You perform a security audit of a server named DC1. You install the Microsoft Network Monitor 3.0 application on DC1.You plan to capture all the LDAP traffic that comes to and goes from the server between 20:00 and 07:00 the next day and save it to the E:

第1题：

You are the network administrator for Humongous Insurance. The network consists of a single Active Directory domain named humongous.com. The domain contains Windows Server 2003 computers and Windows XP Professional computers. You configure several Group Policy objects （GPOs） to enforce the use of IPSec for certain types of communication between specified computers.   A server named Server2 runs the Telnet service. A GPO is supposed to ensure that all Telnet connections to Server2 are encrypted by using IPSec. However， when you monitor network traffic， you notice that Telnet connections are not being encrypted.You need to view all of the IPSec settings that are applied to Server2 by GPOs. Which tool should you use？（）

• A、the IP Security Policy Management console
• B、the IP Security Monitor console
• C、the Resultant Set of Policy console
• D、Microsoft Baseline Security Analyzer （MBSA）

第2题：

You perform a security audit of a server named CRM1. You want to build a list of all DNS requests that are initiated by the server. You install the Microsoft Network Monitor 3.0 application on CRM1. You capture all local traffic on CRM1 for 24 hours. You save the capture file as data.cap. You find that the size of the file is more than 1 GB. You need to create a file named DNSdata.cap from the existing capture file that contains only DNS-related data. What should you do? （）

• A、Apply the display filter !DNS and save the displayed frames as a DNSdata.cap file.
• B、Apply the capture filter DNS and save the displayed frames as a DNSdata.cap file.
• C、Add a new alias named DNS to the aliases table and save the file as DNSdata.cap.
• D、Run the nmcap.exe /inputcapture data.cap /capture DNS /file DNSdata.cap command.

第3题：

ou perform a security audit of a server named DC1. You install the Microsoft Network Monitor 3.0 application on DC1.You plan to capture all the LDAP traffic that comes to and goes from the server between 20：00 and 07：00 the next day and save it to the E:///data.cap file.You create a scheduled task. You add a new Start a program action to the task. You need to add theapplication name and the application arguments to the new action. What should you do？（）

• A、Add nmcap.exe as the application name. Add the /networks * /capture LDAP /file e：/data.cap /stopwhen /timeafter 11hours line as arguments.
• B、Add netmon.exe as the application name. Add the /networks */capture LDAP /file e：/data.cap /stopwhen /timeafter 11hours line as arguments.
• C、Add nmcap.exe as the application name. Add the /networks * /capture !LDAP /file e：/data.cap /stopwhen /timeafter 11hours line as arguments.
• D、Add nmconfig.exe as the application name. Add the /networks * /capture &LDAP /file e：/data.cap /stopwhen /timeafter 11hours line as arguments.

第4题：

You have a VPN server that runs Windows Server 2003 Service Pack 2 (SP2). You need to monitor the performance of the VPN server for one day. What should you do? （）

• A、From the Performance console, create a trace log.
• B、From the Performance console, create a counter log.
• C、Install Network Monitor Tools. From Network Monitor create a new capture.
• D、Install Network Monitor Tools. From Network Monitor create a new parser file.

第5题：

You are the network administrator for your company. The network consists of a single Active Directory domain. The domain contains Windows Server 2003 computers and Windows XP Professional computers.  You configure a server named Server1 to be a file server. The written company security policy states that you must analyze network traffic that is sent to and from all file servers.You need to capture file-transfer network traffic that is being sent to and from Server1. You install Network Monitor Tools from a Windows Server 2003 product CD-ROM on a server named Server2， which is on the same network segment as Server1.You run Network Monitor on Server2. However， Network Monitor captures only network traffic that is sent to and from Server2. You need to capture all network traffic that is sent to and from Server1.  What should you do？（）

• A、Install the Network Monitor driver on Server1. Run Network Monitor on Server2 to capture network traffic.
• B、Open Network Monitor on Server2 and create a capture filter to enable the capture of all protocols. Run Network Monitor to capture network traffic.
• C、Install Network Monitor Tools on Server1. Run Network Monitor to capture network traffic.
• D、Open Network Monitor on Server2 and increase the capture buffer from 1 MB to 20 MB in size. Run Network Monitor to capture network traffic.

第6题：

You perform a security audit of a server named DC1. You install the Microsoft Network Monitor 3.0 application on DC1. You plan to capture all the LDAP traffic that comes to and goes from the server between 20：00 and 07：00 the next day and save it to the e：/data.cap file. You create a scheduled task. You add a new Start a program action to the task. You need to add the application name and the application arguments to the new action. What should you do？（） 

• A、 Add nmcap.exe as the application name. Add the /networks * /capture LDAP /file e：/data.cap / stopwhen /timeafter 11hours line as arguments
• B、 Add netmon.exe as the application name. Add the /networks */capture LDA /file e：/data.cap /stopwhen / T.imeafter 11hours line as arguments
• C、 Add nmcap.exe as the application name. Add the /networks * /capture !LDAP /file e：/data.cap /stopwhen /timeafter 11hours line as arguments
• D、 Add nmconfig.exe as the application name. Add the /networks */capture &LDAP /file e：/data.cap / stopwhen /timeafter 11hours line as arguments

第7题：

You perform a security audit on a server named Server1. You install the Microsoft Network Monitor 3.0 application on Server1.You find that only some of the captured frames display host mnemonic names in the Source column and the Destination column. All other frames display IP addresses.You need to display mnemonic host names instead of IP addresses for all the frames. What should you do？ （）

• A、Create a new display filter and apply the filter to the capture.
• B、Create a new capture filter and apply the filter to the capture.
• C、Populate the Aliases table and apply the aliases to the capture.
• D、Configure the Network Monitor application to enable the Enable Conversations option. Recapture the data to a new file.

第8题：

Your network consists of an internal network and a perimeter network. On the internal network there is a server named Server1. On the perimeter network there is a server named Server2. All servers run Windows Server 2003 Service Pack 2 （SP2）.  You schedule a task to transfers files from Server1 to Server2 by using FTP.You monitor the network traffic from Server1 to Server2 and notice that the user name and password used for the FTP transfer are sent as plain text. You need to ensure that all FTP traffic between Server1 and Server2 is encrypted.  What should you do？（）

• A、Implement IPSec.
• B、Install a server certificate on Server1.
• C、Install a server certificate on Server2.
• D、Use the Encrypting File System on Server1.

第9题：

Your network contains a DNS server that has a reverse lookup zone for all of your network segments. You have a server named Server1 that runs Windows Server 2003 Service Pack 2 （SP2）. An IP security policy is assigned to Server1. You verify IPSec traffic and see that the current security associations display only by IP address. You need to view the fully qualified domain names for all security associations.  What should you do？（）

• A、From the DNS console， add Server1 as a name server.
• B、From the DNS console， change dynamic updates to Secure only.
• C、From IP Security Monitor on Server1， enable DNS name resolution.
• D、From IP Security Monitor on Server1， create a new taskpad view.

第10题：

You are the network administrator for your company. The network contains 12 Windows Server 2003 computers and 300 Windows XP Professional computers. Three servers named Server4， Server5， and Server6 run a critical business application. When performing performance baselining on these three servers， you notice that Server6 has a larger number of concurrently connected users at any given moment than Server4 or Server5. The additional workload is causing performance problems on Server6. You need to identify which client computers are connecting to Server6.You plan to run Network Monitor on Server6 to capture all packets sent to Server6. The capture task must be configured to meet the following requirements.To reduce the size of the captured data， you want to capture only the packet headers.If a large number of packets are captured， the packets must be retained on the server. Captured packets must not overwrite previously captured packets.   Which two tasks should you perform to configure Network Monitor？（）

• A、Configure the Network Monitor display filters.
• B、Configure the Network Monitor capture filters.
• C、Increase the Network Monitor buffer size setting.
• D、Decrease the Network Monitor buffer size setting.
• E、Increase the Network Monitor frame size setting.
• F、Decrease the Network Monitor frame size setting.