You finish the work you were doing in the morning, and head out to the monthly meeting. During this meeting, the Vice President of Strategic Partner Relations informs the group of some news, "we have decided that we need to implement a new web site that is for our strategic partners only. This site will be used for various purposes, but will primarily be used as a means of information exchange."
"So, is this going to be a private site?" asks Blue.
"Absolutely. We will not want any public users on this website. It's just for the people we identify in our Strategic Partner Program. I need those of you in security to be sure that this site is secure."
"We can take care of that. How many people do you think will be accessing the site?" asks Blue.
"Not too many, perhaps around fifty."
"So, is it correct to assume that you know each of these fifty people?"
"Yes, that is correct."
"OK, well this should not be too hard. Wel get working on this right away."
The meeting ends, and you and Blue chat more about the web site issue.
"Well, we know that only around fifty people are going to access the, and we know who these fifty are. This should not cause too many problems," Blue says.
"I agree. Do you think it will be all right to spend any money outside of the site itself?" you ask.
"Since we are dealing with so few people, that shouldn be a problem. However, we cannot go overboard. Go ahead and write up a plan for this and get it back to me in a day or two."
Based on your knowledge of GlobalCorp, choose the best solution to the web site security issue.}

• A. You decide that you will use digital certificates to secure the web site. You will first install a new private CA that the remote users can connect to and request their certificates. This CA will be protected with a very strong password. Each user will be given a user account to access the CA, also protected with a strong password.
  Next, you install the new private web server. You then connect to the new CA and make a request for a certificate for the web site. Once you receive the certificate, you configure the web site to use the certificate to Require a Secure Channel (SSL). You then select the option to require client certificates, and you enable mapping for each user account.
  Finally, you will call each person and instruct them on the process of connecting to the CA and requesting their certificate, which you will instruct them to store on their local machine. Once they have their certificate, you have them test access to the site, and when successful you move on to the next person.
• B. You decide that you will use freely available PGP certificates to secure access to the website. You will first install a new IIS web server to hose the site. You then configure one user account, with a strong password. You map this account as the only account that has access to the website.
  You then log on locally, as this user account, to the server and create a public\private key pair. From that account you then send an outgoing email to all fifty users with the account private key. You finish the configuration of the website by making changes in the Security properties of the website.
  In the Security properties, you select the Advanced tab. On the Advanced tab, you check the box to map this account to a local digital certificate, and you select the new certificate you just created.
  Next, you contact each remote user and instruct them to open the email from you. You have them store the key they receive in their personal certificate store. To verify the install is correct, you walk them through the process of viewing their certificates in the MMC. Once verified, you have the user connect to the website, and enter the location of their certificate when asked for authentication credentials.
• C. You decide to use strong authentication via biometrics, specifically fingerprint scanning to secure the web site. You will first install a new IIS web server to host the site. You then configure fifty user accounts for the remote users, and assign those accounts very strong passwords.
  You then ship one biometric mouse and software to each remote client. You call each user and walk them through the process of configuration of their equipment. First, you tell them to create a matching user account with the same user name and very strong password as you used on the IIS server. You then have them install the software, which you instruct them to configure so that the biometric will be linked to the user account.
  Once the software is installed, you instruct them to connect the mouse to their system and load the appropriate driver. With the driver installed, you tell them how to load the program and enroll their fingerprint. Once they have their fingerprint enrolled, and it is matched to their user account, you let them know that their side of the configuration is complete, and that you will call them shortly to finish the process.
  You return to the configuration of the IIS server. In the Security properties of the website, you select the Advanced authentication tab. On the Advanced tab, you check the box for mapping user accounts to external biometric devices, and you check the box to allow the remote machine to control the mapping. You finish the configuration by configuring the site to use 128-bit RSA to encrypt the data between the client and the server.
  With the server configuration done, you call the client back and have them log in using their biometric mouse. Once logged in, you instruct them to connect to the website and verify the secure site is running.
• D. You decide to use existing security technology of digital certificates and SSL to secure the site. You first install a new IIS server that will be the host of the web site. You then connect to the GlobalCorp CA for the executive building and request a new certificate for the web site.
  You then configure the web site to Require a Secure Channel (SSL) and install the certificate. One you install the new certificate, you connect from the new server to the CA in each office where one or more of the fifty people that require access works. At that CA, you install the CA certificate, so that the new server will trust the certificates that each CA issues.
  Next, you return to the configuration of the new web site. To make the site more secure, you require client certificates, and enable mappings for each user account. You call each user and ensure that they have a certificate from their own CA, which the new server now trusts. You walk them through the process of connecting to the site, and verify that secure access to them has been granted.
• E. You decide to use digital certificates on smart cards to secure the web site. You will first install a new IIS web server to host the site. You then connect to the CA_SERVER and request a new certificate for the server. The server certificate will be used for authentication, and you have the certificate issued and stored on a portable USB drive.
  You then configure a machine to function as the enrollment machine for smart cards. You are going to manage the smart cards yourself. At the machine that you are going to use for the smart cards, you first configure the system with an enrollment agent certificate from the CA_SERVER, and then you install the driver for the smart card reader.
  Once the driver is installed, you make certificate requests for each of the fifty users. You start with the first user, by logging in to the CA and selecting the option to Request A Certificate For A Smart Card On Behalf Of Another User Using The Smart Card Enrollment Station radio button. You then select the Smartcard User template, and enter the user name. When prompted, you put a blank smart card in the reader and press the Enroll button, followed by entering the default PIN.
  You then test access to the site from a remote machine using the smart card and PIN to be authenticated to the site. Once the test is complete, you write a short howto file and send it along with the smart card, smart card reader, and driver to each of the fifty users. You follow up with each user upon receipt to walk them through the configuration.

You go back through your notes to the day that you recommended that the company get a firewall in place. Purple had been convinced that the ISP protected the network, and that a firewall was too much technology on top of the router. Now that you have been given this responsibility, and since you have configured the router already, you wish to get the firewall in place as quickly as possible.
You meet quickly with the CEO and mention that the network currently has no firewall, a serious problem. You inform the CEO that this must be fixed immediately, and that you have several firewall options. For this one instance, the CEO tells you to build the best solution; the decision is not going to be based on direct cost.
Based on your knowledge of and the information you have from MegaCorp, select the best solution to the organization firewall problem:}

• A. After you run an analysis on the network and the MegaCorp needs, you decide to implement a firewall using Checkpoint NG. The firewall will have three NICs. One NIC is connected to the router, one NIC is connected to the Web and FTP server and one NIC is connected to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you install a new version of Checkpoint NG, selecting the VPN-1 and Firewall-1 components, and complete the installation.
  2.Second, you configure the inbound rules to allow only SYN packets that are destined for ports
  80, 20, and 21 on the Web and FTP server.
  3.Third, you disallow all inbound traffic for the internal network, unless it is in response to an
  outbound request.
  4.Fourth, you configure anti-spoofing rules on the inbound interface and log those connections to a
  log server.
• B. You decide to take advantage of the features of Microsoft ISA Server and Checkpoint NG. You implement two firewalls, each with two network cards. From one Ethernet interface of the router, you connect to a Checkpoint firewall, and from the other Ethernet interface on the router, you connect to a Microsoft ISA firewall.
  The Checkpoint firewall is connected via one NIC to the router, and the other NIC is connected to the Web and FTP Server. The Microsoft ISA Server is connected via one NIC to the router and the other NIC is connected to the LAN switch.
  You perform the following steps and configurations to setup the firewalls:
  1.First, you configure the IP Address on both network cards of both firewalls.
  2.Second, you select the Floodgate-1, SMART Clients, and Policy Server as the only components
  to install and complete the installation of Checkpoint.
  3.Third, you configure the Checkpoint firewall so only Web and FTP traffic are allowed inbound.
  4.Fourth, you select the Cache Mode option during the install of ISA Server and complete the
  installation of Microsoft ISA Server.
  5.Fifth, you allow all outbound traffic through the ISA Server.
  6.Sixth, you allow only inbound traffic through the ISA Server that is in response to outbound
  requests.
• C. After you analyze the network, you have decided that you are going to implement a firewall using Microsoft ISA Server. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one NIC to the Web and FTP server and one NIC to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you format a new hard drive and install a new copy of Windows 2000 Server.
  2.Second, you configure the correct IP Addresses on the four network cards.
  3.Third, you install ISA Server into Firewall only mode, and complete the installation.
  4.Fourth, you configure all inbound traffic to require the SYN flag to be set, all other inbound
  network traffic is denied
  5.Fifth, you configure the network card towards the Web and FTP server will only allow ports 80,
  20, and 21.
  6.Sixth, you configure all outbound traffic to be allowed.
• D. After you analyze the company, you decide to implement a firewall using Microsoft ISA Server. You create a DMZ with the Web and FTP server on the network segment between the router and the new firewall. The firewall will have two NICs, one connected to the router, and one connected to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you install a new version of ISA Server, installed in Firewall mode.
  2.Second, you configure the inbound network card to disallow all network traffic that did not
  originate from inside the network or from the Web and FTP Server.
  3.Third, you configure anti-spoofing rules to prevent spoofing attacks.
  4.Fourth, you configure all outbound traffic to be allowed.
  5.Fifth, you configure inbound traffic with the SYN flag on to be allowed, and to be logged to a
  SYSLOG server inside the network.
• E. After analysis, you decide to implement a firewall using Checkpoint NG. You begin by installing a new machine, with a fresh hard drive, and the loading of NG. The new firewall will have four NICs. You connect the two Ethernet interfaces on the routers to two of the firewall NICs. You connect one firewall NIC to the Web and FTP server and one firewall NIC to the LAN switch.
  You perform the following steps and configurations to setup the firewall:
  1.First, you configure the IP Addresses on all four network cards of the Checkpoint firewall.
  2.Second, you select only the VPN-1 & Firewall-1 components to install and complete the
  installation of Checkpoint.
  3.Third, you configure the only new inbound network traffic to be destined for the WWW and FTP
  services on the Web and FTP server
  4.Fourth, you block all other incoming traffic.
  5.Fifth, you create anti-spoofing rules to block inbound traffic that might be spoofed.
  6.Sixth, you configure all traffic to be allowed in the outbound direction

Blue thanks you for your plan and design and took it into consideration. You are then informed that Orange has gone ahead and made a new plan, which will incorporate some of your suggestions, but is going to build the network a bit differently. In Testbed and in each remote office there will be a single self-sufficient CA hierarchy, one that is designed to directly integrate with the existing network. Orange mentions that the hierarchy is only to go two-levels deep, you are not to make an extensive hierarchy in any location. This means a distinct CA hierarchy in six locations, inclusive of the Testbed headquarters.
Using this information, choose the solution that will provide for the proper rollout of the Certificate Authorities in the network.}

• A. In each location, you recommend the following steps: 1.Harden a system to function as the Root CA 2.Harden a system to function as a Registration Authority 3.Configure a Windows Enterprise Root CA 4.Configure each Enterprise Root CA to trust each other Enterprise Root CA via cross certification 5.Configure a Windows Stand-Alone Subordinate Enrollment Authority to function as the Registration Authority 6.Once the Stand-Alone Subordinate is installed, take the Enterprise Root CA offline 7.Test the CA hierarchy 8.Have the local administrative staff inform and train each user how to connect to the Registration Authority through their browser and request a certificate
• B. In each location, you recommend the following steps: 1.Harden a system to function as the Root CA 2.Harden a system to function as the Registration Authority 3.Configure a Windows Enterprise Root CA 4.Configure each Enterprise Root CA to trust each other Enterprise Root CA via cross certification 5.Configure a Windows Enterprise Registration Authority, as a subordinate to the Enterprise Root CA 6.Once the Subordinate CA is active, take the Enterprise Root CA offline 7.Test the CA hierarchy7.Test the CA hierarchy 8.Have the local administrative staff inform and train each user how to connect to the Registration Authority through their browser and request a certificate
• C. In each location, you recommend the following steps: 1.Harden a system to function as the Root CA 2.Harden a system to function as the Registration Authority 3.Configure CATool on the Root CA 4.Configure CATool on the Registration Authority, as a subordinate to the Root CA 5.Once the Subordinate CA is active, take the Root CA offline 6.Configure users for the CAs 7.Configure each Root CA to trust each other Root CA via cross certification 8.Test the CA hierarchy 9.Have the local administrative staff inform and train each user how to connect to the Registration Authority through their browser and request a certificate
• D. In each location, you recommend the following steps: 1.Harden a system to function as the Root CA 2.Harden a system to function as the Registration Authority 3.Configure a Windows Enterprise Root CA 4.Configure each Enterprise Root CA to trust each other Enterprise Root CA via cross certification 5.Configure a Windows Registration Authority, as a subordinate to the Enterprise Root CA 6.Test the CA hierarchy 7.Have the local administrative staff inform and train each user how to connect to the Registration Authority through their browser and request a certificate
• E. In each location, you recommend the following steps: 1.Harden a system to function as the Root CA 2.Harden a system to function as the Registration Authority 3.Configure CATool on the Root CA 4.Configure CATool on the Registration Authority, as a subordinate to the Root CA 5.Configure users for the CAs 6.Configure each Root CA to trust each other Root CA via cross certification 7.Test the CA hierarchy 8.Have the local administrative staff inform and train each user how to connect to the Registration Authority through their browser and request a certificate

You had been taking a short vacation, and when you come into work on Monday morning, Orange is already at your door, waiting to talk to you.
"We're got a problem," Orange says, "It seems that the password used by our Vice President of Engineering has been compromised. Over the weekend, we found this account had logged into the network 25 times. The Vice President was not even in the office over the weekend."
"Did we get the source of the compromise yet?"
"No, but it won't surprise me if it is our new neighbors at MassiveCorp. I need to you to come up with a realistic plan and bring it to me tomorrow afternoon. This problem must be resolved, and like everything else we do not have unlimited funds so keep that in mind."
Based on this information, choose the best solution to the password local authentication problem in the Executive building.}

• A. Since you are aware of the significance of the password problems, you plan to address the problem using technology. You write up a plan for Orange that includes the following points: 1.You will reconfigure the Testbed.globalcorp.org domain to control the password problem. 2.You will configure AD in this domain so that complex password policies are required. 3.The complex password policies will include:
  a.Password length of at least 8 characters
  b.Passwords must be alphanumeric
  c.Passwords must meet Gold Standard of complexity
  d.Passwords must be changed every 30 days
  e.Passwords cannot be reused
• B. Since you are aware of the significance of the password problems, you plan to address the
  problem using technology. You write
  up a plan for Orange that includes the following points:
  1.For all executives you recommend no longer using passwords, and instead migrating to a token-
  based authentication system.
  2.You will install the RSA SecurID time-based token system.
  3.You will create SecurID user records for each user to match their domain accounts.
  4.You will assign each user record a unique token.
  5.You will hand deliver the tokens to the correct executive.
  6.Users will be allowed to create their own PIN, which will be 4 characters long.
  7.The tokens will replace all passwords for authentication into each user Windows system.
• C. Since you are aware of the significance of the password problems, plan to address the problem
  using technology. You write up a plan for Orange that includes the following points:
  1.For all executives you recommend no longer using passwords, and instead migrating to a
  biometric solution.
  2.You will install retinal scanners at every user desktop in the executive building.You will install
  retinal scanners at every user? desktop in the executive building.2.You will install retinal scanners
  at every user desktop in the executive building.You will install retinal scanners at every user?
  desktop in the executive building.
  3.You will personally enroll each user at each desktop.3.You will personally enroll each user at
  each desktop.
  4.You will instruct each user on the proper positioning and use of the scanner.4.You will instruct
  each user on the proper positioning and use of the scanner.
  5.The biometric system will replace all passwords for authentication into each user Windows
  system.The biometric system will replace all passwords for authentication into each user?
  Windows system.5.The biometric system will replace all passwords for authentication into each
  user Windows system.The biometric system will replace all passwords for authentication into each
  user? Windows system.
• D. Since you are aware of the significance of the password problems, you plan to address the
  problem using technology. You write up a plan for Orange that includes the following points:
  1.For all executives you recommend no longer using passwords, and instead migrating to a token-
  based authentication system.
  2.You will install the RSA SecurID challenge-response token system.
  3.You will create SecurID user records for each user to match their domain accounts.
  4.You will assign each user record a unique token.
  5.You will hand deliver the tokens to the correct executive.
  6.Users will be required to use tokencodes from the One-Time tokencode list. The tokencodes will
  be alphanumeric and will be 4 characters long.
  7.The tokens will replace all passwords for authentication into each user Windows system.
• E. Since you are aware of the significance of the password problems, and since you do not have unlimited funds, you plan to address this problem through education and through awareness. You write up a plan for Orange that includes the following points: 1.All end users are to be trained on the methods of making strong passwords 2.All end users are instructed that they are to change their password at a minimum of every 30 days. 3.The administrative staff is to run password-checking utilities on all passwords every 30 days. 4.All end users are to be trained on the importance of never disclosing their password to any other individual. 5.All end users are to be trained on the importance of never writing down their passwords where they are clearly visible.