Question 1

After a DNS zone has been secured with DNSSEC, what additional data will be returned to a client as a result of a query?    Information about the organization administering the zone    Digital signatures for the returned records    Information about the server providing the DNS zone    Digital signatures of the administrators of the zone

Accepted Answer

Digital signatures for the returned records

Question 2

What is the function of the RRSIG record?    Used to sign the records    Returned to positively deny that the requested A record exists in the zone    Used to sign the zone    Returned to the client in response to a successful query along with the A record

Accepted Answer

Returned to the client in response to a successful query along with the A record

Question 3

What DNS security feature in Windows Server 2012 R2 can be configured to allow source port randomization for DNS queries?    Randomization factor    Name Resolution Policy Table    Initialization vector    Socket pool

Accepted Answer

Socket pool

Question 4

How are values for DNS Cache Locking expressed?    As a percentage of the TTL remaining    As a percentage of the TTL    As a fixed period of time in days     As a fixed period of time in hours

Accepted Answer

As a percentage of the TTL

Question 5

What is the net effect if recursion is disabled on a DNS server and the DNS server does not have any forwarding or root hints configuration present?    The DNS server will be able to provide answers to queries about internal and external DNS zones    The DNS server will be able to provide only answers to queries about external DNS zones    The DNS server will be able to provide only answers to queries about internal DNS zones    None of the above

Accepted Answer

The DNS server will be able to provide only answers to queries about internal DNS zones

Question 6

Which of the following commands would correctly set the DNS socket pool to a value of 7,000?     dnscmd /Config /SocketPoolSize 7000      dnscmd /Set /SocketPoolSize 7000      dnscmd /GetSocketPoolSize | dnscmd /Set /SocketPoolSize 7000     dnscmd /Configure /PoolSize 7000

Accepted Answer

dnscmd /Config /SocketPoolSize 7000

Question 7

What Windows Server 2012 R2 DNS feature prioritizes DNS responses based on the subnet of the requesting client?    Conditional forwarding     Iterative queries     Recursive queries      Netmask ordering

Accepted Answer

Netmask ordering

Question 8

The main page of your company\'s Intranet portal is accessible by the FQDN home.na.adatum.corp. How would you configure an entry in the GlobalNames zone for this?     Add a single A record with the IP of one of the web servers hosting the portal     Add a single CNAME record pointing to the A record in another zone     Add multiple CNAME records pointing to all the A records in the other zones     Add multiple A records with all the IPs of the web servers hosting the portal

Accepted Answer

Add a single CNAME record pointing to the A record in another zone

Question 9

DNSSEC uses public key infrastructure (PKI) encryption to provide what assurances to DNS clients? (Choose all that apply)     Proof of identity of DNS records      Confidentiality of information      Availability of services      Verified denial of existence

Accepted Answer

Proof of identity of DNS records    Verified denial of existence

Question 10

How can you best go about delegating administrative access to those employees who need to be able to manage DNS?     Add the user\'s Active Directory accounts to the Domain Admins security group     Add the user\'s Active Directory accounts to the Enterprise Admins security group     Add the user\'s Active Directory accounts to a special universal distribution group created for this purpose (e.g., DNS Service Managers) and then add that group to the DNS Admins local group.     Add the user\'s Active Directory accounts to a special global security group created for this purpose (e.g., DNS Service Managers) and then add that group to the DNS Admins local group.

Accepted Answer

Add the user\'s Active Directory accounts to the Domain Admins security group

Question 11

In Window Server 2012 IPAM, what is the highest-level entity within the IP address space?    IP address range    IP address block    IP address container     IP address

Accepted Answer

IP address block

Question 12

Which of the following statements regarding the server requirements for an IPAM server is false?     The server must have a dual-core CPU of at least 2.0 GHz     The server must be running Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2     The server must have at least 4 GB of RAM installed     The server must have at least 80 GB of free disk space available

Accepted Answer

The server must be running Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2

Question 13

Which of the following database types can be used with Windows IPAM? (Choose all that apply)     MySQL     Microsoft SQL     Windows Internal Database     Access

Accepted Answer

Microsoft SQ    Windows Internal Database

Question 14

Which PowerShell cmdlet is the correct one to use to create the IPAM provisioning GPOs?     Set-IpamGpoProvisioning     Initiate-IpamGpoProvisioning     Perform-IpamGpoProvisioning     Invoke-IpamGpoProvisioning

Accepted Answer

Invoke-IpamGpoProvisioning

Question 15

Which of the following categories will you not find in the Monitor and Manage section of the IPAM console?     DNS and DHCP Servers     DHCP Scopes     DNS Zone Records     DNS Zone Monitoring

Accepted Answer

DNS Zone Records

Question 16

Which of the following can be imported into IPAM using the IPAM console?     IP Addresses     IP Address Block     IP Address Ranges     All of the above

Accepted Answer

All of the above

Question 17

In Window Server 2012 IPAM, what is the second-highest-level entity within the IP address space?     IP address range     IP address block     IP address container     IP address

Accepted Answer

IP address range

Question 18

Which of the following advantages are provided to a SQL server when it\'s used with IPAM?    Scalability    More secure    Reporting     Additional disaster recovery

Accepted Answer

Scalability    Additional disaster recovery     Reporting

Question 19

As it pertains to IPAM, what is the name of the process of retrieving a list of all domain controllers, DNS servers, and DHCP servers?     Server discovery      IPAM discovery     Provisioning IPAM     Verifying IPAM access

Accepted Answer

IPAM discovery

Question 20

Members of which IPAM security group have the ability to view information in IPAM and can perform server management tasks?     IPAM MSM Administrators     IPAM ASM Administrators     IPAM IP Audit Administrators     IPAM Administrators

Accepted Answer

IPAM MSM Administrators

Question 21

Which of the following items would not be considered a logical component of Active Directory?     Domains     Organizational Units      Domain Controllers     Trust relationships

Accepted Answer

Domain Controllers

Question 22

In an organization that has three Active Directory forests with a total of six Active Directory domains, how many schemas will exist in the organization?     Three     Six     Nine     Eighteen

Accepted Answer

Three

Question 23

What are the requirements to perform an in-place upgrade of a domain controller to Windows Server 2012 R2? (Choose all that apply)    The domain controller must be running Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 R2    The domain controller must be running Windows Server 2008 or Windows Server 2008 R2    The forest functional level will need to be at Windows Server 2003 or higher    The forest functional level will need to be at Windows Server 2008 or higher

Accepted Answer

The domain controller must be running Windows Server 2008 or Windows Server 2008 R2     The forest functional level will need to be at Windows Server 2008 or higher

Question 24

Which of the following desirable features first became available with the Windows Server 2008 domain functional level?     SYSVOL replication using DFSR instead of NTFRS     Automatic SPN management     Authentication mechanism assurance     UserPassword attribute

Accepted Answer

SYSVOL replication using DFSR instead of NTFRS

Question 25

You want to use the new features of Key Distribution Center (KDC) support for claims, compound authentication, and Kerberos armoring in your domain. What must you do first? (Choose two answers)    Raise the domain functional level to Windows Server 2008 R2    Raise the domain functional level to Windows Server 2012    Install at least one Windows Server 2012 domain controller    Retire all Windows 2000 Server member servers

Accepted Answer

Install at least one Windows Server 2012 domain controller    Raise the domain functional level to Windows Server 2012

Question 26

Which of the following desirable features first became available with the Windows Server 2008 R2 forest functional level?     Active Directory recycle bin     Domain rename     Cross-forest trusts     KCC algorithm improvements

Accepted Answer

Active Directory recycle bin

Question 27

Which of the following accurately represents a User Principal Name?     MYCOjdoe     jdoe@myco     jdoe.myco.corp    jdoe@myco.corp

Accepted Answer

jdoe@myco.corp

Question 28

Your organization currently has three business units (sales, manufacturing, and service) that function mostly independently. What would be the best approach to take when designing a new Active Directory forest environment for your organization? Be sure to consider the current-day environment and the possibility of future change.     Create a multi-domain forest, with one domain per business unit     Create multiple forests, with one forest per business unit, with no trusts     Create multiple organizational units as needed to organize each business unit\'s objects     Create multiple forests, with one forest per business unit, with trusts between each forest root domain

Accepted Answer

Create multiple organizational units as needed to organize each business unit\'s objects

Question 29

Which Active Directory upgrade method presents the lowest overall cost and risk to an organization, assuming that required physical or virtual servers are available and on hand?     In-place upgrade      Add new domain controllers      Migrate to a new domain      None of the above

Accepted Answer

Add new domain controllers

Question 30

Which partition contains definitions of all objects and attributes that can be created in the directory?     Schema partition      Configuration partition      Domain partition      Application partition

Accepted Answer

Schema partition

Question 31

Which of the following attributes are true of the automatically generated trusts created when a domain is added to the forest? (Choose all that apply)    The trust is two-way between the child domain and the root domain    The trust can be configured to be one-way or two-way    The trust can be configured to be incoming or outgoing, or both    The trust is always transitive

Accepted Answer

The trust is always transitive      The trust is two-way between the child domain and the root domain

Question 32

You have just created a one-way incoming trust in your domain for an external domain used by a partner company to allow your domain\'s users to access a resource in the partner\'s domain. What is the next step that will need to be performed to complete the trust?     You will need to create a one-way outgoing trust in the external domain     The partner will need to create a one-way outgoing trust in the external domain     You will need to create a one-way outgoing trust in your domain    The partner will need to create a one-way outgoing trust in your domain

Accepted Answer

The partner will need to create a one-way outgoing trust in the external domain

Question 33

Which of the following commands correctly illustrates how to create a one-way external trust from the adatum.local domain to the contoso.local domain?     netdom trust adatum.local /Domain:contoso.local /add     netdom -addtrust /Local:adatum.local /External:contoso.local     netdom trust -add adatum.local /Domain:contoso.local     netdom -add /trust adatum.local /Domain:contoso.local

Accepted Answer

netdom trust adatum.local /Domain:contoso.local /add

Question 34

Which of the following scenarios would allow the creation of a shortcut trust? (Choose all that apply)     Between a third-level child domain and a second-level child domain in a different domain tree of the same forest     Between two third-level child domains in the same forest     Between two second-level child domains in different forests     Between a third-level child domain and a forest root domain in different forests

Accepted Answer

Between a third-level child domain and a second-level child domain in a different domain tree of the same forest    Between two third-level child domains in the same forest

Question 35

When disabling SID filtering on a forest trust, what netdom switch should be used?     /disenablesidhistory:Yes      /enablesidhistory:No     /quarantine:No     /sidhistory:Disable

Accepted Answer

/enablesidhistory:No

Question 36

In which scenario would you want to disable SID filtering?     There is no trust between all Domain Admins and Enterprise Admins within both trusts     Forests have been renamed     Domains have been authoritatively restored      User accounts have been involved in a domain migration

Accepted Answer

User accounts have been involved in a domain migration

Question 37

What is the disadvantage of configuring selective authentication for a trust?     The inability to definitively control who is accessing what resources     The administrative overhead involved to configure and maintain user access to resources     The SIDs of the foreign security principals will need to be manually obtained     Security groups from the external domain must be used for the foreign security principals

Accepted Answer

The administrative overhead involved to configure and maintain user access to resources

Question 38

Which of the following attributes are true when discussing manually created trusts?     The trust is two-way between the child domain and the root domain     The trust can be configured to be one-way or two-way      The trust can be configured to be incoming or outgoing, or both     The trust is always transitive

Accepted Answer

The trust can be configured to be one-way or two-way     The trust can be configured to be incoming or outgoing, or both

Question 39

Which of the following scenarios represents the best reason for creating a forest trust between two Active Directory forests?     Company A has purchased Company B      Company A wants to use an application developed by Company B     Company B wants to access data on a Company A web server     Company B wants to send email to recipients in Company A

Accepted Answer

Company A has purchased Company B

Question 40

What type of trust allows users of an internal forest to authenticate to and/or gain access to all resources of an external forest?    Realm trusts    Shortcut trusts     Forest trusts    External trusts

Accepted Answer

Forest trusts

Question 41

Your organization has six offices sppread over three cities in North America. At a minimum, how many Active Directory sites should you plan to have?    Six    One    Three    Eighteen

Accepted Answer

Three

Question 42

What management console is used to manage active Directory Sites?    Active Directory Sites & Services    Active Directory Topology Manager    Active Directory Domains & Trusts    Active Directory Sites & subnets

Accepted Answer

Active Directory Sites & Services

Question 43

Define the logical replication path between sites to perform replication, allowing for faster & optimized replication between sites based on configured costs & frequencies?    Replication links, inter-site    Site links, intrasite    Site links, intersite    Connection objects, Intrasite

Accepted Answer

Site links, intersite

Question 44

Why is it generally not recommended to configure bridgehead servers manually?    You might pick a server that is not a domain controller    You could pick a server in the wrong site    You might overload the server if its performance is below other domain controllers    You could disrupt the flow of replication traffic between sites

Accepted Answer

You could disrupt the flow of replication traffic between sites

Question 45

What default value are all site links costs configured with in Active Directory?    1000    100    10    1

Accepted Answer

100

Question 46

What is defined by the replication schedule?    How often replication occurs    when specific directory partitions are replicated    When replication is allowed to occur    Which site links are the preferred paths

Accepted Answer

When replication is allowed to occur

Question 47

When examining the netlogon.log file, what will be your indicator that you have a problem with your active Directory sites or subnets configuration?    A NO_CLIENT_DC entry    A NO_CLIENT_SITE entry    A NO_CLIENT_LINK entry    A NO_CLIENT_SUBNET entry

Accepted Answer

A NO_CLIENT_SITE entry

Question 48

What undesirable side effect may result from having the \"Bridge ALL Site Links\" option disabled?    Replication time & traffic between spokes will increase due to needing to go through the hub location    You will need to manually create site link bridges between spoke sites    Sites will only replicate among themselves directly if you configure this to occur    Replication will not occur other than to the hub site

Accepted Answer

Replication time & traffic between spokes will increase due to needing to go through the hub location

Question 49

Which of the following represents the best reason why you need yo take care when creating site links within your organization?    So you can create connection objects between domain controllers    So you can map the logical layout of the site links to the physical layout of WAN links    So you can ensure all domain controllers within all sites always stay consistent within 5 minutes    So you can optimize replication traffic between sites by using the highest quality, or lowest cost, routes

Accepted Answer

So you can optimize replication traffic between sites by using the highest quality, or lowest cost, routes

Question 50

What Active Directory component is automatically configured to take changes made during intrasite replication and then replicate that to a domain controller in another site?    Bridgehead servers    site links    Intersite Topology Generator    Knowledge Consistency Checker

Accepted Answer

Bridgehead servers

Question 51

Regarding intersite and intrasite replication, which of the following statements is false?    Replication data between sites is compressed    Intrasite replication topology is generated by the knowledge consistency checker (KCC)    Instrasite replication utilizes Remote Call Procedure over Internet Protocol (RPC over IP) connectivity    Replication data within a site is compressed & encrypted

Accepted Answer

Replication data within a site is compressed & encrypted

Question 52

When a user changes his or her password, to what domain controller is the password change notification sent?    A Global Catalog    The Schema master    The Domain Naming master    The PDC Emulator

Accepted Answer

The PDC Emulator

Question 53

Which of the following repadmin commands would cause updates outward to replication partners & trigger replication across the enterprise as a whole?    REPADMIN /SyncAll /APed    REPADMIN /SyncAll /PQ    REPADMIN /SyncAll /AjQ    REPADMIN /SyncAll /APd

Accepted Answer

REPADMIN /SyncAll /APed

Question 54

Why must an RODC be able to connect to at least one Windows Server 2008 or higher domain controller?    To replicate the domain partition    To replicate the global catalog partition    So that the SYSVOL folder can be replicated using Distributed File System Replication DFSR    So that the Password Replication Policy (PRP) applied to the RODC can be configured and enforced

Accepted Answer

To replicate the domain partition    So that the Password Replication Policy (PRP) applied to the RODC can be configured and enforced

Question 55

What requirements must be met in order to perform the configuration of the Filtered Attribute Set?    The Schema Master must be on a domain controller running Windows Server 2008, Windows Server 2012, or Windows Server 2012 R2    You must perform the change at the command line using netdom command    You must perform the change directly on the Schema Master    The Schema Master must be on a domain controller running Windows Server 2012 R2

Accepted Answer

The Schema Master must be on a domain controller running Windows Server 2008, Windows Server 2012, or Windows Server 2012 R2    You must perform the change directly on the Schema Master

Question 56

What is the net result of deleting an RODC & leaving the \"Reset all passwords for user accounts that were cached on this Read-Only Domain Controller\" option selected?    Users will need to have their accounts rejoined to the domain before they can log in the next time    Users will be forced to use their previous password to log in the next time    Users will be forced to request a password to reset before they can log in the next time    Users will be forced to request an account unlock before they can log in the next time

Accepted Answer

Users will be forced to request a password to reset before they can log in the next time

Question 57

On what domain controller should the DFSR SYSVOL migration process be performed from?    Any writable domain controller in the domain    Any global catalog server in the domain    The PDC Emulator of the domain    The Infrastructure Master of the domain

Accepted Answer

The PDC Emulator of the domain

Question 58

Which of the following scenarios best represents an urgent replication-inducing event?    A change in the domain account lockout policies    The creation of a new user account in the domain    The changing of a user account password    Replication performed to correct a replication conflict

Accepted Answer

A change in the domain account lockout policies

Question 59

Which of the following represents the best reason why you might want to prepopulate passwords on an RODC?    To prevent security principals from needing to be added to the \"Allowed RODC Password Replication Group\" security group    To speed up every login for the user at that site    To speed up the initial login for the user at that site    To reduce replication traffic to that site

Accepted Answer

To speed up the initial login for the user at that site

Question 60

Which SYSVOL replication migration state is done entirely using DSFR?    Prepared (State 1)    Redirected (State 2)    Eliminated (State 3)    Start (State 0)

Accepted Answer

Eliminated (State 3)

Question 61

What benefit does Single Sign-On provide for application users?    Prohibits users from being able to register multiple accounts within an application    Prevents users from needing to remember multiple usernames & passwords    Provides for faster account lockout remediation    Provides for faster account lockout remediation

Accepted Answer

Prevents users from needing to remember multiple usernames & passwords

Question 62

In order to utilize AD FS, what is the oldest version of Windows Server that any domain controller can be using?    Windows Server 2003 SP1    Windows Server 2008 SP1    Windows Server 2008 R2    Windows Server 2012    Windows Server 2012 R2

Accepted Answer

Windows Server 2003 SP1

Question 63

What PowerShell cmdlet would you use to list the attribute stores currently configured for AD FS?    List-ADFSAttributeStore    Show-ADFSAttributeStore    Display-ADFSAttributeStore    Get-ADFSAttributeStore

Accepted Answer

Get-ADFSAttributeStore

Question 64

While testing AD FS claims-based authentication with a sample application, you encounter an error due to the self-signed certificate you opted to use. What can you do to eliminate this error?    Add the self-signed certificate to your computer\'s Trusted Root Certification Authorities store    Add the self-signed certificate to the application server\'s trusted Root Certification Authorities store    Issue a valid certificate from your internal CA    Configure AD FS to ignore self-signed certificate errors

Accepted Answer

Issue a valid certificate from your internal CA    Add the self-signed certificate to your computer\'s Trusted Root Certification Authorities store

412 Finals mid-terms – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards