nerdexam
Microsoft

AZ-801 · Question #112

Server1 has the connection security rules shown in the following table: Rule11: Endpoint1=172.16.10.0/24, Endpoint2=172.16.20.50, Authentication mode=Require inbound and outbound, Authentication metho

The correct answer is A. Yes. Server1 can successfully communicate with Server2 because their Windows Defender Firewall with Advanced Security IPsec rules allow for negotiation.

Secure Windows Server on-premises and hybrid infrastructures

Question

Server1 has the connection security rules shown in the following table: Rule11: Endpoint1=172.16.10.0/24, Endpoint2=172.16.20.50, Authentication mode=Require inbound and outbound, Authentication method=Computer (NTLMv2). Rule12: Endpoint1=172.16.10.10, Endpoint2=172.16.0.0/16, Authentication mode=Request inbound and outbound, Authentication method=Computer (Kerberos V5). Server2 has the connection security rules shown in the following table: Rule31: Endpoint1=Any, Endpoint2=Any, Authentication mode=Request inbound and outbound, Authentication method=Computer (Kerberos V5). Rule32: Endpoint1=172.16.30.80, Endpoint2=172.16.10.10, Authentication mode=Require inbound and outbound, Authentication method=Computer (NTLMv2). For the statement: 'Server1 can communicate with Server2 successfully.', select Yes if the statement is true. Otherwise, select No.

Options

  • AYes
  • BNo

How the community answered

(25 responses)
  • A
    80% (20)
  • B
    20% (5)

Why each option

Server1 can successfully communicate with Server2 because their Windows Defender Firewall with Advanced Security IPsec rules allow for negotiation.

AYesCorrect

Server1's rule for Server2 requires NTLMv2 authentication, and while Server2's applicable rule requests Kerberos V5, it does not prohibit NTLMv2. Given Server2 has another rule using NTLMv2, it indicates capability to provide NTLMv2 authentication, allowing the secure IPsec connection to establish.

BNo

Communication would fail only if Server2 explicitly rejected NTLMv2 authentication for traffic from Server1 or strictly required a different method that Server1 couldn't provide.

Concept tested: Windows Defender Firewall-IPsec rule negotiation

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/connection-security-rules

Topics

#IPsec#Connection Security Rules#Windows Firewall#Network Authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice