Please help me understand this answer...

shamrocker98

This is a practice question from MS book:

Fabricam, Inc. has asked you to implement a dial-up remote access policy for its
employees that is based on time and day restrictions. The company has the following
requirements:
*Administrators can access the network 24 hours a day, 7 days a week.
*Managers cannot access the network after 6:00 P.M. and before 8:00 A.M. during
the week. They can, however, access it at any time during the weekend.
*All other employees can access the network only between 8:00 A.M. and 6:00 P.M.
on weekdays.
You create five custom remote access policies based on security groups and time
restrictions:
*Policy A—managers: permit
*Policy B—administrators: permit
*Policy C—weekend: deny
*Policy D—weekday 8:00 A.M. to 6:00 P.M.: permit
*Policy E—weekday 6:00 P.M. to 8:00 A.M.: deny

In which order can you apply the policies to achieve the required results? (Choose all
that apply.)
A. DABCE
B. DBEAC (CORRECT)
C. CABDE
D. DECBA
E. BDEAC (CORRECT)

I couldn't find any information on the reason these are ordered the way they are. Why are those answers correct? How do I determine the order in which those rules are applied?

Thanks in advance for any info!

josh

jasonboche

Try this explanation:
http://channels.lockergnome.com/it/archives/20050321_how_are_remote_access_policies_evaluated.phtml

shamrocker98

Thanks for the response. It doesn't exactly make it any clearer. Maybe I'm looking at it the wrong way. The website you mentioned says

"The three policy elements are evaluated in the following order:

* Conditions
* Permissions
* Profile"

That part I think I understand, but why are the policies in this question arranged in the EXACT sequence of BDEAC or DBEAC?

Thanks again!!

josh

jasonboche

The way I'm reading the question and the possible answers, each of the incorrect answers (A, C, and D) would provide solutions that deny access for an administrator or manager during a time that they should have access. B and E are the only choices that correctly configure the remote access policy based on the requirement access times.

The wording on these policies is presented in such a difficult way that it's easy to get twisted around or lost.

Also...... a paragraph on order importance per MCSE author Alan Carter in the Windows 2000 MCSE study system ISBN: 0-7645-4701-1:

"the remote access server processes remote access policies in the order they're listed in the RRAS console. You might want to change the order in which policies are applied. Typically, admins place the most specific policies at the top of the list, and the most general policies at the bottom of the list. If you don't order policies in this manner, but instead place policies with few conditions at the top of the list, remote users that have specially configured policies won't be assigned these policies because a more general policy will be applied first"

shamrocker98

That info helps a lot more. I'm going to try and wrap my head around this topic for a little while. It is confusing to me why the first two policies are "interchangable" (DBEAC/BDEAC) but the rest are in a certain order. I'll spend some more time on this. Thanks again for all of your help!

Danman32

This is one of those questions that you have to test each answer. Much like a subnet question.