TẬP ĐOÀN DẦU KHÍ VIỆT NAM
HỘI THI TAY NGHỀ NGÀNH DẦU KHÍ LẦN VI - 2019
NGHỀ
Quản trị hệ thống mạng CNTT
Thời gian: 240 phút
Module B
Vũng Tàu, 2019
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
I. ĐỀ THI
Module B
1. INTRODUCTION TO TEST PROJECT DOCUMENTATION
The competition has a fixed start and finish time. You must decide how to best divide your time.
Please carefully read the following instructions!
When the competition time ends, please leave your station in a running state. The assessment will be done in the
state as it is. No reboot will be initiated as well as powered off machines will not be powered on!
Please do not touch the Hyper_V configuration as well as the configuration of the VM itself except the CD-
ROM / HDD drives
2. CONTENTS
This Test Project consists of the following document/file:
Pef079941.docx (This document)
Excel file for the user import (SA-Users.xlsx)
Websites for install
Manager Website
www.Saigon.net Website
RSAT Tools (WindowsTH-RSAT_WS2016-x64.msu)
Windows 10 ADMX files (Windows_ 10_Creators_Update_ADMX.msi)
Windows Server 2016 ISO
3. DESCRIPTION OF PROJECT AND TASKS
Introduction
You are the IT consultant responsible for Skill04 in Hanoi. There is already an existing domain Hanoi.net. You have
to build and configure the network for the next PVNSkills competition in Ho Chi Minh City, which consists of a new
domain Saigon.net and copy some of the users to this new domain and also implement features for external access
to the network, policies and file services.
This project several components, you need to:
1. Build a new domain (Saigon.net) which will eventually host all the users and computers for the next
competition
2. Maintain connectivity and access to resources between the new domain and the old domain (Hanoi.net)
while the transition is being made
3. Copy some of the users and data from the old domain to the new one
4. Setup a new site-to-site connection
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 2/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Quick Specifications
MODULE B
Part 1 – Saigon.net
In Part 1 you will be responsible for preparing the new domain prior to performing the migration. This will involve
building the Saigon.net domain, including all of the resources that will be necessary for the future migration,
preparing for secure connectivity between the new domain and the old domain - which will involve setting up a VPN
server and a multi-tier PKI infrastruccture.
NOTE: Refer to the diagram on the last page for quick specification reference, as well as the configuration
table.
Please use the default configuration if you are not given the details
All local and domain users on ALL machines should have a password of "P@ssword" unless
otherwise specified. Pre-supplied machines that the competitor needs to logon to will also be pre-
configured with this password.
All supplied software and files needed to complete this project can be found in C:\software on the
competitor computer.
Work Task SA-DC
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 3/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Active Directory
Configure this server as the initial domain controller for Saigon.net
Configure an ONE-WAY (Forest) trust between the domains Saigon.net and Hanoi.net
o Users from Saigon.net must have access to resources from Hanoi.net but not vice versa
DHCP
Configure DHCP for the clients
Mode: Load balancer
Partner Server: SA-FILES
State Switchover: 10 minutes
Range 172.16.0.150-180
Set the appropriate scope options for both DNS servers and default gateway
DNS
Configure DNS for Saigon.net
Create a reverse Zone for the 172.16.0.0/24 network
Add static records for ALL SA-xx servers
GPO
Disable "first sign in Animation" on all Windows 10 Clients
Members of the SA-Users_Experts group must be members of the local admin group on all Windows 10
computers in the domain
www.saigon.net must be the default homepage in IE Explorer and Edge browser
o Install the Windows_10_Creators_Update_ADMX.msi to make Edge group policies available!
Disable Recycle Bin on the Desktop for all domain users except users in "SA-Users_Experts" Group and
domain administrators
Disable changing the screen saver for all domain users except users in "SA-Users_Experts" Group and
domain administrators
Disable changing the background picture for all domain users except users in "SA-Users_Experts" Group
and domain administrators
Redirect (Folder redirection) only for all users in the Expert group "my Documents" and the "Desktop" to
SA-Files -> d:\shares\redirected
share path: \\SA-files.saigon.net\redirected\%username%
Create a fine grained password policy required 7 character non-complex passwords for regular users, 8
characters complex password for members of the SA-Users_Experts group
o Disable “enforce minimum password age”
Users/Groups
Create OUs named "Expert", "Competitor", "Manager" and "Visitor"
Create the following AD groups:
o SA-Users_Experts
o SA-Users_Competitors
o SA-Users_Managers
o SA-Users_Visitors
o SA-Project_Budget-R
o SA-Project_Budget-W
o SA-Project_Intranet-R
o SA-Project_Intranet-W
o SA-Project_Logistics-R
o SA-Project_Logistics-W
o SA-DAClients
NOTE: This is a required list of groups and OUs that have to be created in the domain. If you believe that you
should create additional groups to perform the tasks you can create them.
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 4/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Create the users from the excel sheet SA-Users.xlsx (c:\software) on the competitor machine
o Fill up all fields in the Active Directory user object and add the users to the corresponding SA-Users_xx
groups, SA-Project_xx groups and OUs
Create for every user a home drive in on SA-Files d:\shares\users.
Connect the home drive automatically to drive U: -> \\SA-files.saigon.net\users$\%username%
NOTE: if you are unable to do import all the users from the Excel file create at least the following users manually
Username/Login Password Groups
Test_expert P@ssword SA-Users_Experts; SA-Project_Budget-R
Test_competitor P@ssword SA-Users_Competitors; SA-Project_Intranet-W
Test_manager P@ssword SA-Users_Managers; SA-Project_Logistics-W
Test_visitor P@ssword SA-Users_Visitors
Work Task SA-FILES
This will be the primary file server for the Saigon.net domain, but will also provide redundancy for other network
services, including DHCP and DNS and AD
Install/Configure
Install a Windows Server 2016 (no GUI) from ISO
When creating the VM, build with 4 drives
o 1 System drive (c:\)
o Size 25 GB
o 1 Raid 5 array ( storage Pool )with the remaining three drives (d:\)
Size 10 GB in total
Rename to SA-FILES
Configure the network settings as per configuration table/network diagram
Modify the default Firewall rules to allow ICMP (ping) traffic
Join to Saigon.net domain
Shares
Create shares for departments (Competitors, Experts and Managers)
on SA-FILES -> d:\shares\departments
o \\SA-Files\Experts --> d:\shares\departments\Experts
o \\SA-Files\Competitors --> d:\shares\departments\Competitors
o \\SA-Files\Managers --> d:\shares\departments\Managers
Create a share for projects in SA-FILES -> d:\shares\projects
Create the following folders in d:\shares\projects
o Budget
o Intranet
o Logistics
Set the permissions for these folders according to the table in the appendix
Map the project share (\\SA-files.saigon.net\projects) to P:\ for all users except the Visitor group
Users should see only the folders in P:\ where they have permissions to access them ( Access-based
Enumeration)
Active Directory
Promote this server as a DC for Saigon.net (but not a GC)
DFS
Create a Namespace with the name “dfs”
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 5/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Add SA-DC as the second server for this Namespace
Create DFS links for the department shares (Experts, Competitors, Managers)
Create a DFS Replication to implement a backup of the department shares on SA-DC. The shares should
be replicated/backed up like this:
o SA-Files: D:\shares\departments\Experts SA-DC: C:\backup\Experts
o SA-Files: D:\shares\departments\Competitors SA-DC: C:\backup\Competitors
o SA-Files: D:\shares\departments\Managers SA-DC: C:\backup\Managers
Map the department shares depending on the corresponding group (SA-Users_Experts, SA-
Users_Competitors, SA-Users_Managers) to drive G: using the DFS Namespace
DHCP
Install and configure DHCP
Mode: Load balancer
Partner Server: SA-DC
State Switchover time: 10 minutes
DNS
Host Saigon.net forward and reverse lookup zones
Quota/Screening
Set the quota to every home drives to 5GB
Prevent storing .cmd and .exe files on the home drives. All other file extensions are allowed!
Customized error messages
Make sure that unauthorized users get the following error message, when they want to access one of the
three department shares (Experts, Competitors and Managers) they are not allowed to!
o Expert share:
Error message: “Access only for EXPERTS allowed”
o Competitor share:
Error message: “Access only for COMPETITORS allowed”
o Manager share:
Error message: “Access only for MANAGERS allowed”
IIS
Create a website for the managers (use the provided html file as the default page from C:\software on the
competitor computer)
This website should be accessible via managers.saigon.net
Only users in the in SA-Users_Managers group should have access to the website using "user certificate
based authentication"
Work Task SA-ROOTCA ( SA-DC )
This will be the ROOT Certificate authority for the PKI infrastructure.
Install/Configure
Modify the default Firewall Rules to allow ICMP (ping) traffic
Install AD CS services
standalone Root CA – Use default key length, hash, etc. if not specified
Name: saigon Root CA
Lifetime: 10 years
CRL location: http://SA-SUBCA.saigon.net/certenroll/<caname><crlnamesuffix><deltacrlallowed>.crl
AIA location: http://SA-SUBCA.saigon.net/certenroll/<serverdnsname>_<caname><certificatename>.crt
Create certificate revocation list, and necessary root certificates for SA-SUBCA, and export them to SA-
SUBCA, via share or any other method
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 6/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Approve subordinate Certificate request from SA-SUBCA
Take the server offline when not in use (disable the network interface only)
Work Task SA-SUBCA (SA-FILES)
This will be the online subordinate CA in the PKI infrastructure.
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Join the machine to the saigon.net domain
Install AD CS and Web Enrolment services
Install Enterprise Sub CA
Name: saigon Sub CA
Import and publish CRL for Root CA
Lifetime: 5 years
Configure a template for all clients called "_Skills04_SAClients"
o Set the "subject name format" to Common Name
o Auto enroll this template to all saigon.net Windows 10 Clients
Configure a template for a group of users called "_Skills04_SpecialUsers"
o Set the "subject name format" to Common Name
o Auto enroll this template only to the SA-Users_Managers group
Create the necessary certificates for the two websites on HA-IIS
Work Task SA-CLIENT
This is a Windows 10 client in the Saigon.net domain and can be used for regular user or administration of the
Saigon.net servers and test DirectAccess from the "Internet"
Note: Set the power settings to "never sleep" for all Windows 10 clients
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Join the client to the Saigon.net domain
Install the RSAT tools for server management
Use this client for testing the DirectAccess connection
Use this client for testing the GPO settings
NOTE: for testing the Direct Access connection you have to switch this client to the INTERNET Network
Part 2 – Hanoi.net
In Part 2 you will responsible for making the existing infrastructure available for remote clients, connectivity to the
new domain and maintaining the website information for both
NOTE: Refer to the diagram on the last page for quick specification reference, as well as the configuration
table.
Please use the default configuration if you are not given the details
Local, domain and existing passwords will be "P@ssword"
Work Task HA-DC
This is the existing domain controller for the old domain and hosts all the user and group information
Install/Configure
already preinstalled (domain Hanoi.net, Users, DNS, DHCP)
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 7/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Copy Users to Saigon.net
All user with "Expert" in the "Job Title:" should have duplicate accounts created for them in the Saigon.net
domain (we are not using GPMT – so it is not a migration just a re-creation of the user accounts)
o Copied Users should be placed to OU "Migration" in Saigon.net
o Set the password to "PVNSkills04mig"
o Copy the necessary home folders from HA-DC to SA-FILES d:\shares\migrated
o Set the necessary permissions on these copied folders/shares (only the user itself and domain
administrators should have access to these homefolders)
o Map the home folder to drive S:\ automatically (\\SA-Files\migrated$\%username%)
o Disable the copied users in Hanoi.net and move them to a new OU called MIGRATED on HA-DC
AD
Create the following three users in OU “Users”. They are necessary for the following work tasks.
o RDS_user1
o RDS_user2
Shares
Create a share for the BitLocker recovery keys.
o \\HA-DC\bitlocker --> C:\shares\bitlocker
DNS
DNS records should point to the correct IP addresses for both www.Hanoi.net and www.Saigon.net
DNS records should point to the correct IP address to the RemoteApp website.
Work Task HA-IIS ( HA-DC)
This server hosts your current Hanoi.net website and need to have the content for the Saigon.net added to your
network to provide access to the new Saigon.net domain
IIS
Host www.Hanoi.net website
o Move the default website from wwwroot to c:\inetpub\HA
Host www.Saigon.netwebsite (provided) in c:\inetpub\SA
Both websites should be available by hostname
Both of these sites should use https using certificate approved in Saigon.net
Work Task HA-CLIENT
Note: Set the power settings to "never sleep" for all Windows 10 clients
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Join the client to the Hanoi.net domain
Use this client for all tests in the Hanoi.net domain
BitLocker
Encrypt the system drive using BitLocker
Use the password “P@ssword”
Save the recovery key in the share \\HA-DC\bitlocker\ on HA-DC with the filename “HA-Client_recovery-
key.txt”
Work Task HA-REMOTE
Note: Set the power settings to "never sleep" for all Windows 10 clients
Install/Configure
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 8/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Modify the default Firewall rules to allow ICMP (ping) traffic
DO NOT join this client to any domain
VPN
Configure the VPN client settings for all users on this computer
o Connect the VPN using the public IP of HA-EDGE
o Use IKEv2 protocol with machine certificate authentication
Use this client for testing the "external" access to the websites
o www.saigon.net and www.hanoi.net
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 9/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Work Task HA-EDGE
This is the VPN server that will allow access for external clients to the internal network. It will also create a VPN
tunnel to the Saigon.net domain.
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Join to Hanoi.net domain
Install RRAS service
NAT configuration
Port mapping for external access to HA-IIS websites
o Both Saigon.net and Hanoi.net web content (verify from HA-REMOTE)
VPN
Configure VPN for client access.
Use the IKEv2 protocol and make sure authentication is done by client certificate
Use the IP range 172.19.0.50 – 172.19.0.79
The VPN clients should have access to all internal networks (Hanoi.net and Saigon.net)
Site-to-Site VPN
Configure Site-to-Site VPN to SA-EDGE server
Use machine certificate for the authentication
Set the connection type to “persistent connection”
All traffic bound for Saigon.net will be placed in the VPN tunnel
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 10/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Work Task SA-EDGE
This is the VPN and DirectAccess server that will allow access for external clients to the internal network. It will also
create a VPN tunnel to the old Hanoi.net domain.
Install/Configure
Modify the default Firewall rules to allow ICMP (ping) traffic
Join to Saigon.net domain
Configure Direct Access
Add SA-Client to the AD group "SA-DAClients"
Only members of "SA-DAClients" group can use remote connection
Use SA-FILES server as the only NCA
Generate SSL certificate on the PKI and use it for client connections (no self-signed certs are allowed)
DirectAccess connection name "my W@rkplace"
Use connect.saigon.net for the access from the internet
The DA clients must get full access to the resources of Saigon.net network and Hanoi.net
Site-to-Site VPN
Configure Site-to-Site VPN to the HA-EDGE server
Use machine certificate for the authentication
Set the connection type to “persistent connection”
All traffic bound for Hanoi.net will be placed in the VPN tunnel
Configuration Table
Hostname Operation System Domain IP Address(es) Preinstalled
HA-DC Windows Server 2016 GUI Hanoi.net 172.19.0.1/24 Yes - configured
HA-CLIENT Windows 10 Hanoi.net DHCP Yes - configured
Windows Server 2016 172.19.0.250/24
HA-EDGE no
Hanoi.net Yes - configured
GUI
200.100.50.101/24
Saigon.ne
SA-DC Windows Server 2016 GUI 172.16.0.1/24 Yes - configured
t
Windows Server 2016 Saigon.ne
SA-FILES no
172.16.0.2/24 NO
GUI t
Windows Server 2016 Saigon.ne 172.16.0.250/24
SA-EDGE no
Yes - configured
GUI t 200.100.50.100/24
Saigon.ne
SA-CLIENT Windows 10 DHCP Yes - configured
t
HA-REMOTE Windows 10 None DHCP Yes - configured
Machines indicated as being preinstalled with "Yes – configured" will have the operating system installed and
Hostname and network settings configured.
Shares/Permission Table
Sharenam
Location Read access group Read/Write access group
e
Budget SA-Files -> D:\shares\projects SA-Budget-R SA-Budget-W
Intranet SA-Files -> D:\shares\projects SA-Intranet-R SA-Intranet-W
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 11/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
Logistics SA-Files -> D:\shares\projects SA-Logistics-R SA-Logistics-W
4. INSTSACTIONS TO THE COMPETITOR
Do not bring any materials with you to the competition.
Mobile phones are not to be used.
Do not disclose any competition material / information to any person during each day’s competition.
Read the whole competition script prior to you starting work.
Be aware different tasks attract a percentage of the overall mark. Plan your time carefully.
If your virtual machines spontaneously turned off, run slmgr /rearm command with the administrator
credentials
5. EQUIPMENT, MACHINERY, INSTALLATIONS AND
MATERIALS REQUIRED
Standard/Administration-PC
Intel core i7 processor
16~32GB RAM
250GB SSD-Drive
1x21 inchs LED-Monitors
US Keyboard
Mouse
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 12/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
6. NETWORK DIAGRAM
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 13/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
7. PHYSICAL NETWORK DIAGRAM
Đề thi nghề: Quản trị hệ thống mạng CNTT
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
II. TIÊU CHÍ CHẤM ĐIỂM
Sub Sub Criteria Aspect Aspect - Description Max
Criteria Type Mark
ID Name or Description M = Meas
J = Judg
B1 SA-DC
M Trust Relationship to Hanoi domain 0.40
M Trust relationship functional test 0.40
M DHCP configuration 0.80
M DHCP partnership 0.60
M DNS on both machines all records front and 1.20
back
M Creation of OU's 0.60
M Creation of Groups 0.60
M Creation of Users from spreadsheet 1.60
M SA-Daclients members, from SA-edge, correct 0.60
users in all groups
M Migrated users 1.60
M Migrated user files copied with perms 0.60
M All migrated users there? 0.40
M DFS namespace 0.40
M DFS replication 0.60
B2 SA-Files
M setup as per diagram 0.60
M Check disks, RAID array 0.80
M DC but not GC 0.20
M Check shares - departments 0.80
B3 SA-ROOTCA
M CA setup 1.20
M CA offline 0.20
B4 SA-SUBCA
M CA Setup - enterprise sub ca 0.40
M CA issued by ROOTCA 1.20
M Template and autoenrollment 1.20
M CRL 0.40
B5 SA-CLIENT
M ping all 'round for firewall rules 0.80
M joined domain 0.40
M RSAT tools installed and available 0.20
M disable first sign on GPO 0.40
M managers website v1 0.40
M local admin GPO, import user password 0.80
M gpo expert 0.80
M gpo expert 0.40
M fine-grained passwordv1 0.40
M fine-grained passwordv2 0.80
M GPOs non expert 0.80
M default home page - edge 0.60
M Home folders csv imported users 1.00
M project share map 0.60
M project share perms 0.40
Đề thi nghề: Quản trị hệ thống mạng CNTT Trang 15/16
Trang 15/16
Trang 15/16
Hội thi Tay nghề ngành Dầu khí lần VI - 2019
M Customized error messages 0.80
M managers website v2 0.80
M DFS check 0.40
M visitor user 0.40
M sa-FILES as NCA (connection assistant) server 0.40
M connect.ASC2018.sa as DA name 0.20
M DA testing 1.20
M DA testing 0.80
B6 HA-DC
M find expert users - moved and in migration folder 0.80
M expert users all disabled 0.40
M RDS users 0.40
M DNS - check records for both websites 0.60
B7 AH-IIS
M path of websites 0.60
M path and contents of russia website? 0.60
M certs from th-SUBCA 0.60
B8 HA-RDS
M setup as per diagram 0.60
M rds installed 0.40
B9 HA-Client
M ha-IIS websites 0.60
M saigon website files 0.40
M RDS configuration 1.00
M check rds apps 0.60
M check rds apps 0.20
M bitlocker key + share 0.80
M bitlocker functional test 0.40
B10 HA-Edge
M RRAS installed - configured? 1.20
M NAT-port mapping 0.60
M Site to Site VPN 1.40
M Site to Site VPN 0.80
M s2s functional 0.20
B11 SA-EDGE
M DA Installed 0.20
M connect.ASC2018.sa as DA name 0.80
M VPN tunnel? 1.40
M VPN authentication 0.40
B12 HA-REMOTE
M connect to VPN for Hanoi 1.20
M connect to HAnoi websites 0.60
M joined to domain? 0.40
M connect to Hanoi websites 0.60
50.00
Đề thi nghề: Quản trị hệ thống mạng CNTT
