You need to configure the Group Policy for salespeople.
What should you do?
A. Create one Group Policy object (GPO) that uses AppLocker, and link the GPO to the root of the domain. Modify GPO security filtering to allow only the Sales department computers to read and apply the GPO, and then create a WMI filter that applies only to laptop computers and associate the filter with the GPO.
B. Create a domain security group named SalesDevices and add all client devices to this group. Create one Group Policy object (GPO) that has an AppLocker policy rule that applies to SalesDevices and then link the GPO to the root of the domain.
C. Move all shared desktops to a separate organizational unit (OU). Create one Group Policy object (GPO) that has an AppLocker policy rule and then enable loopback policy processing within the GPO.
Link the GPO to the new OU.
D. Create a Group Policy Object (GPO) with an AppLocker policy and then link the GPO to the Computers OU for each location.
Answer: A
Explanation:
Explanation/Reference:
Testlet 1
General Overview
Fabrikam, Inc, is an international pharmaceutical company that has 3,000 employees.
The company has a sales department, a marketing department, a research department, and a human resources department.
Physical Locations
The company has a main office, a sales office, and a manufacturing plant. The main office is located in Montreal. The sales office is located in New York. The manufacturing plant is located in Seattle.
All offices connect to each other by using a WAN link. Each office connects directly to the Internet.
Active Directory
The company has an Active Directory forest named fabrikam.com. The forest contains a single domain. All domain controllers run Windows Server 2008 R2.
Each office contains one DHCP server and two domain controllers. Each office is configured as an Active Directory site. The Seattle site contains three separate subnets. Each subnet has its own DHCP scope. All of the client computers in the research department are located on a subnet named Research in the Seattle site.
All of the sites connect to each other by using the DEFAULTIPSITELINK site link.
System Center 2012
The company has Microsoft System Center 2012 Configuration Manager and Microsoft System Center
2012 Operations Manager deployed. Configuration Manager has a single primary site that contains one site server. All of the site system roles are located in the Montreal site. Operations Manager has a single management server located in the Montreal site.
Applications
An application named App1 is used by different groups in the Seattle site. App1 is composed of a web application and a web service that are hosted on separate virtual machines.
Problem Statements
The company identifies the following network issues:
Network administrators report that it takes a long time to deploy applications to the client computers in
the Seattle and New York sites by using Configuration Manager.
During the last few months, network administrators discovered several DNS cache attacks.
Business Goals
The company wants to minimize hardware and software purchasing costs.
Planned Changes
The company plans to implement the following changes:
Deploy Microsoft System Center 2012 Virtual Machine Manager (VMM) to manage a host group named
HostGroup1 in the Montreal site and a host group named HostGroup2 on one of the subnets in the Seattle site.
Implement a line-of-business application named App2 for use on the Research subnet. App2 will be
installed on a read-only domain controller (RODC).
Deploy all new domain controllers by using domain controller cloning.
Virtualize all new domain controllers.
Implement Microsoft System Center 2012 Endpoint Protection on all client computers.
In the Seattle site, configure a separate Active Directory site for the research department.
Implement a highly available remote access server solution in the New York site.
Upgrade System Center 2012 to System Center 2012 Service Pack 1 (SP1).
Upgrade all member servers to Windows Server 2012.
Technical Requirements
The company identifies the following technical requirements:
Enable reporting on Endpoint Protection form a central point.
Protect the DNS server cache from malicious overwrites.
Ensure that internal DNS clients only accept DNS responses for fabrikam.com from authorized DNS
servers.
Ensure that the client computers request signed data from the DNS servers.
Ensure that remote users can access network resources over a VPN if one of the remote access
servers in the New York site fails.
Provide high-availability for HostGroup1 by using a clustered storage space that supports the failure of
two disks without losing data.
Implement an Active Directory site for the Research subnet. All Active Directory replication to the new
site must occur within the Seattle office only.
Ensure that research users can log on locally to the server that hosts App2 to install drivers and hard
disks, and to manage updates.
Ensure that virtual machines hosted in HostGroup2 receive IP addresses from the DHCP server in the
Seattle site. The IP addresses for the virtual machines will be from a different range than the IP addresses used for physical machines.
Ensure that virtualization administrators can remotely manage all of the Hyper-V hosts by using the
Remote Server Administration Tools (RSAT) on their local computer. Virtualization administrators must be able to move virtual machines by using live migration.
Ensure that the users in the Seattle site can create new instances of App1 by using the Virtual Machine
Manager Self-Service Portal (VMMSSP). Each new instance of App1 will contain two virtual machines.
One of the virtual machines will run the web application. The other virtual machine will run the web service.
Follow the principle of least privilege whenever possible.
Use the minimum amount of administrative effort whenever possible.
