Create a printer preference in the Default Domain Policy that sets a default printer as laser5.nutex.com and designate the policy as Enforced.

Transcription

1 Page 1 of 218 Item: 1 (Ref:Cert ) You are the administrator of the nutex.com domain. Each department has its own Organizational Unit (OU). Click on the Exhibit(s) button to view the Active Directory structure. The following conditions must apply in your network: You want all the users in the Engineering, Finance, and Sales departments to have a custom registry setting for an application You want all users in all departments to have a default printer set to laser5.nutex.com You want all users in the Marketing department to have a path set to "C:\Program Files\KaplanIT Learning" You create the following Group Policies. A GPO named CustReg with a registry preference configured under the User Configuration \Preference \Windows Settings\Registry A GPO named KaplanIT with an environment variable configured under the User Configuration \Preference \Windows Settings \Registry to update the PATH variable to contain C:\Program Files\KaplanIT Learning What else should you configure? (Choose all that apply.) Link CustReg to the nutex.com domain Link CustReg to the Engineering OU and Sales OU Link KaplanIT to the nutex.com domain Link KaplanIT to the Marketing OU Create a printer preference in the Default Domain Policy that sets a default printer as laser5.nutex.com and designate the policy as Enforced. Create a printer preference in the Default Domain Controllers Policy that sets a default printer to laser5.nutex.com and designate the policy as Enforced Configure Block Inheritance on the Marketing OU Link CustReg to the nutex.com domain Link KaplanIT to the Marketing OU Create a printer preference in the Default Domain Policy that sets a default printer as laser5.nutex.com and designate the policy as Enforced. Configure Block Inheritance on the Marketing OU You should do the following:

2 Page 2 of 218 Link CustReg to the nutex.com domain Link KaplanIT to the Marketing OU Create a printer preference in the Default Domain Policy that sets a default printer set to laser5.nutex.com Designate the Default Domain Policy as Enforced Configure Block Inheritance on the Marketing OU A GPO that is applied at the domain level will flow down to the users and computers in all Organizational Units (OUs) in the domain. A GPO will not flow down to an OU in a domain that has a block inheritance setting applied to it, unless the GPO is designated as Enforced. A block inheritance setting blocks any GPO set at a higher level from flowing down to the objects in the OU. In this scenario, a printer preference in the default domain policy that sets a default printer to laser5.nutex.com will apply to all users and computers in the domain because the default domain policy has been designated as Enforced. The default domain policy is linked at the domain level and its settings flows down to the all users and computers in the domain. If you link CustReg to the nutex.com domain, then you must configure Block Inheritance on the Marketing OU. The users in the Engineering, Finance, and Sales departments need custom registry settings for an application. The CustReg GPO has the registry setting configured. Users in the Marketing OU do not need this setting configured. If the Marketing OU has a block inheritance set on it, the settings set in the CustReg GPO would not apply to the computers in the Marketing OU. You should link KaplanIT to the Marketing OU and not link KaplanIT to the nutex.com domain. Only users in the Marketing OU require the PATH environmental variable to be set, as shown in the following exhibit: You should not create a printer preference in the Default Domain Controllers Policy that sets a default printer to laser5.nutex.com. The Default Domain Controllers Policy only applies to the Domain Controllers OU, which contains only domain controllers. You should not link CustReg to the Engineering OU and Sales OU. Users in the Engineering, Finance, and Sales departments all need a custom registry setting for an application. You would also need to link CustReg to the Finance OU for this to be a correct solution. You can apply a GPO at an OU that has a block inheritance setting configured. While a block inheritance setting prevents GPO's applied at a higher level from flowing down, a GPO that is applied at the OU is not affected by the block inheritance. Item: 2 (Ref:Cert )

3 Page 3 of 218 Your corporate network consists of a single Active Directory domain that spans three sites, as shown in the following image: There are no domain controllers in Site1, and you want users in Site1 to log on by using domain controllers only from Site2. Which of the following should you do? Change the cost of the site link between Site1 and Site3 to 50. Change the cost of the site link between Site1 and Site2 to 150. Configure the subnet object that corresponds to the IP address range of the client computers in Site1 to belong to Site2. Move the computer objects for the client computers from Site1 to Site2. Configure the subnet object that corresponds to the IP address range of the client computers in Site1 to belong to Site2. If there are no domain controllers in a site, then the client computers in that site will send user logon requests to the site or sites with the lowest site link cost where domain controllers are available. To ensure that users in Site1 authenticate to domain controllers only from Site2 in this scenario, you can either reduce the cost of the site link between Site1 and Site2 or configure the client computers in Site1 to belong to Site2. You should use Active Directory Sites and Services to reconfigure the subnet object that corresponds to the IP address range of the client computers in Site1 to belong to Site2. You can then delete Site1 altogether because, once you have configured all its computers to belong to Site2, Site1 will be left empty. Only server objects for domain controllers can be explicitly moved between sites; computer objects for member servers and client computers cannot be moved between sites because their site affiliations are determined automatically based on their IP addresses. Computer objects for member servers and client computers do not appear in Active Directory Sites and Services. Item: 3 (Ref:Cert ) You are implementing an Active Directory forest for your company. You install Windows Server 2008 R2 on a computer, name it DC1, and promote it to the first domain controller in a new domain in a new forest. Then, you install Windows Server 2008 R2 on another computer, name it DC2, and promote it to an additional domain controller in the existing domain. Now, you want to create a new domain. You install Windows Server 2008 R2 on a new computer, name it DC3, and start the Active Directory Installation wizard. You specify that DC3 will be a domain controller in a new domain in a new domain tree in the existing forest. You receive an error message that indicates that DC3 cannot be promoted to a domain controller. Your investigation reveals that DC1 has failed due to a hardware problem. The replacement part necessary to bring DC1 back online will be delivered within the next few days. However, you must continue the deployment of Active Directory immediately, and you must promote DC3 to a domain controller in a new domain. Which of the following should you do?

4 Page 4 of 218 Promote DC3 to a domain controller in a new child domain. Join DC3 to the existing domain and then promote it to a domain controller in a new tree-root domain. Promote DC3 to an additional domain controller in the existing domain and then join it to a new tree-root domain. Configure DC2 to hold all operations master roles and then promote DC3 to a new domain controller in a new tree-root domain. Configure DC2 to hold all operations master roles and then promote DC3 to a new domain controller in a new tree-root domain. In an Active Directory forest, certain types of operations can be performed only on the domain controllers that are designated as operations masters for those types of operations. There are five operations master roles. The schema master and domain naming master are forest-wide roles; the PDC emulator, RID master, and infrastructure master are domain-wide roles. There can be only one schema master and one domain naming master in each forest. Each domain-wide role is unique only in each domain. By default, the first domain controller in a new forest hosts all five operations master roles. The first domain controller in any new domain in a forest, by default, holds the three domain-wide roles for that domain. Subsequently, a forest-wide role can be transferred to another domain controller in the forest, and a domain-wide role can be transferred to another domain controller in the domain. In order for a new domain to be created in a forest, the domain naming master must be available in that forest. It appears that you cannot create a new domain in this scenario because DC1, by default, was configured to hold all five operations master roles. In this scenario DC3 cannot be promoted to a domain controller for the new domain because the domain naming master role is not available. To proceed with the creation of a new tree-root domain, as you originally intended, you should force the transfer of at least the domain naming master role to DC2, which currently is the only remaining domain controller in the existing forest. Once you have forced the transfer of, or seized, the domain naming master role to DC2, the original domain naming master, DC1, should never be brought back online. Instead, when it is repaired, you should perform a fresh installation of Windows Server 2008 R2 on that computer and configure it as a different domain controller or as a member server. Therefore, in this scenario, you should seize all of the operations master roles that were held by DC1. In the absence of the domain naming master, you cannot create a new domain, regardless of whether it is a tree-root or a child domain. Any computer that runs the appropriate edition of Windows Server 2008 can be promoted to become a domain controller in an existing forest, regardless of whether it is a stand-alone server or a member server in a domain in that forest. A domain controller in one domain cannot be directly reconfigured as a domain controller in another domain. First, it must be demoted to a member server or a stand-alone server. Only then can it be promoted to a domain controller in a different domain. Item: 4 (Ref:Cert ) You are the network administrator for your company. Your company's network has a single domain. All servers and domain controllers run Windows Server 2008 Enterprise Edition and Windows Server 2008 R2, and all client computers run Windows Vista. You have a public key infrastructure that maintains a subordinate enterprise Certification Authority (CA), which issues certificates on behalf of the root CA. All CAs use Windows Server 2008 R2. Your company uses a proprietary application that tracks customer shipments and orders. You want to ensure that the code in the application has not been tampered with. The AppUsers group monitors the application for flaws. You want to achieve the following: Have a code-signing certificate automatically issued to the AppUsers group. Ensure that the certificate utilizes Suite B cryptography settings. What should you do to achieve the objective? (Drag the steps from the Choices area and place them sequentially in the Correct Order area. It may not be necessary to use all the steps provided.)

5 Page 5 of 218 You should do the following: To create a new certificate template, you can use the Certificate Template snap-in. You can highlight the appropriate certificate template and duplicate the existing template. You should create the duplicate based on an existing template that is closest in function to the target template. Although most settings in the certificate template can be edited after the template is duplicated, you cannot change the subject type, such as Code Signing, Web, or Exchange User. If you use an existing certificate template, such as Code Signing, you will not be able to edit most of the settings.

6 Page 6 of 218 You should create the template using Windows Server 2008 Datacenter or Enterprise edition or any edition of Windows Server 2008 R2 as the minimum CA level. Version 3 certificates are issued by Windows Server 2008 or Windows Server 2008 R2 servers that are Certification Authorities. Version 3 certificates include the Suite B cryptographic settings in their certificates, which include advanced options for encryption, digital signatures, key exchange, and hashing. These types of certificates can only used by Windows Server 2008, Windows Server 2008 R2 Windows 7 clients. In this scenario, all computers are either Windows Server 2008, Windows Server 2008 R2, or Windows 7, and you want to ensure that the certificate utilizes Suite B cryptography settings. You should not create the template based using Windows Server 2003 Enterprise edition as the minimum CA level. Windows Server 2003 servers that are Certification Authorities issue Version 2 certificates. You are able to edit most settings with Version 2 certificates, but they do not utilize Suite B cryptography settings. A Windows Server 2008 Enterprise or Datacenter Edition CA server can issue Version 1, Version 2 and Version 3 certificates, as can all editions of a Windows Server 2008 R2 CA server. A Windows Server 2003 CA can only issue Version 1 and Version 2 certificates. You should assign the AppUsers group the Read, Enroll, and Autoenroll permissions on the template. The Autoenroll permission is needed in addition to the Enroll permission for a user to enroll for a given certificate template.

7 Page 7 of 218 Item: 5 (Ref:Cert ) You are the administrator of the nutex.com domain. You want to make sure that all of the computers in the Accounting Organizational Unit (OU) and Tax OU use a signed application that is file version or higher. The Accounting OU contains Windows 7, Windows Vista Enterprise, and Windows Server 2008 R2 computers. The Tax OU contains Windows 7 Enterprise computers, Windows 7 computers, Windows Server 2008 computers, and Windows Server 2008 R2 computers. Users have been resistant to using the new version of the application. Some of the users in the domain have been connecting to a server that has the version of the application. You create an AppLocker rule in a Group Policy Object that prevents domain users from installing any version below You link it to the GPO to the domain. (Click the Exhibit(s) button to view the GPO.) After a few weeks, you perform an audit of computers in the domain. Version of the application is being used by users on Windows Vista Enterprise computers in the Accounting OU, and all Windows 7 Enterprise computers, Windows Server 2008 R2 computers, and Windows Server 2008 computers in the Tax OU. What should you do? Apply service pack 2 to all Windows Vista Enterprise computers and link the GPO to the Tax OU. Apply service pack 2 to all Windows Vista Enterprise computers and remove the block inheritance on the Tax OU. Upgrade or replace all Windows Vista Enterprise computers with Windows 7 Enterprise. Upgrade or replace all Windows 2008 Server computers with Windows Server 2008 R2. Remove the Block Inheritance setting on the Tax OU. Upgrade or replace all Windows Vista Enterprise computers with Windows 7 Enterprise. Upgrade or replace all Windows 2008 Server computers with Windows Server 2008 R2. Remove the No Override setting on the Tax OU. Upgrade or replace all Windows Vista Enterprise computers with Windows 7 Enterprise. Upgrade or replace all Windows 2008 Server computers with Windows Server 2008 R2. Remove the Block Inheritance setting on the Tax OU.

8 Page 8 of 218 You should do the following: Upgrade or replace all Windows Vista Enterprise computers with Windows 7 Enterprise. Upgrade or replace all Windows 2008 Server computers with Windows Server 2008 R2. Remove the Block Inheritance setting on the Tax OU. To enforce AppLocker rules you created in a GPO, you need to have computers running either Windows Server 2008 R2, Windows 7 Ultimate, or Windows 7 Enterprise. Although you can create AppLocker rules on a computer that is running Windows 7 Professional, AppLocker rules cannot be enforced on computers running Windows 7 Professional. You would have to upgrade or replace all the computers that are not using those operating systems. You would have to upgrade or replace all client computers with Windows 7 Enterprise and all Windows 2008 Server computers with Windows Server 2008 R2. A GPO that is applied at the domain level will flow down to the users and computers in Organizational Units (OUs) in the domain. A GPO will not flow down to an OU in a domain that has a block inheritance setting applied to it. A block inheritance setting blocks any GPO set at a higher level from flowing down to the objects in the OU. If the Tax OU has a block inheritance set on it, the AppLocker rules set in the GPO would not apply to the Windows 2008 R2 computers and Windows 7 computers in the Tax OU. You can apply a GPO at an OU that has a block inheritance setting configured. While a block inheritance setting prevents GPO's applied at a higher level from flowing down, a GPO that is applied at the OU is not affected by the block inheritance. Applying Service Pack 2 will not allow Windows Vista computers to enforce AppLocker rules set in a GPO. You need to have you need to have computers running either Windows Server 2008 R2, Windows 7 Ultimate, or Windows 7 Enterprise. There is not a No Override setting on an OU. The No Override setting was used in legacy versions of Windows Server to apply to a GPO. The No Override setting on a GPO can override the block inheritance setting on an OU. The No Override setting on a GPO has been replaced with the Enforced setting in Windows Item: 6 (Ref:Cert )

9 Page 9 of 218 You are the network administrator for a city government. The city government's network has a single domain with Windows 2000 Server servers, Windows Server 2003 servers, and Windows Server 2008 R2 servers, as shown in the exhibit. Client computers are running either Windows XP or Windows Vista. All domain controllers run either Windows Server 2003 or Windows Server 2008 R2. You want to deploy Active Directory Rights Management System (AD RMS) to secure all documents, spreadsheets and to provide user authentication. You have a limited budget. What must you configure to complete the deployment of AD RMS? Upgrade all client computers to Windows Vista. Install AD RMS on DC1. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all Windows XP computers. Install AD RMS on DC1. Upgrade all client computers to Windows Vista. Install AD RMS on SRV5. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all Windows XP computers. Install AD RMS on SRV5. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all Windows XP computers. Install AD RMS on SRV5. You should ensure that all Windows XP computers have the latest service pack, install the RMS client on all Windows XP computers, and install AD RMS on SRV5 to achieve the objective in this scenario. You can only deploy the AD RMS on a member server in the domain. You can only deploy an AD RMS on a server that runs the Windows Server 2008 or Windows Server 2008 R2 operating systems. You can deploy AD RMS on a domain controller, but not one that is running Windows Server Windows Vista and Windows 7 include the RMS client by default. However, operating systems released before Windows Vista and Windows Server 2008 do not have the RMS client installed. To use AD RMS service on a Windows XP operating system, you can download and install the RMS client from the Microsoft Download Center (Microsoft Windows RMS with Service Pack 2 (SP2)). By using AD RMS, you can protect the documents for AD RMS-enabled applications by providing appropriate user rights and permissions to the documents, such as copy, edit, view, and print. To install AD RMS in Windows Server 2008 R2, perform the following steps: 1. Click Start, click Administrative Tools, and click Server Manager. 2. In the Server Manager window, click Add Roles. 3. Highlight AD RMS and click Next to complete the installation. You should not upgrade all computers to Windows Vista to achieve the objective in this scenario. Upgrading all client computers to Windows Vista will make the AD RMS services available, as Windows Vista has the default RMS client installed on it. However, it cannot be done with minimum administrative effort, and it would add cost. Item: 7 (Ref:Cert ) All of the servers in the nutex.com domain have been upgraded to Windows Server 2008 R2. You have several Online Responders to manage and distribute revocation status information or make the revoked certificates highly available. The Online Responders are in an Online Responder Array.

10 Page 10 of 218 The server named NewYork-OR is designated as the Array controller to resolve synchronization conflicts with other members of the Online Responders Array. You open a new office in the city of Dallas and add an Online Responder named Dallas-OR to the Online Responders Array. You want to backup the Online Responder revocation configuration and the signing keys. You want to ensure the most up-to-date revocation configuration information is backed up. What should you do? Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OCSPSvc\Responder registry hive on Dallas-OR Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OCSPSvc\Responder registry hive on NewYork-OR Run certutil -dump on Dallas-OR Run certutil -dump on NewYork-OR Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OCSPSvc\Responder registry hive on NewYork-OR You should export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OCSPSvc\Responder registry hive on NewYork- OR. The Online Responder Array controller holds the most up-to-date revocation configuration information, resolves synchronization conflicts with other members of the Online Responders Array, applies updated revocation configuration information to all members of the Online Responders Array, and overrides conflicting configuration settings on other Online Responders in an Array. In this scenario, you should choose to export the hive from NewYork-OR instead of exporting it from Dallas-OR. To ensure that you backup the Online Responder signing keys, you should perform a full system state backup of NewYork-OR. You should not run certutil -dump to ensure that the most up-to-date revocation configuration information is backed up. The command dumps configuration information or files of a certification authority (CA). Item: 8 (Ref:Cert ) You are the network administrator for your company's network. You install a certification authority (CA) to distribute certificates to users and computers in your domain. You decide that you want to audit the following events on your CA: Backing up and restoring the CA database Changing the CA configuration Changing the CA security settings Issuing and managing certificate requests After seven days, you review the security log, but you cannot find any events related to the CA. What could you do to solve the problem? Check the application log for auditing events related to the CA. Enable Audit object access in the local security policy on the computer. Enable Audit policy change in a Group Policy Object. Enable Audit system events in a Group Policy Object. Enable Audit object access in the local security policy on the computer. You should enable Audit object access in the local security policy on the computer or via a Group Policy Object that is applied to the computer. Enabling object access auditing in a policy allows you to specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry in the security log when a user successfully accesses an object that has an appropriate SACL specified. Failure audits generate an audit entry in the security log when a user unsuccessfully attempts to access an

11 Page 11 of 218 object that has a SACL specified. You can use the event viewer tool to view the security log. Only administrators and users that have been delegated the right to view the security log may view the security log on a computer. You should not enable Audit policy change in a Group Policy Object. This policy setting determines whether to audit every incidence of a change to user rights assignment policies, Windows Firewall policies, audit policies, or trust policies. This policy will not affect the auditing of a CA. You should not enable Audit system events in a Group Policy Object. This policy setting audits when a user restarts or shuts down their computer, or when an event occurs that affects either computer security or the Security log. This policy will not affect the auditing of a CA. You should not check the application log for auditing events related to the CA. Audited events will display in the security log, not in the application log. Auditing of the CA will not be successful until you enable object access auditing in a local security policy or Group Policy Object. Item: 9 (Ref:Cert ) You are the network administrator for a company that manufactures auto parts. Your company has a single forest with multiple domains. All domain controllers run either Windows Server 2003 or Windows 2000 Server. You want to install a Windows Server 2008 R2 domain controller in a child domain. What three actions will you need to perform? (Choose three.) Ensure that you are a member of the Enterprise Admins, Schema Admins, and Domain Admins groups. Log on to the schema master and run adprep /forestprep. Log on to the domain naming master and run adprep /forestprep. Log on to the PDC emulator in the domain and run adprep /domainprep /gpprep. Log on to the infrastructure master in the domain and run adprep /domainprep /gpprep.

12 Page 12 of 218 Ensure that you are a member of the Enterprise Admins, Schema Admins, and Domain Admins groups. Log on to the schema master and run adprep /forestprep. Log on to the infrastructure master in the domain and run adprep /domainprep /gpprep. To add a Windows Server 2008 R2 domain controller to a forest that has domain controllers running Windows 2000 Server or Windows Server 2003, you must update the Active Directory schema from the domain controller that hosts the schema master role. You should run adprep /forestprep on the schema master. You must be a member of the Enterprise Administrators group and Schema Administrators group to perform this task. You must also prepare the domain that will have the Windows Server 2008 R2 domain controller installed by running adprep /domainprep /gpprep from the domain controller that hosts the infrastructure master in that domain. You will get an error when you run adprep /domainprep /gpprep on Windows 2003 domains, but you can ignore this error. The error occurs because you do not need to use the /gpprep parameter when upgrading a Windows Server 2003 domain, but only when upgrading a Windows 2000 Server domain. You must be a member of the Domain Admins group to perform this task. When you run either the adprep /forestprep or adprep /domainprep command, you should not use the command version included in either the Windows 2000 Server or Windows Server 2003 media. You must use the version of adprep included in the Windows Server 2008 media in the \sources\adprep folder. You should copy the folder from this folder to the an existing Windows Server 2003 or Windows Server 2000 domain controller. You should not run adprep /forestprep from the domain naming master. This command must be run from the domain controller that is the schema master in the forest. You should not run adprep /domainprep /gpprep from the PDC emulator. This command must be run from the infrastructure master of that domain. Item: 10 (Ref:Cert ) You are the senior network administrator for your company, which has a main office in Portland and a branch office in Seattle. The company's network consists of a single Active Directory domain. You install Domain Name System (DNS) on a Windows Server 2008 R2 computer in the main office, named DNS1, which contains the primary zone. You install a new UNIX DNS server in the Seattle branch office. You are in the process of configuring DNS1 for interoperability with the UNIX DNS server. You are required to ensure that DNS1 is able to replicate DNS zones with the UNIX server in the branch office. To achieve this, you want to disable the fast zone transfer method on DNS1 so that DNS1 transfers only one record per packet during zone transfer. What should you do? Configure DNS1 to use Windows Internet Name Service (WINS) resolution. Disable netmask ordering on DNS1. Configure the refresh interval on the Start of Authority (SOA) tab on the DNS1 properties sheet to one hour. Enable Berkeley Internet Name Domain (BIND) secondaries on DNS1. Enable Berkeley Internet Name Domain (BIND) secondaries on DNS1. You should enable Berkeley Internet Name Domain (BIND) secondaries on DNS1. Enabling the BIND secondaries option disables the fast zone transfer method on Windows Server 2008, which enables the server to make successful zone transfers to DNS servers that support BIND versions earlier than version Windows Server 2008 supports two types of zone file replication, namely full zone transfer (AXFR) and incremental zone transfer (IXFR). In AXFR, the entire zone file is replicated. In IXFR, only records that have been modified are replicated. Berkeley Internet Name Domain (BIND) version and earlier DNS server software, such as UNIX DNS and Windows NT 4.0 DNS, only support full zone transfers.

13 Page 13 of 218 There are two types of AXFR: one requires a single record per packet, and the other allows multiple records per packet. Windows Server 2008 DNS service supports both types of zone transfer and uses multiple records per packet by default. Therefore, to configure your Windows Server 2008 DNS server to successfully work and replicate with a UNIX DNS server, you should disable the fast zone transfer method by selecting the BIND secondaries option in the Server options list on the Advanced tab in the properties sheet for DNS1. You should not configure DNS1 to use Windows Internet Name Service (WINS) resolution. Configuring a DNS server to use WINS resolution enables the DNS service to look up names that are not found in the DNS domain namespace by checking the NetBIOS namespace managed by WINS. Configuring DNS1 to use WINS resolution will not disable the fast zone transfer method on DNS1. You should not disable netmask ordering on DNS1. Netmask ordering allows you to use one host name for multiple IP addresses. Disabling netmask ordering will not disable the fast zone transfer method on DNS1. You should not configure the refresh interval on the Start of Authority (SOA) tab on the Properties sheet of DNS1 to one hour. The refresh interval on the Start of Authority (SOA) tab determines how often the secondary server polls the primary server for updates. Configuring the refresh interval will not disable the fast zone transfer method on DNS1. Item: 11 (Ref:Cert ) You are a network administrator for your company. Your corporate network consists of several Active Directory domains in a single forest. All domain controllers in the forest run Windows Server 2008 R2. The domain controller that holds the schema master role must be shut down in order to upgrade its hardware. However, a schema master must always be available because your company uses a lineof-business Active Directory-aware application that routinely makes changes to the Active Directory schema. You must upgrade the hardware as planned while maintaining the continuity of business operations. Which of the following should you do? Connect to another domain controller in the forest root domain and seize the schema master role. Connect to another domain controller in any domain in the forest and seize the schema master role. Connect to another domain controller in any domain in the forest and transfer the schema master role to that domain controller. Connect to the schema master and transfer the schema master role to another domain controller in the forest root domain. Connect to the schema master and transfer the schema master role to another domain controller in any domain in the forest. Connect to another domain controller in any domain in the forest and transfer the schema master role to that domain controller. Changes to the Active Directory schema can be made only on the domain controller that holds the schema master role. There can be only one schema master in a forest. Initially, the first domain controller in the forest becomes the schema master. When more domain controllers are installed in the forest, the schema master role can be transferred to any domain controller in any domain in the forest. To be able to reassign the schema master role, you must be a member of the Schema Admins universal security group or you must be assigned the Allow - Change Schema Master permission for the schema. You can transfer the schema master role by using Active Directory Schema or the Ntdsutil command-line utility. You must connect to the domain controller to which you want to transfer the schema master role. Seizing is another method that can be used to reassign an operations master role; seizing differs from transferring a role in that seizing is possible only when the original operations master is unavailable on the network. Seizing is an extreme measure and should be used only when transferring is no longer possible. You should seize the schema master, domain naming master or the RID master role only if the original operations master will never be brought back online. To seize the schema master role do the following: 1. Open a command prompt and type ntdsutil and hit Enter. 2. At the ntdsutil command prompt, type roles and hit Enter. 3. At the fsmo maintenance command prompt, type connections and hit Enter. 4. At the server connections command prompt, type connect to server DomainController and hit Enter where DomainController is the domain controller to which you want to assign the new operations master role. 5. At the server connections prompt, type quit and hit Enter. 6. At the fsmo maintenance command prompt, type seize schema master and hit Enter.

14 Page 14 of 218 Item: 12 (Ref:Cert ) Your company's network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2, and all client computers run Windows 7. You have a public key infrastructure that has a subordinate enterprise certification authority (CA), which issues certificates on behalf of the root CA. There exists a certificate template that allows users to autoenroll, and a Group Policy object that distributes the certificates to users. All users are able to automatically obtain certificates. You now want routers and other network devices to obtain certificates from the CA. What should you do? Assign the routers and network devices the Autoenroll permission in a certificate template. Change the Publish Delta CRL to 1 hour so that expired certificates for routers and network devices are published in Active Directory. Install the Online Certificate Status Protocol (OCSP) role service for AD CS. Install the Microsoft Simple Certificate Enrollment Protocol (MSCEP) role service for AD CS. Install the Microsoft Simple Certificate Enrollment Protocol (MSCEP) role service for AD CS. You should install the Microsoft Simple Certificate Enrollment Protocol (MSCEP) role service for AD CS. MSCEP, also referred to in some documents as Network Device Enrollment Service (NDES), is the Microsoft implementation of SCEP, which was developed by Cisco Systems Inc. to support the secure, scalable issuance of certificates to network devices by using existing CAs. MSCEP is a communication protocol that allows software running on network devices, such as routers and switches, to enroll for X.509 certificates from a CA. You should not install the Online Certificate Status Protocol (OSCP). OSCP is used by an online responder. Online Responders can be used as an alternative to or an extension of certificate revocation lists (CRLs) to provide certification revocation data to clients. In Windows Server 2008, you can use an Online Responder based on the Online Certificate Status Protocol (OSCP) to manage and distribute revocation status information in cases where the use of standard CRLs is not the best solution. OCSP is a Hypertext Transfer Protocol (HTTP) that allows a relying party to submit a certificate status request to an OCSP responder. When the OSCP responder receives the request, a definitive, digitally signed response indicating the certificate status is returned to the client. Before configuring a CA to support the Online Responder service, you must ensure that the following conditions are met: IIS must be installed on the computer before the Online Responder can be installed. An OCSP Response Signing certificate template must be configured on the CA, and autoenrollment must be used to issue an OCSP Response Signing certificate to the computer on which the Online Responder will be installed. The URL for the Online Responder must be included in the AIA extension of certificates issued by the CA. This URL is used by the Online Responder client to validate certificate status. The OSCP will not help a network device such as a router receive a certificate. You do not have to change the Publish Delta CRL setting or the Publish CRL Interval setting. The Publish Delta CRL setting determines how often changes to the certificate revocation list (CRL) are published. CAs can have frequent certificate revocations and will need to be downloaded often by clients. Clients can download the most current delta CRL, which contains all the changes since the last base CRL was published via the Publish CRL Interval setting, which minimizes the frequent downloads of large CRLs. Clients combine the downloaded delta CRL with the most current base CRL to generate a complete list of revoked certificates. In this scenario, you should have the MSCEP role service installed to issue certificates to network devices. You should not assign the routers and network devices the Autoenroll permission in a certificate template. You can only assign Active Directory objects permissions in a certificate template. A router or network device would not be an Active Directory object. Item: 13 (Ref:Cert ) You are the network administrator for your company's domain. The company has two branch offices with two different Active Directory sites. The default domain policy for the domain is displayed in the exhibit. (Click the Exhibit(s) button.)

15 Page 15 of 218 You want to secure the accounts in your domain. You specifically want to ensure that an account cannot be compromised by a hacker, and that the account would be disabled before the hacker had an opportunity to guess the password. What should you configure? Change the minimum password age to 7 days. Enable store passwords using reverse encryption. Change the account lockout duration to 0. Change the account lockout threshold to 7. Change the account lockout duration to b a You should change the account lockout duration to 0. This setting will lock out an account until the administrator unlocks it. Configuring the account lockout duration setting, along with the account lockout threshold setting and the reset lockout counter setting, can help prevent hackers from guessing the passwords of accounts on the domain. The account lockout threshold setting limits the user's number of attempts to type a correct password. The reset lockout counter sets the length of time that the system remembers the failed attempts. In this scenario, the account lockout threshold setting is set to 4 and the reset lockout counter setting is set to 30 minutes, which means

16 Page 16 of 218 that the user has 4 attempts within 30 minutes to guess the password for the account. If the user has 3 attempts at the password, but comes back more than 30 minutes later, then the user would have another 4 attempts at the password before the password is locked. You should not increase the account lockout duration to 7. This action will lessen security and will only lock the account for 7 minutes if the number of failed password attempts reaches the threshold. You should not change the minimum password age to 7 days. The minimum password age is the time a password must remain valid before a user can change it. If set the minimum password age to 7 days, then the user must wait a week before changing his/her password. This setting will not stop a hacker from guessing a password, or disable the account if the hacker incorrectly types a password. You should not store passwords using reversible encryption. This policy provides support for legacy applications that use protocols that require knowledge of the user's password for authentication purposes. These types of applications can compromise security. You should never store passwords using reversible encryption setting because storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords. The default setting for this policy is disabled. Item: 14 (Ref:Cert ) Your company has a single Active Directory domain with over 700 user accounts and 800 computer accounts. You have a main office and three branch offices. Each office is configured as its own Active Directory site. You will be opening another branch office in a new city. The new branch office will only have a dozen people. You want to add a readonly domain controller (RODC) in the new branch. You only want the accounts used by the people in the new branch office to be cached on the RODC. What must you do? Add the dozen accounts to a Global group and change permissions on the Global group to not replicate passwords. On each of the accounts in the branch office, set Account is sensitive and cannot be delegated. Add the dozen accounts in the branch office to a Password Replication Policy in the allowed list, and add all other accounts in the company to the denied list. Create a GPO that allows the accounts to be cached and apply it to the site that has the new branch office. Add the dozen accounts in the branch office to a Password Replication Policy in the allowed list, and add all other accounts in the company to the denied list. You should add the dozen accounts in the branch office to a Password Replication Policy in the allowed list and add all other accounts in the company to the denied list. The Password Replication Policy determines if an RODC should be allowed to cache a password. The Password Replication Policy lists the accounts that are permitted to be cached, and the accounts that are explicitly denied from being cached. The Password Replication Policy is configured and enforced on a writable domain controller. For example, to prevent the Administrator password from replicating from the main office to the branch office RODC, a Password Replication Policy would need to be implemented on the DC in the main office. This would prevent the password from replicating to the RODC in the branch office. You should not add the dozen accounts to a Global group and change permissions on the Global group to not replicate passwords. There is no property on a Global group or an account to allow the user to cache his/her password on an RODC. You should not configure the Account is sensitive and cannot be delegated setting on each of the accounts in the branch office. This setting allows control over a user account that is designed to be a guest or temporary account. This option can be used if this account cannot be assigned for delegation by another account. This setting will not allow the user to cache his/her password on an RODC. You should not create a GPO that allows the accounts to be cached and apply it to the site that has the new branch office. Although you can link a GPO at the site level in Active Directory, you cannot configure a user account to cache his/her password on an RODC. You can only do this via a Password Replication Policy configured on a writable domain controller. Item: 15 (Ref:Cert ) You are the administrator for the Verigon Corporation. You have an application on each Windows Server 2008 R2 server that requires

17 Page 17 of 218 IPv6. You must ensure that each Windows 7 client computer that uses the application has a link-local address. Which of the following IP addresses is a link-local address? 2000:4321:8765:9ABC:5678:1234:9ABC:1111 FE80::2AA:FF:FE9A:4CA2 0:0:0:0:0:0:0:1 FF02::1:FF78:5678 FE80::2AA:FF:FE9A:4CA2 The IPv6 address FE80::2AA:FF:FE9A:4CA2 is a link-local address. The link-local addresses, FE80::/64, are equivalent to autoconfigured IPv4 addresses /16. Link-local addresses are used to send packets on a local subnet. An IPv6 address has eight 16-bit groups of hexadecimal characters separated by colons. Each 16-bit block is converted to hexadecimal and separated by colons, such as 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C7B. You can simplify IPv6 addresses by removing the leading zeros within each 16-bit block, but each block must have at least a single digit. For example, by suppressing the leading zeros of the address given above, the address representation becomes 21DA:D3:0:2F3B:2AA:FF:FE28:9C7B. You can also simplify IPv6 addresses by using :: or commonly referred to as a double colon to represent a contiguous sequence of 16-bit blocks set to 0. For example, the link-local address of FE80:0:0:0:2AA:FF:FE9A:4CA2 can be compressed to FE80::2AA:FF:FE9A:4CA2, and the multicast address FF02:0:0:0:0:0:0:2 can be compressed to FF02::2. The 0:0:0:0:0:0:0:1 address is not a link-local address. This address is used as a loopback address. In Windows 7, the 0:0:0:0:0:0:0:1 or ::1 address is used as a loopback address. The loopback address enables a node to send packets to itself. The 2000:4321:8765:9ABC:5678:1234:9ABC:1111address is not a link-local address. This address is a global unicast address. A global unicast address is an IPv6 address that uses unicast packets that can be sent through the Internet. A global unicast address has a prefix of 2000::/3. The FF02::1:FF78:5678 address is not a link-local address. This address is a multicast address. Multicasts stay on the local subnet. These type of addresses have a prefix of FF02::/16. Item: 16 (Ref:Cert ) You are the network administrator of your company. You install Windows Server 2008 R2 on all servers on the network. The company's network consists of a single Active Directory domain with the Windows Server 2008 domain functional level. You want to configure multiple password policies in the domain. To achieve this, you want to configure fine-grained password policies. Which group membership will you require for configuring fine-grained policies? Enterprise Admins group Domain Admins group Schema Admins group Local Administrators group on the domain controller Domain Admins group By default, only members of the Domain Admins group can set fine-grained password policies, although if your domain functional level is Windows Server 2008 or above, it is possible to delegate this permission to other users as well. To configure fine-grained password policies, the domain functional level must be Windows Server 2008.

18 Page 18 of 218 Windows Server 2008 and Windows Server 2008 R2 allow you to define different password and account lockout policies for different sets of users in a domain. You can use fine-grained password policies to specify multiple password policies within a single domain. Finegrained password policies apply only to user objects and global security groups. If you do not create fine-grained password policies for different sets of users, the default domain policy settings will apply to all users in the domain. As fine-grained password policy cannot be applied to an OU, you can instead apply a fine-grained password policy to a global security group that contains all the users of that OU. This type of global security group is called a shadow group. Applying a fine-grained password policy to a shadow group will ensure that all users in the same OU have the same password policies applied. The options stating Enterprise Admins group, Schema Admins group, and local Administrators group on the domain controller are incorrect because only members of the Domain Admins group can set fine-grained password policies by default. Item: 17 (Ref:Cert ) You are the network administrator for your company. Your company's network has a single forest with three domains. All domain controllers in your forest run Windows Server 2008 R2. You will be expanding the personnel in one of your domains by an additional 200 users. You have created a spreadsheet with the properties of the new user accounts, and you want to import the spreadsheet into Active Directory. What should you do? Run CSVDE to import the accounts and run REPADMIN to replicate the accounts to the other domain controllers. Export the spreadsheet to a comma-delimited text file. Use Active Directory Users and Computers to import the file into the appropriate domain. Use REPADMIN to replicate the accounts to the other domain controllers. Export the spreadsheet to a comma-delimited text file. Use Active Directory Users and Computers to import the file into the appropriate domain. Use RSDIAG to replicate the accounts to the other domain controllers. Run CSVDE to import the accounts and RSDIAG to replicate the accounts to the other domain controllers. Run CSVDE to import the accounts and run REPADMIN to replicate the accounts to the other domain controllers. You should use CSVDE to import the accounts. The CSVDE utility can be used to import a comma-delimited file in Active Directory. However, this utility can only be used to import new objects; it cannot be used to modify existing objects. Next, you should use REPADMIN to force replication of the newly imported accounts to other domain controllers. You can use either the Repadmin or Replmon command-line tools to manually force the replication of a specific directory partition to other domain controllers. The LDIFDE utility can also be used to import new or modified objects in Active Directory. However, LDIFDE does not use commadelimited or tab-delimited files; it uses a special file format named the LDAP directory interchange file (LDIF). You cannot use Active Directory Users and Computers to import accounts from a file. You cannot use RSDIAG to force replication of the newly imported accounts to other domain controllers. This tool is a command-line tool that examines Remote Storage (HSM) databases and displays diagnostic information in text format about migration jobs, managed volumes of the version of the NTFS file system used in Windows Server 2003, and physical media, as well as other Remote Storage information used for system analysis. RSDIAG does not replicate Active Directory information. Item: 18 (Ref:Cert ) You are a network administrator for a multinational bank. You administer a contact center for the company in Alaska. The company's network consists of a single Active Directory domain that has several domain controllers that run Windows Server 2008 R2. The company's network also consists of 100 Windows 7 client computers. One of the users, named Fred, reported that his computer keeps restarting. You fixed the problem by reinstalling a device driver. You now want to enable an audit policy using the Auditpol.exe command-line tool to track all system restart events on Fred's computer. However, before you run Auditpol.exe to enable a new audit policy, you want to verify all the audit policies currently enabled on Fred's computer.

19 Page 19 of 218 What should you do? Run the Auditpol /list /r command. Run the Auditpol /get command. Run the Auditpol /list command. Run the Auditpol /get /sd command. Run the Auditpol /get command. You should run the Auditpol /get command to verify all audit policies that are currently enabled on Fred's computer. Auditpol.exe is a command-line tool used to set audit policy subcategories and per-user audit policy in Windows Server 2008 and Windows Server 2008 R2. In Windows 2000 Server and Windows Server 2003, there is only one audit policy for Active Directory, named Audit Directory Service Access, which controls whether auditing for directory service events are enabled or disabled. In Windows Server 2008 and Server 2008 R2, the audit policy is divided into four subcategories: Directory Service Access: Enables users to audit the event of a user accessing an Active Directory objects. Directory Service Changes: Enables users to audit the event of changes that are made to an Active Directory objects, for example, create, modify, or move. Directory Service Replication: Enables users to audit Active Directory replication problems. Detailed Directory Service Replication: Enables detailed tracking of Active Directory replication. Each subcategory is independent for its own usage. To be precise, if you disable one of the subcategories such as Directory Service Access, the event changes generated can still be seen if you have enabled the Directory Service Changes subcategory. Similarly, if you disable the Directory Service Changes subcategory and enable the Directory Service Access subcategory, the Security log events will still be reflected. Since there is no Windows interface tool available for these in Windows Server 2008, you can use the Auditpol.exe command-line tool to view or set audit policy subcategories. You should not run the auditpol / list /r command to verify all audit policies currently enabled on Fred's computer. The auditpol / list /r command is a subcommand to the Auditpol /list command, which is used to display the output in report format as comma-separated values. You should not run the auditpol /list command to verify all audit policies currently enabled on Fred's computer. The /list command parameter in Auditpol.exe is used to display selectable policy elements to create an audit policy. You should not run the auditpol /get /sd command to verify all audit policies currently enabled on Fred's computer. The auditpol /get /sd command in Auditpol.exe is a subcommand to the Auditpol /get command, which is used to retrieve the security descriptor used to delegate access to the audit policy. To verify only the current audit polices enabled, you can use the Auditpol /get command separately. Item: 19 (Ref:Cert ) You are the network administrator for your company. The company's network consists of a single Active Directory domain. All servers on the network run Windows Server 2008 R2. A server named Server1 is configured as a domain controller. Users report that Active Directory searches have become slow. You discover that Server1 is running low on disk space due to the gradual growth of the Active Directory database file. You decide to move the Active Directory database and log files to a single partition on another server, named Server2. What is the minimum free disk space that will be required to permanently move Active Directory database and log files to Server2? The size of the database file plus at least 15 percent (15%) of the size of the combined Ntds.dit and log files or 500 MB, whichever is greater The size of the database file plus at least 15 percent (15%) of the size of the combined Ntds.dit and log files or 1 GB, whichever is greater The size of the database file plus at least 20 percent (20%) of the size of the combined Ntds.dit and log files or 500 MB, whichever is greater The size of the database file plus at least 20 percent (20%) of the size of the combined Ntds.dit and log files or 1 GB, whichever is greater

20 Page 20 of 218 The size of the database file plus at least 20 percent (20%) of the size of the combined Ntds.dit and log files or 1 GB, whichever is greater You need enough space for the size of the database plus at least 20 percent (20%) of the size of the combined Ntds.dit and log files, or 1 GB, whichever is greater. Relocating the Active Directory database file is usually done due to hardware maintenance or low disk space. If the growth of the Active Directory database or log files are causing low disk space, you should either expand the partition on the disk that currently stores the database file, or move the database file to a bigger partition with the Ntdsutil.exe utility. To relocate the Active Directory database, you should restart the server in Directory Services Restore Mode. If the path to the database file or log files will change as a result of moving the files, it is recommended that you use the Ntdsutil.exe utility because Ntdsutil updates the registry with the new path. You should also perform a system state backup as soon as the move is complete so that the restore procedure uses the correct path. When you are permanently relocating only the Active Directory database file to a new location, the minimum free disk space required is the size of the database file plus 20 percent of the Ntds.dit file, or 500 MB, whichever is greater. When you are permanently relocating only the log files to a new location, the minimum free disk space required is the size of the combined log files plus 20 percent of the combined logs, or 500 MB, whichever is greater. When you want to relocate both database and logs permanently to a new location, the minimum free disk space required is at least 20 percent of the combined Ntds.dit and log files, or 1 GB, whichever is greater. The other three options are incorrect. When you want to relocate both database and logs permanently to a new location, the minimum free disk space required is the greater of 1 GB or a volume equivalent to at least 20 percent of the combined Ntds.dit and log files. Item: 20 (Ref:Cert ) You are a network administrator for your company. The company has one main office and two branch offices. The servers at the main office run Windows Server 2008 R2 at the Windows Server 2003 functional level. All servers at the branch office network run either Windows Server 2003 or Windows Server 2008 R2. The client computers in the main office run Windows XP Professional, and client computers in branch offices run Windows 7. You deploy Active Directory Rights Management Services (AD RMS) in the main office. However, you notice that the client computers in the main office are unable to protect their documents using the AD RMS service. What should you do to fix the problem with minimal administrative efforts? Upgrade all client computers to Windows 7. Raise the domain functional level to Windows Server Download and install the RMS client and the Windows Rights Management Add-on for Internet Explorer on all Windows XP client computers. Flush the RMS Message Queuing queue. Download and install the RMS client and the Windows Rights Management Add-on for Internet Explorer on all Windows XP client computers. You should download and install RMS client and the Windows Rights Management Add-on for Internet Explorer on all client computers running Windows XP to achieve the objective in this scenario. Windows Vista includes the RMS client by default. Operating systems released before Windows Vista and Windows Server 2008 do not have the RMS client installed. To use AD RMS service in a Windows XP computer, you must download and install the RMS client from the Microsoft Download Center (Microsoft Windows RMS with Service Pack 2 (SP2)). With AD RMS, you can protect the documents for AD RMS enabled applications by providing appropriate user rights and permissions to the documents such as copy, edit, view, and print. You should also install the Windows Rights Management Add-on for Internet Explorer. The Rights Management Add-on for Internet Explorer (RMA) allows users who do not have Microsoft Office 2003 or later installed to view these RM-protected files. You should install the Windows Rights Management client (RM) before installing the Windows Rights Management Add-on for Internet Explorer. You should not upgrade all computers to Windows 7 to achieve the objective in this scenario. Upgrading all client computers to Windows