CERTguide 70-214 Study Guide
What is 70-214 all about?
Exam 70-214: Implementing and Administering Security in a Microsoft Windows 2000 Network
When you pass this exam, you achieve Microsoft Certified Professional status. You also earn credit toward the following certifications:
n Elective credit toward Microsoft Certified Systems Administrator (MCSA) on Microsoft Windows 2000 certification
n Elective credit toward Microsoft Certified Systems Engineer (MCSE) on Microsoft Windows 2000 certification
According to Microsoft,
“
Candidates for this exam operate in medium to very large computing environments that use Windows 2000 and Active Directory®. Operating systems on client computers might include Windows NT® Workstation 4.0, Windows 2000 Professional, and Windows XP Professional.
”
What is this security exam all about? Any difference between this exam and the other Microsoft security exams?
This exam is more “technical” and less “business oriented” in terms of security. Also, this exam covers not only Windows 2000 but also NT4.0 and Windows XP.
The characteristics of the Windows 2000 environment we are talking about in this exam are:
n Supported users range from 200 to more than 26,000.
n Physical locations range from five to more than 150.
n Infrastructures include LAN, WAN, and wireless networks.
n Typical network services and applications include file and print, database, messaging, proxy server and firewall, public key infrastructure, remote access, desktop management, and Web hosting.
n Connectivity scenarios include connecting individual offices and users at remote locations to the corporate network and connecting corporate networks to other networks and the Internet.
Let’s review the official testing objectives:
n Implementing, Managing, and Troubleshooting Baseline Security
u Configure security templates.
u Configure registry and file system permissions.
u Configure account policies.
u Configure audit policies.
u Configure user rights assignment.
u Configure security options.
u Configure system services.
u Configure restricted groups.
u Configure event logs.
n Deploy security templates. Deployment methods include using Group Policy and scripting.
u Troubleshoot security template problems. Considerations include Group Policy, upgraded operating systems, and mixed client-computer operating systems.
u Configure additional security based on computer roles. Computer roles include Microsoft SQL Server computer, Microsoft Exchange Server computer, domain controller, Internet Access Service (IAS) server, Internet Information Services (IIS) server, and mobile client computer.
u Configure additional security for client-computer operating systems by using Group Policy.
u Implementing, Managing, and Troubleshooting Service Packs and Hot Fixes
u Determine the current status of service packs and hot fixes. Tools include MBSA and HFNetChk.
u Install service packs and hot fixes. Consideration include slipstreaming and using Remote Installation Services (RIS), custom scripts, and isolated networks.
u Install service packs and hot fixes on new client computers and servers. Considerations include slipstreaming and using RIS, custom scripts, and isolated networks.
n Manage service packs and hot fixes. Considerations include server computers, remote client computers, and the Critical Notification Service. Tools include Microsoft Software Update Service, Windows Critical Notification Service, SMS, and QChain.
u Troubleshoot the deployment of service packs and hot fixes. Typical issues include third-party application compatibility, permissions, and version conflicts.
u Implementing, Managing, and Troubleshooting Secure Communication Channels
u Configure IPSec to secure communication between networks and hosts. Hosts include domain controllers, Internet Web servers, databases, e-mail servers, and client computers.
u Configure IPSec authentication.
u Configure appropriate encryption levels.
u Configure the appropriate IPSec protocol. Protocols include AH and ESP.
u Deploy and manage IPSec certificates. Considerations include renewing certificates.
n Troubleshoot IPSec. Typical issues include IPSec rule configurations, firewall configurations, routers, and authentication.
u Implement security for wireless networks.
u Configure public and private wireless LANs.
u Configure wireless encryption levels. Levels include WEP and 802.1x.
u Configure wireless network connection settings on client computers. Client-computer operating systems include Windows 2000 Professional, Windows XP Professional, and Windows CE 3.0.
n Configure Server Message Block (SMB) signing to support packet authentication and integrity.
u Deploy and manage SSL certificates. Considerations include renewing certificates and obtaining self-issued certificates versus public-issued certificates.
u Obtain public and private certificates.
u Install certificates for SSL.
u Renew certificates.
n Configure SSL to secure communication channels. Communication channels include client computer to Web server, Web server to SQL Server computer, client computer to Active Directory domain controller, and e-mail server to client computer.
u Configuring, Managing, and Troubleshooting Authentication and Remote Access Security
u Configure and troubleshoot authentication.
u Configure authentication protocols to support mixed Windows client-computer environments.
u Configure the interoperability of Kerberos authentication with UNIX computers.
u Configure authentication for extranet scenarios.
u Configure trust relationships.
u Configure authentication for members of non-trusted domain authentication.
n Configure and troubleshoot authentication for Web users. Authentication types include Basic, Integrated Windows, anonymous, digest, and client certificate mapping.
u Configure authentication for secure remote access. Authentication types include PAP, CHAP, MS-CHAP, MS-CHAP v2, EAP-MD5, EAP-TLS, and Multi-factor authentication with smart cards and EAP.
u Configure and troubleshoot virtual private network (VPN) protocols. Considerations include Internet service provider (ISP), client-computer operating system, Network Address Translation (NAT) devices, Routing and Remote Access server, and firewall server.
u Manage client-computer configuration for remote access security. Tools include remote access policy and Connection Manager Administration Kit.
u Implementing and Managing a Public Key Infrastructure (PKI) and Encrypting File System (EFS)
u Install and configure Certificate Authority (CA) hierarchies. Considerations include enterprise, standalone, and third-party.
u Install and configure the root, intermediate, and issuing CA. Considerations include renewals and hierarchy.
u Configure certificate templates. Considerations include LDAP queries, HTTP queries, and third-party CAs.
u Configure the publication of Certificate Revocation Lists (CRLs).
u Configure public key Group Policy.
u Configure certificate renewal and enrollment.
u Deploy certificates to users, computers, and CAs.
n Manage Certificate Authorities (CAs). Considerations include enterprise, stand-alone, and third-party.
u Enroll and renew certificates.
u Revoke certificates.
u Manage and troubleshoot Certificate Revocation Lists (CRLs). Considerations include publishing the CRL.
u Back up and restore the CA.
n Manage client-computer and server certificates. Considerations include SMIME, EFS, exporting, and storage.
u Publish certificates through Active Directory.
u Issue certificates using MMC, Web enrollment, programmatic, or auto enrollment using Windows XP.
u Recover KMS-issued keys.
n Manage and troubleshoot EFS. Considerations include domain members, workgroup members, and client-computer operating systems.
u Monitoring and Responding to Security Incidents
u Configure and manage auditing. Considerations include Windows Events, Internet Information Services (IIS), firewall log files, Netlog, and RAS log files.
u Manage audit log retention.
u Manage distributed audit logs by using EventComb.
n Analyze security events. Considerations include reviewing logs and events.
u Respond to security incidents. Incidents include hackers, viruses, denial-of-service (DoS) attacks, natural disasters, and maintaining chains of evidence.
u Isolate and contain the incident. Considerations include preserving the chain of evidence.
u Implement counter measures.
u Restore services.
You should make yourself completely familiar with the technical side of NT4.0, Windows 2000 and Active Directory before attempting this exam. These items will appear in your exam.
As of the time of this writing the exam does not test anything on the new .NET technology.
Do NOT ignore virus. Virus protection is an important aspect of security!
Your preparation path:
Important resources for preparation:
Security Tools and Checklists
http://www.microsoft.com/technet/treeview/default.htm?url=/technet/security/tools/tools.htm
Best Practices for Enterprise Security
Security How-Tos
http://www.microsoft.com/technet/treeview/default.htm?url=/technet/itsolutions/howto/sechow.htm
Virus Protection Strategies
http://www.microsoft.com/technet/treeview/default.htm?url=/technet/security/virus/default.htm
Supplementary readings:
Security Administrator
http://www.secadministrator.com/
NSA Windows 2000 Security Recommendation Guides
http://nsa2.www.conxion.com/win2k/
SANS Reading Room
http://rr.sans.org/win2000/win2000_list.php
NT Security
Practical resources:
Make Your Windows Servers Secure
Make Your Desktops Secure
Top 20 Security Service Packs and Security Rollup Packs
http://www.microsoft.com/technet/treeview/default.htm?url=/technet/security/tpsrvpck.htm
Microsoft Security Tool Kit: Guides, Updates, and Tools
http://www.microsoft.com/technet/treeview/default.htm?url=/TechNet/security/tools/tools/STKIntro.htm
Reference Books:
Hacking Exposed Windows 2000 -- by Joel Scambray, Stuart McClure; Paperback
Windows 2000 Security -- by Roberta Bragg; Paperback
Windows 2000 Security Handbook -- by Philip Cox, et al; Paperback
Securing Windows NT/2000 Servers for the Internet
by Stefan Norberg, Deborah Russell (Paperback - November 2000)
Microsoft(r) Windows(r) 2000 Security Technical Reference
by Internet Security Systems Inc. (Editor), John Hayday (Hardcover)
Windows NT/2000 Network Security (Circle Series)
by E. Eugene Schultz (Paperback)
Windows NT Security
by Michael McInerney (Paperback)
Microsoft Windows Nt 4.0 Security, Audit, and Control (Microsoft Technical Reference)
by James G. Jumes, et al (Paperback - December 1998)
Windows Xp Professional Security (COMING SOON)
by Chris Weber, Gary Bahadur (Paperback - October 2002)
Microsoft Windows Security Inside Out for Windows XP and Windows 2000 (COMING SOON)
by Ed Bott, Carl Siechert (Paperback)
This study guide is developed by Michael Yu Chak Tin. He can be reached at Michael@examreview.net.