that will receive permission to the folder.Click OK.With the Managers group selected, select the appropriate Full control.Click OK. Prevent inherited permissions from parent.On the Security tab, select Advanced.Select Disable inheritance.Select Remove all inherited permissions from this object.Click OK to close the Advanced Security Settings for Personnel dialog.Click OK to close the Properties dialog. 5.1.7 Configure a Security Appliance You are an IT security administrator for a small corporate network. To increase security for the corporate network, you have installed the pfSense network security appliance in your network. Now you need to configure the device. In this lab, your task is to configure pfSense as follows: Sign in to pfSense using the following case-sensitive information:URL: 198.28.56.18Username: adminPassword: pfsense Configure the DNS servers as follows:Primary DNS server: 163.128.78.93 - Hostname: DNS1Secondary DNS server: 163.128.80.93 - Hostname: DNS2 Configure the WAN IPv4 information as follows:Enable the interface.Use a static IPv4 address of 65.86.24.136/8Add a new gateway using the following information:Type: Default gatewayName: WANGatewayIP address: 65.86.1.1 - Correct answer Complete this lab as follows: Access the pfSense management console.From the taskbar, select Google Chrome.Maximize the window for better viewing.In the address bar, type 198.28.56.18 and then press Enter.Sign in using the following case-sensitive information:Username: adminPassword: pfsenseSelect SIGN IN or press Enter. Configure the DNS Servers.From the pfSense menu bar, select System > General Setup.Under DNS Server Settings, configure the primary DNS Server as follows:Address: 163.128.78.93Hostname: DNS1Gateway: NoneSelect Add DNS Server to add a secondary DNS Server and then configure it as follows:Address: 163.128.80.93Hostname: DNS2Gateway: NoneScroll to the bottom and select Save. Configure the WAN settings.From pfSense menu bar, select Interfaces > WAN.Under General Configuration, select Enable interface.Use the IPv4 Configuration Type drop- down to select Static IPv4.Under Static IPv4 Configuration, in the IPv4 Address field, enter 65.86.24.136.Use the IPv4 Address subnet drop-down to select 8.Under Static IPv4 Configuration, select Add a new gateway.Configure the gateway settings as follows:Default: Select Default gatewayGateway name: Enter WANGatewayGateway IPv4: 65.86.1.1Select Add.Scroll to the bottom and select Save.Select Apply Changes. 5.1.8 Configure Network Security Appliance Access You work as the IT security administrator for a small corporate network. You need to secure access to your pfSense appliance, which is still configured with the default user settings. In this lab, your task is to: Change the password for the default pfSense account from pfsense to P@ssw0rd (use a zero). Change the port number used on the floating rule created for MSRDP as follows:Interface: GuestWi-FiDestination Port Range: 3391 Answer the question. - Correct answer Complete this lab as follows: Sign into the pfSense management console.In the Username field, enter admin.In the Password field, enter P@ssw0rd (zero).Select SIGN IN or press Enter. Create a high bandwidth usage alias.From the pfSense menu bar, select Firewall > Aliases.Select Add.Configure the Properties as follows:Name: HighBWDescription: High bandwidth usersType: Host(s)Add the IP addresses of the offending computers to the host(s) configuration as follows:Under Host(s), in the IP or FQDN field, enter 172.14.1.25.Select Add Host.In the new IP or FQDN field, enter 172.14.1.100.Select Save.Select Apply Changes. Start the Traffic Shaper wizard for dedicated links.From the pfSense menu bar, select Firewall > Traffic Shaper.Under the Firewall bread crumb, select Wizards.Select traffic_shaper_wizard_dedicated.xml.Under Traffic shaper Wizard, in the Enter number of WAN type connections field, enter 1 and then select Next. Configure the Traffic Shaper.Make sure you are on Step 1 of 8.Using the drop-down menu for the upper Local interface, select GuestWi-Fi.Using the drop-down menu for lower Local interface, make sure PRIQ is selected.For the upper Upload field, enter 5.Using the drop-down menu for the lower Upload field, select Mbit/s.For the top Download field, enter 45.Using the drop-down menu for the lower Download field, select Mbit/s.Select Next. Prioritize voice over IP traffic.Make sure you are on Step 2 of 8.Under Voice over IP, select Enable to prioritize the voice over IP traffic.Under Connection #1 parameters, in the Upload rate field, enter 15.Using the drop-down menu for the top Units, select Mbit/s.For the Download rate, enter 20.Using the drop-down menu for the bottom Units, select Mbit/s.Select Next. Enable and configure a penalty box.Make sure you are on Step 3 of 8.Under Penalty Box, select Enable to enable the penalize IP or alias option.In the Address field, enter HighBW. This is the alias created earlier.For Bandwidth, enter 2.Select Next. Continue to step 6 of 8.For Step 4 of 8, scroll to the bottom and select Next.For Step 5 of 8, scroll to the bottom and select Next. Raise and lower the applicable application's priority.Make sure you are on Step 6 of 8.Under Raise or lower other Applications, select Enable to enable other networking protocols.Under Remote Service / Terminal emulation, use the:MSRDP drop-down menu to select Higher priority.VNC drop-down menu to select Higher priority.Under VPN:Use the PPTP drop-down menu to select Higher priorityUse the IPSEC drop-down menu to select Higher priorityScroll to the bottom and select Next.For step 7 of 8, select Finish.Wait for the reload status to indicate that the rules have been created (look for Done). View the floating rules created for the firewall.Select Firewall > Rules.Under the Firewall breadcrumb, select Floating.In the top right, select Answer Questions.Answer the question and then minimize the question dialog. Change the port number used for the MSRDP outbound rule.For the m_Other MSRDP outbound rule, select the edit icon (pencil).Under Edit Firewall Rule, in the Interface field, select GuestWi-Fi.Under Destination, use the Destination Port Range drop-down menu to select Other.In both Custom fields, enter 3391.Select Save.Select Apply Changes.In the top right, select Answer Questions.Select Score Lab. 5.2.3 Configure a DMZ You are the IT administrator for a small corporate network. You want to make a web server that runs services accessible from the internet. To help protect your company, you want to place this server and other devices in a demilitarized zone (DMZ). This DMZ and server need to be protected by the pfSense Security Gateway Appliance (pfSense). Since a few of the other devices in the DMZ require an IP address, you have also decided to enable DHCP on the DMZ network. In this lab, your task is to perform the following: Access the pfSense management console:Username: adminPassword: P@ssw0rd (zero) Add a new pfSense interface that can be used for the DMZ.Name the interface DMZ.Use a static IPv4 address of 172.16.1.1/16 Add a firewall rule for the DMZ interface that allows all traffic from the DMZ.Use a description of Allow DMZ to any rule Configure and enable the DHCP server for the DMZ interface.Use a range of 172.16.1.100 to 172.16.1.200 - Correct answer Complete this lab as follows: Sign into the pfSense management console.In the Username field, enter admin.In the Password field, enter P@ssw0rd (zero).Select SIGN IN or press Enter. Range, use the From drop-down to select HTTP (80).Under Destination, use the Destination drop-down to select Single host or alias.In the Destination Address field, enter 172.16.1.5.Using the Destination Port Range drop-down, select HTTP (80).Under Extra Options, in the Description field, enter HTTP to DMZ from WAN.Select Save.Select Apply Changes. Create and configure a firewall rule to pass HTTPS traffic from the internet to the Web server.For the rule just created, select the Copy icon (two files).Under Source, select Display Advanced.Change the Source Port Range to HTTPS (443).Under Destination, change the Destination Port Range to HTTPS (443).Under Extra Options, change the Description filed to HTTPS to DMZ from WAN.Select Save.Select Apply Changes. Create and configure a firewall rule to pass all traffic from the LAN network to the DMZ network.Select Add (either one).Make sure Action is set to Pass.For Protocol, use the drop-down to select Any.Under Source, use the drop-down to select LAN net.Under Destination, use the drop-down to select DMZ net.Under Extra Options, change the Description filed to LAN to DMZ Any.Select Save.Select Apply Changes. 5.4.3 Configure NAT You are the IT administrator for a small corporate network. One of your assignments is to manage several computers in the demilitarized zone (DMZ). However, your computer resides on the LAN network. To be able to manage these machines remotely, you have decided to configure your pfSense device to allow several remote control protocols to pass through the pfSense device using NAT port forwarding. In this lab, your task is to create NAT forwarding rules to: Access the pfSense management console:Username: adminPassword: P@ssw0rd (zero) Allow the RDP/TCP Protocols from the LAN network to the administrator's PC located in the DMZ using the following guidelines:IP address for the administrator's PC: 172.16.1.100Description: RDP from LAN to Admin Allow the SSH Protocol through the pfSense device to the Kali Linux server using the following guidelines:IP address for the Linux Kali server: 172.16.1.6Description: SSH from LAN to Kali Allow the RDP/TCP Protocols from the LAN network to the web server located in the DMZ using the following guidelines:Destination and redirect port: Port 5151IP address for the web server: 172.16.1.5Description: RDP from LAN to web server using custom port - Correct answer Complete this lab as follows: Sign into the pfSense management console.In the Username field, enter admin.In the Password field, enter P@ssw0rd (zero).Select SIGN IN or press Enter. Configure NAT port forwarding for the administrator's PC.From the pfSense menu bar, select Firewall > NAT.Select Add (either one).Configure or verify the following settings:Interface: LANProtocol: TCPDestination type: LAN addressDestination port range (From and To): MS RDPRedirect target IP: 172.16.1.100Redirect target port: MS RDPDescription: RDP from LAN to AdminSelect Save. Configure NAT port forwarding for the Kali Linux server.Select Add (either one).Configure or verify the following settings:Interface: LANProtocol: TCPDestination type: LAN addressDestination port range (From and To): SSHRedirect target IP: 172.16.1.6Redirect target port: SSHDescription: SSH from LAN to KaliSelect Save. Configure NAT port forwarding for the web server.Select Add (either one).Configure or verify the following settings:Interface: LANProtocol: TCPDestination type: LAN addressDestination port range (From and To): OtherCustom (From and To) 5151Redirect target IP: 172.16.1.5Redirect target port: MS RDPDescription: RDP from LAN to web server using custom portSelect Save.Select Apply Changes. 5.5.4 Configure a Remote Access VPN You work as the IT security administrator for a small corporate network. Occasionally, you and your co-administrators need to access internal resources when you are away from the office. You would like to set up a Remote Access VPN using pfSense to allow secure access. In this lab, your task is to use the pfSense wizard to create and configure an OpenVPN Remote Access server using the following guidelines: Sign in to pfSense using:Username: adminPassword: P@ssw0rd (zero) Create a new certificate authority certificate using the following settings:Name: CorpNet- CACountry Code: GBState: CambridgeshireCity: WoodwaltonOrganization: CorpNet Create a new server certificate using the following settings:Name: CorpNetCountry Code: GBState: CambridgeshireCity: Woodwalton currently at home and would like to connect your iPad to the VPN. Your iPad is connected to your home wireless network. In this lab, your task is to: Add an IPSec VPN connection using the following values:ParameterValueDescriptionCorpNetVPNServer198.28.56.34AccountmbrownSec retasdf1234$ Turn on the VPN. Verify that a connection is established. The password for mbrown is L3tM31nN0w (0 = zero). - Correct answer Complete this lab as follows: Verify your connection to the Home-Wireless network.Select Settings.Select Wi-Fi. Add and configure a VPN.From the left menu, select General.From the right menu, select VPN.Select Add VPN Configuration.Select IPSec.In the Description field, enter CorpNetVPN.In the Server field, enter 198.28.56.34.In the Account field, enter mbrown.In the Secret field, enter asdf1234$.In the upper right, select Save. Connect to the VPN just created.Under VPN Configuration, slide Not Connected to ON.When prompted, enter L3tM31nN0w (0 = zero) as the password.Select OK. 5.6.3 Configure URL Blocking You are the security analyst for a small corporate network. After monitoring your network, you have discovered that several employees are wasting time visiting non- productive and potentially malicious websites. As such, you have added pfBlockerNG to your pfSense device. You now need to configure this feature and add the required firewall rules that allow/block specific URLs and prevent all DNS traffic from leaving your LAN network. In this lab, your task is to: Sign in to pfSense using:Username: adminPassword: P@ssw0rd (zero) Create a firewall rule that blocks all DNS traffic leaving the LAN network. Create a firewall rule that allows all DNS traffic going to the LAN network. Use the following table for the two rules: ParameterSettingProtocolUDP (53)DescriptionsFor the block rule: Block DNS from LANFor the allow rule: Allow all DNS to LAN Arrange the firewall rules in the order that allows them to function properly. Enable and configure pfBlockerNG using the information in the following table: ParameterSettingDNSBL Virtual IP192.168.0.0Top-Level Domain (TLD) Blacklistfinancereports.cototalpad.comsalesscript.infoTop-Level Domain (TLD) Whitelist.www.google.com.play.google.com.drive.google.com - Correct answer Complete this lab as follows: Sign into the pfSense management console.In the Username field, enter admin.In the Password field, enter P@ssw0rd (zero).Select SIGN IN or press Enter. Create a firewall rule that blocks all DNS traffic coming from the LAN.From the pfSense menu bar, select Firewall > Rules.Under the Firewall breadcrumb, select LAN.Select Add (either one).Under Edit Firewall Rule, use the Action drop-down to select Block.Under Edit Firewall Rule, set Protocol to UDP.Under Source, use the drop-down menu to select LAN net.Under Destination, configure the Destination Port Range to use DNS (53) (for From and To).Under Extra Options, in the Description field, enter Block DNS from LAN.Select Save.Select Apply Changes. Create a firewall rule that allows all DNS traffic going to the LAN network.Select Add (either one).Under Edit Firewall Rule, set Protocol to UDP.Under Destination, use the drop-down menu to select LAN net.Configure the Destination Port Range to use DNS (53) (for From and To).Under Extra Options, in the Description field, enter Allow all DNS to LAN.Select Save.Select Apply Changes. Arrange the firewall rules in the order that allows them to function properly.Using drag- and-drop, move the rules to the following order (top to bottom):Anti-Lockout RuleAllow all DNS to LANBlock DNS from LANIn the simulated version of pfSense, you can only drag and drop the rules you created. You cannot drag and drop the default rule.Select Save.Select Apply Changes. Enable pfBlockerNG.From the pfSense menu bar, select Firewall > pfBlockerNG.Under General Settings, select Enable pfBlockerNG.Scroll to the bottom and select Save. Enable and configure DNS block lists.Under the Firewall breadcrumb, select DNSBL.Select Enable DNSBL.For DNSBL Virtual IP, enter 192.168.0.0.Scroll to the bottom and expand TLD Blacklist.Enter the following URLs in the TLD Blacklist box:financereports.cototalpad.comsalesscript.infoExpand TLD Whitelist and then enter the following URLs:.www.google.com.play.google.com.drive.google.comSelect Save. 5.9.6 Secure a Switch Renew the IP information for the ITAdmin computer.Right-click Start and select Windows PowerShell (Admin).From the Command Prompt, type ipconfig /renew to renew the IP address.Type ipconfig /all to confirm the MAC address and the IP address have been updated. 5.11.9 Harden a Switch You are the IT security administrator for a small corporate network. You need to increase the security on the switch in the networking closet. The following table lists the used and unused ports: Unused PortsUsed PortsGE2GE7GE9-GE20GE25GE27-GE28GE1GE3- GE6GE8GE21-GE24GE26 In this lab, your task is to: Shut down the unused ports. Configure the following Port Security settings for the used ports:Interface Status: LockLearning Mode: Classic LockAction on Violation: Discard - Correct answer While completing this lab, use the following information: Unused PortsUsed PortsGE2GE7GE9-GE20GE25GE27-GE28GE1GE3- GE6GE8GE21-GE24GE26 Complete this lab as follows: Shut down the unused ports.Under Initial Setup, select Configure Port Settings.Select the GE2 port.Scroll down and select Edit.Under Administrative Status, select Down.Scroll down and select Apply.Select Close.With the GE2 port selected, scroll down and select Copy Settings.In the Copy configuration field, enter the remaining unused ports.Select Apply.From the Port Setting Table, in the Port Status column, you can see that all the ports are down now. Configure the Port Security settings.From the left menu, expand Security.Select Port Security.Select the GE1 port.Scroll down and select Edit.Under Interface Status, select Lock.Under Learning Mode, make sure Classic Lock is selected.Under Action on Violation, make sure Discard is selected.Select Apply.Select Close.Scroll down and select Copy Settings.Enter the remaining used portsSelect Apply. 5.11.10 Secure Access to a Switch You are the IT security administrator for a small corporate network. You need to increase the security on the switch in the Networking Closet by restricting access management and by updating the switch's firmware. In this lab, your task is to: Create an access profile named MgtAccess and configure it with the following settings:SettingValueAccess Profile NameMgtAccessRule Priority1Management MethodAllActionDenyApplies to InterfaceAllApplies to Source IP addressAll Add a profile rule to the MgtAccess profile with the following settings:SettingValueRule Priority2Management MethodHTTPActionPermitApplies to interfaceAllApplies to Source IP addressUser definedIP Version: Version 4IP Address: 192.168.0.10Network Mask: 255.255.255.0 Set the MgtAccess profile as the active access profile. Save the changes to the switch's startup configuration file using the default settings. Update the firmware image to the latest version by downloading the firmware files found in C:\Sx300_Firmware\Sx300_FW-1.2.7.76.ros. - Correct answer Complete this lab as follows: Create and configure an Access Profile named MgtAccess.From the left pane, expand and select Security > Mgmt Access Method > Access Profiles.Select Add.Enter the Access Profile Name of MgtAccess.Enter the Rule Priority of 1.For Action, select Deny.Select Apply and then select Close. Add a profile rule to the MgtAccess profile.From the left pane, under Security > Mgmt Access Method, select Profile Rules.Select the MgtAccess profile and then select Add.Enter a Rule Priority of 2.For Management Method, select HTTP.For Applies to Source IP Address, select User Defined.For IP Address, enter 192.168.0.10.Enter the 255.255.255.0.Select Apply and then select Close. Set the MgtAccess profile as the active access profile.From the left pane, under Security > Mgmt Access Method, select Access Profiles.Use the Active Access Profile drop-down list to select MgtAccess.Select Apply.Select OK. Save the changes to the switch's startup configuration file.At the top, select Save.For Source File Name, make sure Running configuration is selected.For Destination File Name, make sure Startup configuration is selected.Select Apply.Select OK. Upgrade the firmware image to the latest version.From the left pane, select Getting Started.Under Quick Access, select Upgrade Device Software.For File Name, select Choose File.Browse to and select C:\Sx300_Firmware\Sx300_FW-1.2.7.76.ros.Select Open.Select Apply.Select OK.From the left pane, under File Management, select Active Explore VLANs You are the IT security administrator for a small corporate network. You need to increase the networking closet's security by implementing a CCTV system with IP cameras. As part of this task, you need to separate the CCTV data traffic on the network using a separate VLAN on the switch. The patch panel connections for the networking closet, lobby, and IT administration office are installed and ready for use (ports 18-20). A DHCP server is already configured to provide the IP cameras and the laptop in the IT administration office with the correct TCP/IP settings (port 21). For an easier implementation, create the logical VLAN first and then establish the physical connections of the IP cameras and the laptop. In this lab, your task is to perform the following: Access the switch management console from ITAdmin using the following credentials:Address: http://192.168.0.2Username: ITSwitchAdminPassword: Admin$only (the password is case-sensitive) Create and configure a VLAN on the switch as follows:VLAN ID: 2VLAN Name: IPCamerasConfigure ports GE18, GE19, GE20, GE21 as untagged.Port 18 is connected to the network jack next to the laptop in the IT administration office.Port 19 is connected to the camera mount in the lobby.Port 20 is connected to the camera mount in the networking closet.Port 21 is connected to a DHCP server that provides IP addresses to the camera and the laptop. In the lobby and networking closet, perform the following:Connect a Cat5e cable to the RJ-45 ports on the IP camera and the IP camera wall plate.Mount the IP camera on the wall plate. In the networking closet, connect the DHCP server to the VLAN using a Cat5e cable from switch port 21 to patch panel port 21 in the rack. In the IT administration office, connect a Cat5e cable to the laptop's network port and the open port on the wall plate. On ITAdmin-Lap, verify the VLAN configuration and IP camera installation as follows:Select Start > IP Cameras.Verify that the program detects the IP cameras on the VLAN 2 network. - Correct answer Complete this lab as follows: From the ITAdmin computer, log into the CISCO switch.From the taskbar, open Google Chrome.Maximize the window for easier viewing.In the URL field, enter 192.168.0.2 and press Enter.For Username, enter ITSwitchAdmin.For Password, enter Admin$only (password is case-sensitive).Select Log In. Create a VLAN.From the Getting Started pane, under Initial Setup, select Create VLAN.Select Add.For VLAN ID, enter 2.For VLAN Name, enter IPCameras.Select Apply.Select Close. Configure a VLAN.From the left pane, under VLAN Management, select Port to VLAN.From the the VLAN ID equals to drop-down menu, select 2.Select Go.For ports GE18, GE19, GE20, and GE21, select Untagged.Select Apply. Connect the IP camera in the lobby to the VLAN and mount the IP cameras.From the top navigation area, select Floor 1.Under Lobby, select Hardware.Under Shelf, expand CCTV Cameras.Drag the IP Camera (Lobby) to the workspace.Under Workspace for the IP camera, select Back to switch to the back view of the IP camera.Under Shelf, expand Cables and then select a Cat5e Cable, RJ45.Under Selected Component, drag a RJ45 Connector to the RJ-45 port on the IP Camera wall mount plate.From the wall plate's Partial Connections list, drag the other connector to the RJ-45 port on the back of the IP camera.Drag the IP camera to the IP camera wall plate. Connect the IP camera in the networking closet to the VLAN and mount the IP cameras.From the top navigation area, select Floor 1.Under Networking Closet, select Hardware.Under Shelf, expand CCTV Cameras.Drag the IP Camera (Networking Closet) to the workspace.Under Workspace for the IP camera, select Back to switch to the back view of the IP camera.Under Shelf, expand Cables and then select Cat5e Cable, RJ45.Under Selected Component, drag a RJ45 Connector to the RJ-45 port on the IP Camera mount wall plate.Under Selected Component, drag the unconnected RJ45 cable to the RJ-45 port on the back of the IP camera.To mount the IP camera, drag the IP camera to the IP camera wall plate. Connect the DHCP server and laptop to the VLAN.In the networking closet, under Shelf, select a Cat5e Cable, RJ45.Under Selected Component, drag a RJ45 Connector to port 21 on the switch.Under Selected Component, drag the unconnected RJ45 Connector to port 21 on the patch panel. Connect the laptop to the VLAN.From the top menu, select Floor 1.Under IT Administration, select Hardware.Above the laptop, select Back to switch to the back view of the laptop.Under Shelf, select Cat5e Cable, RJ45.Under Selected Component, drag a RJ45 Connector to the RJ-45 port on the laptop.Under Selected Component, drag the unconnected RJ45 Connector to the open RJ-45 port on the wall plate.To Add a permit any statement to Access List 11 to allow all traffic other than the restricted traffic. Save your changes in the startup-config file. - Correct answer Complete this lab as follows: Enter the configuration mode for the Fiji router:From the exhibit, select the Fiji router.From the terminal, press Enter.Type enable and then press Enter.Type config term and then press Enter. From the terminal, add a permit any statement to Access List 11 to allow all traffic other than the restricted traffic.Type access-list 11 permit any and press Enter.Press Ctrl + Z. Save your changes in the startup-config file.Type copy run start and then press Enter.Press Enter to begin building the configuration.Press Enter. 5.13.7 Block Source Hosts You have a small business network connected to the internet through a single router as shown in the network diagram. You have noticed that three hosts on the internet have been flooding your router with unwanted traffic. As a temporary measure, you want to prevent all communication from these three hosts until the issue is resolved. In this lab, your task is to: Create a Standard Access List 25. Add statements to the access list to block traffic from the following hosts:199.68.111.199202.177.9.1211.55.67.11 Add a statement to allow all other traffic from all other hosts. Apply Access List 25 to the Serial0/0/0 interface to filter incoming traffic. - Correct answer Complete this lab as follows: Enter the configuration mode for the router:From the exhibit, select the router.From the terminal, press Enter.Type enable and then press Enter.Type config term and then press Enter. From the terminal, create a standard numbered access list using number 25. Add statements to the access list to block traffic to the required hosts.Type access-list 25 deny host 199.68.111.199 and press Enter.Type access-list 25 deny host 202.177.9.1 and press Enter.Type access-list 25 deny host 211.55.67.11 and press Enter. From the terminal, add a statement to allow all other traffic from all other hosts, by typing access-list 25 permit any and pressing Enter. From the terminal, apply Access List 25 to the Serial0/0/0 interface to filter incoming traffic.Type int s0/0/0 and press Enter.Type ip access-group 25 in and press Enter.Type Ctrl + Z. 6.5.5 Create OUs You are the IT administrator for a small corporate network. You have just installed Active Directory on a new Hyper-V guest server named CorpDC. Now you need to create an Active Directory organizational unit (OU) structure based on the company's departmental structure. In this lab, your task is to create the following organizational units (OUs) on the CorpDC server and ensure that each is protected from accidental deletion as follows: Beneath the CorpNet.local domain, create the following OUs:AccountingAdminsMarketingResearch-DevServersSupportWorkstationsSales Within the Sales OU, create the following OUs:SalesManagersTempSales - Correct answer While completing this lab, use the following information: Beneath the CorpNet.local domain, create the following OUs:AccountingAdminsMarketingResearch-DevServersSupportWorkstationsSales Beneath the Sales OU, create the following OUs:SalesManagersTempSales Complete this lab as follows: Access the CorpDC server.From the left pane of Hyper-V Manager, select CORPSERVER.From the Virtual Machines pane, double-click CorpDC. Create the Active Directory organizational units (OUs) beneath the CorpNet.local domain.From Server Manager's menu bar, select Tools > Active Directory Users and Computers.From the left pane, right-click CorpNet.local and then select New > Organizational Unit.You can also create OUs by selecting the Create a new organizational unit in the current container icon () located in the Active Directory Users and Computers ribbon.Enter the name of the OU to be created.Ensure that Protect container from accidental deletion is selected and then select OK.Repeat steps 2b - 2d until all the required domain OUs are created. Create the OUs within the Sales OU.From the left pane, select CorpNet.local > Sales.From the menu bar, select the Create a new organizational unit in the current container icon.Enter the name of the OU to be created.Ensure that Protect container from accidental deletion is selected and then select OK.Repeat steps 3a - 3d to create the remaining OU. Complete this lab as follows: Access the CorpNet.local domain.From Server Manager, select Tools > Group Policy Management.Expand Forest: CorpNet.local > Domains > CorpNet.local.Maximize the window for better viewing. Create the Workstation Settings GPO and link it to the CorpNet.local domain.Right-click the Group Policy Objects OU and select New.In the Name field, enter the Workstation Settings and then click OK. Link OUs to the Workstation Settings GPO.Right-click the OU and select Link an Existing GPO.Under Group Policy Objects, select Workstation Settings from the list and then click OK.Repeat step 3 to link the additional OUs. Import the ws_sec.inf security policy template.Expand Group Policy Objects.Right-click Workstation Settings and select Edit.Under Computer Configuration, expand Policies > Windows Settings.Right-click Security Settings and select Import Policy.Browse to the C:\Templates.Select ws_sec.inf and then click Open. 6.5.11 Create User Accounts You are the IT administrator for a small corporate network. You recently added an Active Directory domain to the CorpDC server to manage network resources centrally. You now need to add user accounts in the domain. In this lab, your task is to create the following user accounts on CorpDC: UserJob RoleDepartmental OUJuan SuarezMarketing managerMarketing\ MarketingManagersSusan SmithPermanent sales employeeSales\PermSalesMark BurnesSales managerSales\SalesManagersBorey ChanTemporary sales employeeSales\TempSales Use the following user account naming standards and specifications as you create each account: Create the user account in the departmental OU corresponding to the employee's job role. User account name: First name + Last name Logon name: firstinitial + lastname with @CorpNet.local as the domain Original password: asdf1234$ (must change after the first logon) Configure the following for the temporary sales employee:Limit the logon hours to allow logon only from 8:00 a.m. to 5:00 p.m., Monday through Friday.Set the user account to expire on December 31st of the current yea - Correct answer Use the following user account specifications as you create each account. UserJob RoleDepartmental OUJuan SuarezMarketing managerMarketing\ MarketingManagersSusan SmithPermanent sales employeeSales\PermSalesMark BurnesSales managerSales\SalesManagersBorey ChanTemporary sales employeeSales\TempSales Complete this lab as follows: Access Active Directory Users and Computers on the CorpDC server.From Hyper-V Manager, select CORPSERVER.From the Virtual Machines pane, double-click CorpDC.From Server Manager's menu bar, select Tools > Active Directory Users and Computers.Maximize the window for better viewing. Create the domain user accounts.From the left pane, expand CorpNet.local.Browse to the appropriate OU.Right-click the OU and select New > User.In the First name field, enter the user's first name.In the Last name field, enter the user's last name.In the User logon name field, enter the user's logon name which should be the first letter of the user's first name together with their last name. (e.g. jsuarez)The domain, @CorpNet.local, is appended automatically to the end of the logon name.Click Next.Select Next.In the Password field, enter asdf1234$.In the Confirm password field, enter asdf1234$.Make sure User must change password at next logon is selected and then click Next.Select Finish to create the object.Repeat steps 3e-3m to create the additional users. Modify user account restrictions for the temporary sales employee.Right-click Borey Chan and select Properties.Select the Account tab.Select Logon hours.From the Logon Hours dialog, select Logon Denied to clear the allowed logon hours.Select the time range of 8:00 a.m. to 5:00 p.m., Monday through Friday.Select Logon Permitted to allow logon.Select OK.Under Account expires, select End of.In the End of field, use the drop- down calendar to select 31 December of the current year.Select OK. 6.5.12 Manage User Accounts You are the IT administrator for a small corporate network. You recently added an Active Directory domain on the CorpDC server to manage network resources centrally. Organizational units in the domain represent departments. User and computer accounts are in their respective departmental OUs. You are the IT administrator for the CorpNet domain. You have decided to use groups to simplify the administration of access control lists. Specifically, you want to create a group containing the department managers. In this lab, your task is to use Active Directory Users and Computers to complete the following actions on the CorpDC server: In the Users container, create a group named Managers. Configure the group as follows:Group scope: GlobalGroup type: Security Make the following users members of the Managers group: Organization UnitUsernameAccountingMark WoodsResearch-DevPat BentonMarketing\ MarketingManagersJuan SuarezResearch-Dev\ResearchManagersArlene KimblySales\ SalesManagersMark BurnesSupport\SupportManagersShelly Emery - Correct answer Complete this lab as follows: Access Active Directory Users and Computers on the CorpDC server.From Hyper-V Manager, select CORPSERVER.From the Virtual Machines pane, double-click CorpDC.From Server Manager's menu bar, select Tools > Active Directory Users and Computers.Maximize the window for better viewing. In the Users container, create a group named Managers.From the left pane, expand and select CorpNet.local > Users.Right-click the Users container and select New > Group.You can also create a new group by selecting the Create a new group in the current container icon found in the ribbon.In the Group name field, enter Managers.A pre-Windows 2000 group name is created automatically, but it can be changed.Under Group scope, make sure Global is selected.Under Group type, make sure Security is selected and select OK. Add user accounts to the Managers group.From the left pane, ensure that the Users container is still selected.From the right pane, right-click Managers and select Properties.Select the Members tab.Select Add.In the Enter the object names to select field, enter all the usernames. Use a semicolon to separate each name.Example: Steve Hoffer; Peter Williams; Princess DianaSelect Check Names.Select OK to add the users and close the dialog.Select OK to close the Managers Properties dialog.You can also add individ 6.5.14 Create Global Groups You are the IT Administrator for the CorpNet.local domain. You are in the process of implementing a group strategy for your network. You have decided to create global groups as shadow groups for specific departments in your organization. Each global group will contain all users in the corresponding department. In this lab, your task is to: Create the following global security groups on the CorpDC server in their corresponding OUs:OU CreationLocationNew Group NameAccountingAccountingResearch- DevResearch-DevSalesSales Add all user accounts in the corresponding OUs and sub-OUs as members of the newly created groups. - Correct answer While completing this lab, use the following information: OU CreationLocationNew Group NameAccountingAccountingResearch-DevResearch- DevSalesSales Complete this lab as follows: Access Active Directory Users and Computers on the CorpDC server.From Hyper-V Manager, select CORPSERVER.From the Virtual Machines pane, double-click CorpDC.From Server Manager's menu bar, select Tools > Active Directory Users and Computers.Maximize the window for better viewing.From the left pane, expand CorpNet.local. Create the groups.Right-click the OU where the new group is to be added and select New > Group.In the Group name field, enter the name of the group.Make sure the Global Group scope is selected.Make sure the Security Group type is selected.Click OK. Add users to groups.In the right pane, right-click the user account(s) and select Add to a group. (Use the Ctrl or Shift keys to select and add multiple user accounts to a group at one time.)In the Enter the object names to select field, enter the name of the group.Select Check Names and verify that the object name was found.Click OK to accept the groups added.Click OK to acknowledge the change.If a sub-OU with users exist, double-click on the sub-OU and then repeat step 3. Do this for each sub-group. Repeat steps 2 - 3 for additional groups and users. 6.6.4 Configure Account Password Policies You have been asked to perform administrative tasks for a computer that is not a member of a domain. To increase security and prevent unauthorized access to the computer, you need to configure specific password and account lockout policies. Access the CorpNet.local domain under Group Policy Management.From Server Manager, select Tools > Group Policy Management.Maximize the windows for better viewing.Expand Forest: CorpNet.local > Domains > CorpNet.local. Create a policy to update the built-in Administrator local group.Right-click Default Domain Policy and select Edit.Maximize the windows for better viewing.Under Computer Configuration, expand Preferences > Control Panel Settings.Right-click Local Users and Groups and select New > Local Group.Using the Group name drop-down, select Administrators (built-in).Select Delete all member users to remove all member users.Select Delete all member groups to remove all member groups.Select Add.In the Name field, enter BUILTIN\Administrator and then select OK.Select Add.In the Name field, enter %DOMAINNAME%\Domain Admins and then select OK.Select OK to save the policy. 6.6.7 Secure Default Accounts You work as the IT security administrator for a small corporate network. You are improving office computers' security by renaming and disabling default computer accounts. In this lab, your task is to perform the following on the Office1 computer: Rename the Administrator account Yoda. Disable the Guest account. Verify that Password never expires is not selected for any local users. This forces them to change their passwords regularly. Delete any user accounts with User must change password at next logon selected. This indicates that a user has never logged in. Start Lab - Correct answer Complete this lab as follows: Access the computer's Computer Management tool.Right-click Start and select Computer Management.Under System Tools, expand Local Users and Groups.Select Users. Rename the Administrator account.From the center pane, right-click Administrator and select Rename.Enter Yoda and press Enter. Disable the Guest account.Right-click Guest and select Properties.Select Account is disabled and click OK. Remove Password never expires option if it is selected.Right-click a user and select Properties.Deselect Password never expires (if selected) and then select OK.Repeat step 4 for each user. Delete any unused accounts.Right-click the user that has User must change password at next logon selected and select Delete.Click Yes to confirm deletion of the account. 6.6.8 Enforce User Account Control You are the IT administrator for a small corporate network. The company has a single Active Directory domain named CorpNet.xyz. You need to increase the domain's authentication security. You need to make sure that User Account Control (UAC) settings are consistent throughout the domain and in accordance with industry recommendations. In this lab, your task is to configure the following UAC settings in the Default Domain Policy on CorpDC as follows: User Account ControlSettingAdmin Approval mode for the built-in Administrator accountEnabledAllow UIAccess applications to prompt for elevation without using the secure desktopDisabledBehavior of the elevation prompt for administrators in Admin Approval modePrompt for credentialsBehavior of the elevation prompt for standard usersAutomatically deny elevation requestsDetect application installations and prompt for elevationEnabledOnly elevate UIAccess applications that are installed in secure locationsEnabledOnly elevate executables that are signed and validatedDisabledRun all administrators in Admin Approval modeEnabledSwitch to the secure desktop when prompting for elevationEnabledVirtualize file and registry write failures to per-user locationsEnabled User Account Control policies are set in a GPO linked to the domain. In this scenario, edit the Default Domain Policy and configure settings in the following path:Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. - Correct answer While completing this lab, use the following information when configuring the UAC settings. User Account ControlSettingAdmin Approval mode for the built-in Administrator accountEnabledAllow UIAccess applications to prompt for elevation without using the secure desktopDisabledBehavior of the elevation prompt for administrators in Admin Approval modePrompt for credentialsBehavior of the elevation prompt for standard usersAutomatically deny elevation requestsDetect application installations and prompt for elevationEnabledOnly elevate executables that are signed and 6.7.4 Create a User Account The VP of marketing has told you that Paul Denunzio will join the company as a market analyst in two weeks. You need to create a new user account for him. In this lab, your task is to: Create the pdenunzio user account. Include the full name, Paul Denunzio, as a comment for the user account. Set eye8cereal as the password for the user account. When you're finished, view the /etc/passwd file to verify the creation of the account. Answer the question. - Correct answer Complete this lab as follows: Create the Paul Denunzio account and comment.From the Linux prompt, type useradd - c "Paul Denunzio" pdenunzio and press Enter. Create a password for Paul.Type passwd pdenunzio and press Enter.Type eye8cereal as the password and press Enter.Retype eye8cereal as the password and press Enter. Verify that the account was created.Type cat /etc/passwd and press Enter. Answer the question.In the top right, select Answer Questions.Select the correct answer.Select Score Lab. 6.7.5 Rename a User Account Brenda Cassini (bcassini) was recently married. You need to update her Linux user account to reflect her new last name of Palmer. In this lab, your task is to use the usermod command to: Rename Brenda's user account bpalmer. Change Brenda's comment field to read Brenda Palmer. Change and move Brenda's home directory to /home/bpalmer. When you're finished, view the /etc/passwd file and /home directory to verify the modification. - Correct answer Complete this lab as follows: Rename the bpalmer account and move her home directory.From the Linux prompt, type usermod -l bpalmer bcassini -m -c "Brenda Palmer" -d /home/bpalmer and press Enter. Verify account modification.Type cat /etc/passwd and press Enter.Type ls /home and press Enter to verify that the account was modified. 6.7.6 Delete a User Terry Haslam (thaslam) was dismissed from the organization. His colleagues have harvested the files they need from his home and other directories. Your company security policy states that upon dismissal, users accounts should be removed in their entirety. In this lab, your task is to: Delete the thaslam user account and home directory from the system. When you're finished, view the /etc/passwd file and /home directory to verify the account's removal. - Correct answer Complete this lab as follows: Delete the Terry Haslam account and home directory.At the prompt, type userdel -r thaslam and press Enter. Verify the account's removal.Type cat /etc/passwd and press Enter.Type ls /home and press Enter to verify that the account was removed. 6.7.7 Change Your Password You use a special user account called Administrator to log on to your computer. However, you think someone has learned your password. You are logged on as Administrator. In this lab, your task is to change your password to r8ting4str. The current Administrator account uses 7hevn9jan as the password. - Correct answer Complete this lab as follows: Change your password.At the prompt, type passwd and press Enter.When prompted, enter 7hevn9jan and press Enter. This is the current password.At the New password prompt, enter r8ting4str and press Enter.Retype r8ting4str as the new password and press Enter. 6.7.8 Change a User's Password Salman Chawla (schawla) forgot his password and needs access to the resources on his computer. You are logged on as wadams. The password for the root account is 1worm4b8. Modify the group membership as needed.Type usermod -G eastern_sales_division aespinoza and press Enter.When you assign aespinoza to the eastern_sales_division group using the usermod -G option, the user account is removed from the western_sales_division group. Use cat /etc/group or groups aespinoza to verify aespinoza's group membership. 6.8.4 Add Users to a Group Maggie Brown (mbrown) and Corey Flynn (cflynn) have recently been hired in the human resources department. You have already created their user accounts. In this lab, your task is to: Add the hr group as a secondary group for the mbrown and cflynn user accounts. When you're finished, view the /etc/group file or use the groups command to verify the changes. - Correct answer Complete this lab as follows: Add users to the hr group.At the prompt, type usermod -G hr mbrown and press Enter.Use usermod -G hr cflynn and press Enter. Verify the group membership for the users added to each group.Use groups mbrown and press Enter.Use groups cflynn and press Enter. 6.8.5 Remove a User from a Group Corey Flynn (cflynn) currently belongs to several groups. Due to some recent restructuring, he no longer needs to be a member of the hr group. To preserve existing group membership, use the usermod -G command to list all groups to which the user must belong. Do not include the primary group name in the list of groups. In this lab, your task is to: Remove cflynn from the hr group. Preserve all other group memberships. View the /etc/group file or use the groups command to verify the changes. Start Lab - Correct answer Complete this lab as follows: View a list of all groups to which Cory Flynn belongs.At the prompt, type groups cflynn and press Enter.Notice that cflynn currently belongs to the mgmt1, hr, and it secondary groups. The cflynn group is the user's primary group. Change and verify Cory Flynn's group membership.Type usermod -G mgmt1,it cflynn and press Enter.Type groups cflynn and press Enter.Cory now only belongs to the mgmt1 and it groups. 6.10.6 Configure Kerberos Policy Settings You are the IT security administrator for a small corporate network that has a single Active Directory domain named CorpNet.local. You are working on increasing the authentication security of the domain. In this lab, your task is to configure the Kerberos policy settings in the Default Domain Policy using Group Policy Management with the following settings: Security SettingValueMaximum lifetime for service ticket180 minutesMaximum lifetime for user ticket3 hoursMaximum lifetime for user ticket renewal3 daysMaximum tolerance for computer clock synchronization1 minute Start Lab - Correct answer When completing this lab, use the following Kerberos policy settings: Security SettingValueMaximum lifetime for service ticket180 minutesMaximum lifetime for user ticket3 hoursMaximum lifetime for user ticket renewal3 daysMaximum tolerance for computer clock synchronization1 minute Complete this lab as follows: Access the CorpNet.local Default Domain Policy.From Server Manager, select Tools > Group Policy Management.Maximize the window for better viewing.Expand Forest: CorpNet.local > Domains > CorpNet.local. Edit the Default Domain Policy to configure the Kerberos policy for computer configurations.Right-click Default Domain Policy and then select Edit.Maximize the window for better viewing.Under Computer Configuration, expand Policies > Windows Settings > Security Settings > Account Policies.Select Kerberos Policy.From the right pane, double-click the policy you want to edit.Configure the policy setting and then select OK.Repeat steps 2e - 2f for each policy setting. 7.1.11 Hide Files with OpenStego You are the IT security administrator for a small corporate network. Recently, some of your firm's proprietary data leaked online. You have been asked to use steganography View the files in the C:\Downloads folder.Right-click Start and select Windows PowerShell (Admin).At the prompt, type cd C:\downloads and press Enter to navigate to the directory that contains the files.Type dir and press Enter to view the available files. Confirm that the Release.zip file is unaltered.Type get-filehash Release.zip -a md5 and press Enter to view the MD5 hash.Type get-content release821hash.txt and press Enter to view the known hash contained in the .txt file.Type "new hash" -eq "known hash" and press Enter to determine whether the file hashes match.The new hash is the hash generated by the get-filehash file_name -a md5 command.The known hash is the hash generated by the get-content file_name.txt command.Include the quotation marks and the file extensions with the file names in the commands. Answer the question.In the top right, select Answer Questions.Answer the question.Select Score Lab. 7.4.3 Encrypt Files with EFS At work, you share a computer with other users. You want to secure the contents of the Finances folder so that unauthorized users cannot view its contents. In this lab, your task is to: Encrypt the D:\Finances folder and all of its contents. Add the Susan user account as an authorized user for the D:\Finances\2020report.xls file. - Correct answer Complete this lab as follows: Open the D: drive.From the Windows taskbar, select File Explorer.From the left pane, select This PC.From the right pane, double-click Data (D:). Encrypt the Finances folder.Right-click Finances and then select Properties.Select Advanced.Select Encrypt contents to secure data and then select OK.Select OK to close the properties dialog.Select OK to confirm the attribute changes. Give Susan authorization to modify the 2020report.xls file.Double-click Finances.Right- click 2020report.xls and then select Properties.Select Advanced.Select Details.Select Add.Select Susan and then select OK.Select OK as many times as needed to close all remaining dialogs. 7.4.8 Configure BitLocker with a TPM You work as the IT security administrator for a small corporate network. The employee in Office 1 is working on a very sensitive project. Management is concerned that if the hard drive in the computer were stolen, sensitive information could be compromised. As a result, you have been asked to encrypt the entire System volume. The Office1 computer has a built-in TPM on the motherboard. In this lab, your task is to configure BitLocker drive encryption as follows: From within the computer's BIOS, turn on and activate TPM Security. From Windows, turn on BitLocker for the System (C:) drive. Back up the recovery key to the \\CorpServer\BU-Office1 folder. Encrypt the entire System (C:) drive. Use the new encryption mode. Run the BitLocker system check. - Correct answer Complete this lab as follows: (Optional) Try to enable BitLocker.From the search field on the Windows taskbar, type Control.From Best match, select Control Panel.Select System and Security.From the right pane, select BitLocker Drive Encryption.Under Operating system drive, select Turn on BitLocker.An error message at the bottom of the screen indicates that a TPM security device was not found.Select Cancel. Access the BIOS settings.Right-click the Start menu and then select Shut down or sign out > Restart to reboot your computer.When the TestOut logo appears, press Delete to enter the BIOS. Turn on and activate the TPM.From the left pane, expand and select Security > TPM Security.From the right pane, select TPM Security and then select Apply.Select Activate and then select Apply.Select Exit.Your computer will automatically reboot. Turn BitLocker on.From the search field on the Windows taskbar, type Control.From Best match, select Control Panel.Select System and Security.Select BitLocker Drive Encryption.Under Operating system drive, select Turn on BitLocker. Windows begins the Drive Encryption setup. Back up a BitLocker recovery key.Select Save to a file.In the left pane, expand and select Network > CorpServer > BU-Office1.Select Save.Select Next. Configure BitLocker encryption.Select Encrypt entire drive and then select Next.Make sure that New encryption mode is selected and then select Next.Select Run BitLocker system check and then select Continue.Select Restart now.The computer will reboot, and the encryption process will run automatically.When the encryption process is complete, select Close. In this lab, your task is to: Create a WLAN using the following settings:Name: CorpNet WirelessESSID: CorpNetType: Standard UsageAuthentication: OpenEncryption: WPA2Encryption algorithm: AESPassphrase: @CorpNetWeRSecure! Connect the Exec-Laptop in the Executive office to the new wireless network. - Correct answer Complete this lab as follows: Access the Ruckus zone controller.From the taskbar, open Chrome.In the URL field, enter 192.168.0.6 and press Enter.Maximize the window for easier viewing. Log into the Wireless Controller console.In the Admin field, enter admin (case sensitive).In the Password field, enter password as the password.Select Login. Create a new WLAN.Select the Configure tab.From the left menu, select WLANs.Under WLANs, select Create New.In the New Name field, enter the CorpNet Wireless.In the ESSID field, enter the CorpNet.Under Type, make sure Standard Usage is selected.Under Authentication Options, make sure Open is selected.Under Encryption Options, select WPA2.Under Algorithm, make sure AES is selected.In the Passphrase field, enter @CorpNetWeRSecure!.Select OK. Switch to the Exec-Laptop.Using the navigation tabs at the top of the screen, select Floor 1.Under Executive Office, select Exec-Laptop. Connect to the new CorpNet wireless network.In the notification area, select the wireless network icon to view the available networks.Select CorpNet.Select Connect.Enter @CorpNetWeRSecure! for the security key.Select Next.Select Yes to make the computer discoverable on the network.The CorpNet network now shows as being connected and secured. 8.2.6 Configure Rogue Host Protection You are a network technician for a small corporate network. You want to take advantage of the self-healing features provided by the small enterprise wireless solution you've implemented. You're already logged in as WxAdmin on the Wireless Controller console from ITAdmin. In this lab, your task is to: Configure self-healing on the wireless network.Automatically adjust AP radio power to optimize coverage when interference is present.Set 2.4 GHz and 5 GHz radio channels to use the Background Scanning method to adjust for interference. Configure the background scanning needed for rogue device detection, AP locationing, and self-healing. Background scans should be performed on all radios every 30 seconds. Configure load balancing for all radios by adjusting the threshold to 40 dB. Configure band balancing to allow no more than 30% of clients to use the 2.4 GHz radios. Reduce the power levels to -3 dB for three access points in Building A to reduce RF emanations. Use the wireless survey results in the exhibit to identify the access points.The amount you reduce TX Power by requires a judgment call based on the wir - Correct answer Complete this lab as follows: Configure self-healing.From the top, select the Configure tab.From the left menu, select Services.Under Self-Healing, select Automatically adjust AP radio power to optimize coverage when interference is present.Using the Automatically adjust 2.4GHz channels using drop-down menu, select Background Scanning from the drop-down menu.Using the Automatically adjust 5GHz channels using drop-down menu, select Background Scanning from the drop-down menu.On the right, select Apply. Configure background scanning.Select Run a background scan on 2.4GHz radio.Enter 30 seconds.Select Run a background scan on 5GHz radio.Enter 30 seconds.On the right, select Apply. Configure load balancing.Select Run load balancing on 2.4GHz radio.In the Adjacent radio threshold(dB) field, enter 40.Select Run load balancing on 5GHz radio.In the Adjacent radio threshold(dB) field, enter 40.On the right, select Apply. Configure band balancing.Select Percent of clients on 2.4GHz radio.Enter the 30.On the right, select Apply. Adjust the AP power level.From the left menu, select Access Points.From the top right, select Exhibit to determine which access points to adjust.Select Edit next to the access point to be modified.Under Radio B/G/N(2.4G) next to TX Power, make sure Override Group Config is selected.From the TX Power drop-down list, select -3dB (1/2).Under Radio A/N/AC(5G) next to TX Power, make sure Override Group Config is selected.From the TX Power drop-down list, select -3dB (1/2).Select OK.Repeat steps 5b - 5h for additional access poin 8.3.6 Harden a Wireless Network Configure Intrusion Detection and Prevention as follows:Report all rogue devices regardless of type.Protect the network from rogue access points. Enable Rogue DHCP Server Detection. - Correct answer Complete this lab as follows: Access the Ruckus zone controller.From the taskbar, open Google Chrome.In the URL field, enter 192.168.0.6 and press Enter.Maximize the window for easier viewing. Configure Denial of Service protection.Select the Configure tab.From the left menu, select WIPS.Under Denial of Services(DoS), select Protect my wireless network against excessive wireless requests.Select Temporarily block wireless clients with repeated authentication failures.Enter 120 seconds.On the right, select Apply. Configure Intrusion Detection and Prevention:Under Intrusion Detection and Prevention, select Enable report rogue devices.Select Report all rogue devices.Select Protect the network from malicious rogue access points.On the right, select Apply. Select Enable rogue DHCP server detection and then select Apply. 8.3.9 Configuring a Captive Portal You have been hired by a small hotel to configure how their guests access the internet. You have chosen to use pfSense's captive portal feature. Guests must pass through this portal to access the internet. In this lab, your task is to: Access the pfSense management console:Username: adminPassword: P@ssw0rd (zero) Add a captive portal zone named Guest_WiFiUse the description Zone used for the guest Wi-Fi Using the GuestWi-Fi interface, configure your portal as follows:Allow a maximum of 100 concurrent connections.Disconnect user from the internet if their connection is inactive for 30 minutes.Disconnect user from the internet after two hours regardless of their activity.Limit user's download and upload to 8000 and 2500 Kbit/s, respectively.Force to pass through your portal prior to authentication. Allow the following MAC and IP address to pass through the portal:MAC: 00:00:1B:12:34:56IP: 198.28.1.100/16Give the IP address the description Admin's Laptop - Correct answer Complete this lab as follows: Sign into the pfSense management console.In the Username field, enter admin.In the Password field, enter P@ssw0rd (zero).Select SIGN IN or press Enter. Add a captive portal zone.From the pfSense menu bar, select Services > Captive Portal.Select Add.For Zone name, enter Guest_WiFi.For Zone description, enter Zone used for the guest Wi-Fi.Select Save & Continue. Enable and configure the captive portal.Under Captive Portal Configuration, select Enable.For Interfaces, select GuestWi-Fi.For Maximum concurrent connections, select 100.For Idle timeout, enter 30.For Hard timeout, enter 120.Scroll down and select Per- user bandwidth restriction.For Default download (Kbit/s), enter 8000.For Default upload (Kbit/s), enter 2500.Under Authentication, use the drop-down menu to select None, don't authenticate users.Scroll to the bottom and select Save. Allow a MAC address to pass through the portal.From the Captive Portal page, select the Edit Zone icon (pencil).Under the Services breadcrumb, select MACs.Select Add.Make sure the Action field is set to Pass.For Mac Address, enter 00:00:1B:12:34:56.Select Save. Allow an IP address to pass through the portal.Under the Services breadcrumb, select Allowed IP Addresses.Select Add.For IP Address, enter 198.28.1.100.Use the IP address drop-down menu to select 16. This sets the subnet mask to 255.255.0.0.For the Description field, enter Admin's Laptop.Make sure Direction is set to Both.Select Save. 9.1.6 Create Virtual Machines You have installed Hyper-V on ITAdmin. You're experimenting with creating virtual machines. In this lab, your task is to create two virtual machines named VM1 and VM2. Use the following settings as specified for each machine: VM1: Virtual machine name: VM1 Virtual machine location: D:\HYPERV Generation: Generation 1 Startup memory: 1024 MB (do not use dynamic memory) Networking connection: External Virtual hard disk name: VM1.vhdx Virtual hard disk location: D:\HYPERV\Virtual Hard Disks Virtual hard disk size: 50 GB an operating system later is selected and then select Next.Review your configuration and then select Finish to create the virtual machine.Repeat step 2 to created the second virtual machine. Adjust virtual machine memory for VM2.From the Hyper-V Manager, under Virtual Machines, right-click VM2 and select Settings.From the left pane, select Memory.In the Minimum RAM field, enter 512.In the Maximum RAM field, enter 4096.Select OK. 9.2.6 Create Virtual Switches You have installed Hyper-V on the CorpServer server. You want to use the server to create virtual machines. Prior to creating the virtual machines, you are experimenting with virtual switches. In this lab, your task is to: Create an internal virtual switch named Switch 1. Create a private virtual switch named Switch 2. - Correct answer Complete this lab as follows: Open the Virtual Switch Manager.From Hyper-V Manager, right-click CORPSERVER.Select Virtual Switch Manager. Create an internal switch named Switch 1.Select Create Virtual Switch.In the Name field, enter Switch 1.Under Connection type, select Internal network.Select Apply. Create a private switch named Switch 2.From the left pane, select New virtual network switch.From the right pane, select Private.Select Create Virtual Switch.In the Name field, enter Switch 2.Select OK. 9.8.4 Secure an iPad You work as the IT security administrator for a small corporate network. The receptionist uses an iPad to manage employees' schedules and messages. You need to help her secure the iPad because it contains all of the employees' personal information. In this lab, your task is to: View the current iOS version and then answer the applicable question. Apply the latest software update and then answer the applicable question. Configure Auto-Lock with a five-minute delay. Configure Passcode Lock using a passcode of C@sp3r Require the passcode after five minutes. Configure Data Erase to wipe all data after 10 failed passcode attempts. Require unknown networks to be added manually. Turn off Bluetooth. - Correct answer Complete this lab as follows: Verify the current version of iOS installed on your iPad.Select Settings.From the Settings pane, select General.From the General pane, select About.In the top right, select Answer Questions.Answer Question 1. Leave the question dialog open. Apply the latest software update.From the About pane's heading, select General. This returns you to the General settings.From the General pane, select Software Update.Select Download and Install.Select Agree.Select OK. The software is downloaded.Select Install.The installation automatically starts after 10 seconds.Slide the arrow to the right to unlock the iPad.Answer Question 2 and then minimize the question dialog. Configure Auto-Lock.From the Settings pane, select Display & Brightness.From the right pane, select Auto-Lock and then select 5 minutes. Configure Complex Passcode Lock and Data Erase.From the left menu, select Touch ID & Passcode.From the right pane, select Turn Passcode On.Enter the new passcode of C@sp3rSelect Next.Re-enter
[email protected] Done.Scroll down and then slide Erase Data to ON.Select Enable.Select Require Passcode.Select After 5 minutes. Require unknown networks to be manually added.From the left menu, select Wi-Fi.Slide Ask to Join Networks to OFF. Turn off Bluetooth as follows:From the left pane, select Bluetooth.Slide Bluetooth to OFF.In the top right, select Answer Questions.Select Score Lab. 9.8.6 Create a Guest Network for BYOD You are a network technician for a small corporate network. You need to enable BYOD Guest Access Services on your network for guests and employees that have mobile phones, tablets, and personal computers. In this lab, your task is to perform the following: Access the Wireless Controller console through Google Chrome on http://192.168.0.6.Username: admin (case sensitive)password: password Set up Guest Access Services using the following parameters:Name: Guest_BYODAuthentication: Use guest pass authenticationThe guest should be Last Score Report - Correct answer Complete this lab as follows: Open the IIS Manager to the CorpNet.xyz site.From the Server Manager's menu bar, select Tools > Internet Information Services (IIS) Manager.Expand CorpWeb(CorpNet.com\Administrator) > Sites.Select CorpNet.xyz. Add a binding to the CorpNet website.From the Actions pane (far right), select Bindings.Select Add.Using the Type drop-down menu, select HTTPS.Make sure the port is set to 443.Using the SSL certificate drop-down menu, select www.CorpNet.xyz and then select OK.Select Close. 10.3.10 Clear the Browser Cache You use Google Chrome as your web browser on the desktop computer in your dorm room. You are concerned about privacy and security while surfing the web. You are also concerned about exploits that harvest data from your Google Chrome browsing history. In this lab, your task is to delete the following items from your Google Chrome browser history for all time: Browsing history Download history Cookies and other site data Cached images and files Hosted app data - Correct answer Complete this lab as follows: Delete all items from your Google Chrome history.From the Windows taskbar, select Google Chrome.In the upper right, select the ellipsis (three dots) and then select History > History.Maximize the window for easier viewing.Select Clear browsing data.Select Advanced.For the Time range field, use the drop-down menu to select All time.Make sure the following items are checked:Browsing historyDownload historyCookies and other site dataCached images and filesHosted app dataSelect Clear data. 10.4.10 Implement Application Whitelisting with AppLocker You are the IT security administrator for a small corporate network. You are increasing network security by implementing application whitelisting. Your first step is to prevent applications not located in the operating system directory or the program files directory from running on your computers. In addition, the call center application used by the support team runs from C:\CallCenter\CallStart.exe and must be allowed to run. You also want any future versions of the call center application to run without changing any settings. In this lab, your task is to configure AppLocker in the default domain policy as follows: Create the default rules.Allow all files located in the Program Files folder.Allow all files located in the Windows folder. Allow the Support group to run the call center software found in C:\CallCenter\ CallStart.exe. Configure a publisher rule to allow future updates from the same vendor. - Correct answer Complete this lab as follows: Access the CorpNet.local domain under Group Policy Management.From Server Manager's menu bar, select Tools > Group Policy Management.Maximize the window for better viewing.Expand Forest: CorpNet.local > Domains > CorpNet.local. Access the AppLocker policy.Right-click Default Domain Policy and select Edit.Maximize the window for better viewing.Under Computer Configuration, expand and select:Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker. Configure rule enforcement.From the right pane, select Configure rule enforcement.Under Executable rules, select Configured.Make sure Enforce rules is selected in the drop-down list.Select OK. Configure a Publisher rule and allow the Support group to run the call center software.From the left pane, expand AppLocker.Right-click Executable Rules and then select Create New Rule.Select Next.Make sure Allow is selected.For User or group, click Select.In the Enter the object names to select box, type Support and then select OK.Select Next.Make sure Publisher is selected; then select Next.For the Reference file, select Browse.Browse to and select the C:\CallCenter\CallStart.exe file.Select Open.Slide the pointer from File version to Publisher and then select Next.Select Next.Accept the default name and select Create.Select Yes to create the default rules.Notice that the Publisher rule was created. 10.4.12 Implement Data Execution Preventions Configure the Sourcefire OpenAppID Detectors to be downloaded.Under Sourcefire OpenAppID Detectors, select Enable OpenAppID.Select Enable RULES OpenAppID. Configure when and how often the rules will be updated.Under Rules Update Settings, use the Update Interval drop-down menu to select 1 Day.For Update Start Time, change to 01:00.Select Hide Deprecated Rules Categories. Configure Snort General Settings.Under General Settings, use the Remove Blocked Hosts Interval drop-down menu to select 1 HOUR.Select Startup/Shutdown Logging.Select Save. Configure the Snort Interface settings for the WAN interface.Under the Services breadcrumb, select Snort Interfaces and then select Add.Under General Settings, make sure Enable interface is selected.For Interface, use the drop-down menu to select WAN (PFSense port 1).For Description, use WANSnort.Under Alert Settings, select Send Alerts to System Log.Select Block Offenders.Scroll to the bottom and select Save. Start Snort on the WAN interface.Under the Snort Status column, select the arrow.Wait for a checkmark to appear, indicating that Snort was started successfully. 11.4.7 Scan for Windows Vulnerabilities You are the IT security administrator for a small corporate network. You are performing vulnerability scans on your network. Mary is the primary administrator for the network and the only person authorized to perform local administrative actions. The company network security policy requires complex passwords for all users. It is also required that Windows Firewall is enabled on all workstations. Sharing personal files is not allowed. In this lab, your task is to: Run a vulnerability scan for the Office2 workstation using the Security Evaluator. A shortcut is located on the taskbar. Remediate the vulnerabilities found in the vulnerability report for Office2. Re-run a vulnerability scan to make sure all of the issues are resolved. - Correct answer Complete this lab as follows. Run a Security Evaluator report.From the taskbar, open Security Evaluator.Next to Target Local Machine, select the Target icon to select a new target.Select Workstation.From the Workstation drop-down list, select Office2 as the target.Select OK.Next to Status, select the Run/Rerun Security Evaluation icon.Review the results to determine which issues you need to resolve on Office2. Access local users using Office2's Computer Management console.From the top navigation tabs, select Floor 1.Under Office 2, select Office2.From Office2, right-click Start and select Computer Management.Expand and select Local Users and Groups > Users. Rename a user account.Right-click Administrator and select Rename.Enter a new name of your choice and press Enter. Disable the Guest account.Right-click Guest and select Properties.Select Account is disabled and then select OK. Set a new password for Mary.Right-click Mary and select Set Password.Select Proceed.Enter a new password of your choice (12 characters or more).Confirm the new password and then select OK.Select OK.Ideally, you should have created a policy that requires passwords with 12 characters or more. Configure Mary's password to expire and to change at next logon.Right-click Mary and select Properties.Clear Password never expires.Select User must change password at next logon and then select OK. Unlock Susan's account and remove her from the Administrators group.Right-click Susan and select Properties.Clear Account is locked out and then select Apply.Select the Member of tab.Select Administrators.Select Remove.Select OK.Close Computer Management. Enable Windows Firewall for all profiles.Right-click Start and then select Settings.Select Network & Internet.From the right pane, scroll down and select Windows Firewall.Under Domain network, select Turn on.Under Private network, select Turn on.Under Public network, select Turn on.Close all open Windows. Remove a file share.From the taskbar, select File Explorer.From the left pane, select This PC.From the right pane, double-click Local Disk (C:).Right-click MyMusic and select Properties.Select the Sharing tab.Select Advanced Sharing.Clear Share this folder.Select OK.Select OK. Use the Security Evaluator feature to verify that all of the issues on the ITAdmin computer were resolved.From the top navigation tabs, select Floor 1.Under IT Administration, select ITAdmin.From Security Evaluator, select the Run/Rerun Security Evaluation icon to rerun the security evaluation.If you still see unresolved issues, select Floor 1, navigate to the Office2 workstation and remediate any remaining issues. 11.4.8 Scan for Linux Vulnerabilities