nerdexam
CompTIA

SK0-003 · Question #391

An administrator wants to restrict users through VPN from connecting to the network between 12:00 AM and 6:00 AM. The system uses LDAP for authentication back to a domain. Which of the following…

The correct answer is A. Limit logon hours for remotely connected users on the domain controller during the restricted. To restrict VPN users from connecting during specific hours using an LDAP-authenticated system, configuring logon hours on the domain controller for those users is the most effective solution.

Security and disaster recovery

Question

An administrator wants to restrict users through VPN from connecting to the network between 12:00 AM and 6:00 AM. The system uses LDAP for authentication back to a domain. Which of the following solutions would BEST restrict the users?

Options

  • ALimit logon hours for remotely connected users on the domain controller during the restricted
  • BSet up a logon script that checks the local time of users and logs users off if the local time is in
  • CRestrict DHCP addresses, through the DHCP server, to remote users during the restricted
  • DConfigure ACLs on the VPN to restrict users from accessing the VPN during the restricted time

How the community answered

(25 responses)
  • A
    72% (18)
  • B
    4% (1)
  • C
    8% (2)
  • D
    16% (4)

Why each option

To restrict VPN users from connecting during specific hours using an LDAP-authenticated system, configuring logon hours on the domain controller for those users is the most effective solution.

ALimit logon hours for remotely connected users on the domain controller during the restrictedCorrect

Limiting logon hours for users on the domain controller, which uses LDAP for authentication, directly enforces time-based access control. When users attempt to authenticate via VPN outside their permitted logon hours, the domain controller will deny the authentication request, effectively restricting VPN access.

BSet up a logon script that checks the local time of users and logs users off if the local time is in

A logon script runs after a user has successfully logged on and is client-side, making it easy to bypass for a persistent user and ineffective at preventing initial connection.

CRestrict DHCP addresses, through the DHCP server, to remote users during the restricted

Restricting DHCP addresses only controls IP address assignment, not user authentication or connection times, and would not prevent a user from attempting to connect to the VPN.

DConfigure ACLs on the VPN to restrict users from accessing the VPN during the restricted time

While ACLs on a VPN can restrict access based on IP, user groups, or other criteria, they typically do not provide granular time-based restrictions linked to individual user logon hours enforced by LDAP authentication.

Concept tested: Active Directory logon hour restrictions

Source: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups#logon-hours

Topics

#VPN security#user access control#logon hours#domain controller

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SK0-003 Practice