Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. All the servers are on the…

This question tests understanding of Windows Defender Firewall IPsec connection security rule authentication modes - specifically the behavioral difference between 'Require' and 'Request' authentication and how mismatched rules across endpoints affect traffic flow and…

Secure Windows Server on-premises and hybrid infrastructures

Question

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. All the servers are on the same network and have network connectivity.
On Server1, Windows Defender Firewall has a connection security rule that has the following settings:
Rule Type: Server-to-server
Endpoint 1: Any IP address
Endpoint 2: Any IP address
Requirements: Require authentication for inbound connections and request authentication for outbound connections
Authentication Method: Computer (Kerberos V5)
Profile: Domain, Private, Public
Name: Ruel

Server2 has no connection security rules.
On Server3, Windows Defender Firewall has a connection security rule that has the following settings:
Rule Type: Server-to-server
Endpoint 1: Any IP address
Endpoint 2: Any IP address
Requirements: Request authentication for inbound and outbound connections
Authentication Method: Computer (Kerberos V5)
Profile: Domain, Private, Public
Name: Ruel

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Explanation

Approach. The critical distinction is between 'Require' and 'Request' authentication. 'Require' means the connection is blocked entirely if the peer cannot authenticate (no fallback). 'Request' means the rule attempts authentication but gracefully falls back to unauthenticated/cleartext traffic if the peer doesn't support it. Server1 REQUIRES inbound auth - so any server initiating a connection TO Server1 without auth capability (e.g., Server2) will be blocked. Server1 only REQUESTS outbound auth - so Server1 initiating connections to Server2 will succeed but be unauthenticated (cleartext). Server3 only REQUESTS both directions - so connections to/from Server2 succeed but unauthenticated, while connections between Server1 and Server3 are fully authenticated because both sides can negotiate Kerberos V5. Server2, having no rules, neither initiates nor responds to authentication, making it the weakest link - it can receive unauthenticated connections and initiate unauthenticated outbound, but it cannot reach Server1 inbound due to Server1's Require setting.

Concept tested. Windows Defender Firewall connection security rules: the behavioral difference between 'Require authentication' (hard block without auth) vs. 'Request authentication' (soft attempt with unauthenticated fallback), and how asymmetric rule configurations between endpoints determine whether traffic is authenticated, unauthenticated, or blocked entirely - especially in IPsec server-to-server Kerberos V5 scenarios.

Reference. Microsoft Docs: Connection Security Rules - Windows Defender Firewall with Advanced Security (specifically 'Require' vs 'Request' in inbound/outbound authentication settings)

Topics

#Windows Defender Firewall#Connection Security Rules#IPsec#Kerberos Authentication

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice