AZ-801 · Question #160
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains the servers shown in the following table. | Name | Domain joined |…
This question assesses understanding of Windows Defender Firewall with Advanced Security (WFAS) Connection Security Rules, specifically how to configure IPsec to mandate mutual computer authentication using Kerberos V5 within an Active Directory domain.
Question
| Name | Domain joined |
|---|---|
| Server1 | Yes |
| Server2 | Yes |
| Server3 | Yes |
| Rule | Enabled | Profile | Endpoint 1 | Endpoint 2 | Authentication method | Authentication method | Endpoint 1 port | Endpoint 2 port | Protocol |
|---|---|---|---|---|---|---|---|---|---|
| Rule1 | Yes | Domain | Any | Any | Require inbound and outbound | Computer (Kerberos V5) | Any | Any | TCP |
| Rule | Enabled | Profile | Endpoint 1 | Endpoint 2 | Authentication method | Authentication method | Endpoint 1 port | Endpoint 2 port | Protocol |
|---|---|---|---|---|---|---|---|---|---|
| Rule1 | Yes | Domain | Any | Any | Require inbound and outbound | Computer (Kerberos V5) | Any | Any | TCP |
| Name | Group | Profile | Enabled | Action | Program | Local Address | Remote Address | Protocol |
|---|---|---|---|---|---|---|---|---|
| File and Printer Sharing (Echo Request - ICMPv4-In) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | ICMPv4 |
| File and Printer Sharing (Echo Request - ICMPv6-In) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | ICMPv6 |
| File and Printer Sharing (LLMNR-In) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | Local subnet |
| File and Printer Sharing (NB-Datagram-In) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | Any |
| File and Printer Sharing (NB-Session-In) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | Any |
| File and Printer Sharing (RPC) | File and Printer Sharing | Domain | Yes | Allow | System | Any | Any | Any |
| File and Printer Sharing (RPC-EPMAP) | File and Printer Sharing | Domain | Yes | Allow | %System... | Any | Any | TCP |
| File and Printer Sharing (Spooler Service - RPC) | File and Printer Sharing | Domain | Yes | Allow | %System... | Any | Any | TCP |
| File and Printer Sharing (Spooler Service - RPC-EPMAP) | File and Printer Sharing | Domain | Yes | Allow | %System... | Any | Any | TCP |
- Server2 can ping Server1 successfully.
- Server2 can connect to a file share on Server1.
- Server3 can connect to a file share on Server1.
Explanation
This question assesses understanding of Windows Defender Firewall with Advanced Security (WFAS) Connection Security Rules, specifically how to configure IPsec to mandate mutual computer authentication using Kerberos V5 within an Active Directory domain.
Approach. The correct approach involves recognizing that the detailed rule on Server1 establishes a highly secure communication policy. It mandates that all inbound and outbound TCP traffic must be mutually authenticated, meaning both endpoints must prove their identity before communication is allowed. Utilizing Computer (Kerberos V5) authentication makes this ideal for domain-joined servers, as Kerberos leverages Active Directory for robust, centralized authentication of computer accounts, thereby preventing unauthorized or spoofed systems from connecting.
Concept tested. IPsec (Internet Protocol Security) Connection Security Rules, Windows Defender Firewall with Advanced Security (WFAS), Kerberos V5 authentication in an Active Directory domain, and securing network communication.
Topics
Community Discussion
No community discussion yet for this question.