Free MCTS 70 640: Active Directory, Configuring Question and Answers — Questions and Answers
Question 1: There is only one Active Directory domain in your network. Every domain controller is active Operating System 2003. <br> The domain controllers are all upgraded to Windows Server 2008. <br> The Active Directory system has to be set up to accommodate the use of multiple password policies. <br> What should you do?
- Create multiple Active Directory sites
- On all domain controllers, run dcpromo /adv
- Raise the functional level of the domain to Windows Server 2008 (Correct answer)
- On one domain controller, run dcpromo /adv.
Correct answer: Raise the functional level of the domain to Windows Server 2008
Multiple password policies, also known as Fine-Grained Password Policies, are a feature introduced in Windows Server 2008 Active Directory. To enable and utilize this advanced security feature, the Active Directory domain functional level must be raised to Windows Server 2008 or higher. This ensures that the necessary Active Directory schema extensions and capabilities are available.
Question 2: Intranet.contoso.com is the only Active Directory domain owned by your business. Windows Server 2008 R2 is used by all domain controllers. Windows is the domain functional level. <br> Windows 2000 is native and the forest functional level. <br> You must make sure that user accounts can use the UPN suffix for contoso.com. <br> What should you start with
- Add the new UPN suffix to the forest. (Correct answer)
- Change the Primary DNS Suffix option in the Default Domain Controllers Group Policy Object (GPO) to contoso.com
- Raise the intranet.contoso.com forest functional level to Windows Server 2003 or higher.
- Raise the intranet.contoso.com domain functional level to Windows Server 2003 or higher.
Correct answer: Add the new UPN suffix to the forest.
To allow user accounts in an Active Directory domain (e.g., intranet.contoso.com) to use an alternative User Principal Name (UPN) suffix (e.g., contoso.com), that suffix must first be explicitly added to the Active Directory forest. This action makes the new UPN suffix available for selection when configuring user accounts. The domain or forest functional level does not need to be raised for this specific task.
Question 3: You have two servers, Server1 and Server2, respectively. Windows Server 2008 is used by both servers. R2. Enterprise root certification authority (CA) configuration is set up on Server1. <br> On Server2, you set up the Online Responder role service. <br> Server1 must be set up to handle the Online Responder. <br> What ought you to do?
- Configure the Certificate Revocation List Distribution Point extension.
- Add the Server2 computer account to the CertPublishers group.
- Configure the Authority Information Access (AIA) extension. (Correct answer)
- Import the enterprise root CA certificate.
Correct answer: Configure the Authority Information Access (AIA) extension.
To enable an Online Responder (OCSP) to function correctly with a Certification Authority (CA), the CA must be configured to include the Online Responder's URL in the Authority Information Access (AIA) extension of issued certificates. This configuration allows clients to discover and use the Online Responder to check the revocation status of certificates. Without this, clients wouldn't know where to find the OCSP service.
Question 4: Active Directory forests with the names contoso.com and fabrikam.com exist within your organization. <br> Three DNS servers designated DNS1, DNS2, and DNS3, are part of the firm network. The configuration of the DNS servers is displayed in the following table. <br> DNS3 is set as the primary DNS server on each computer in the fabrikam.com domain. The preferred DNS server for the rest of the PCs is DNS1. <br> The servers for the contoso.com domain are inaccessible to users from the fabrikam.com domain. <br> You must make sure that any contoso.com queries may be answered by users of the fabrikam.com domain. <br> What ought you to do?
- Create a copy of the fabrikam.com zone on the DNS1 server and the DNS2 server.
- Create a copy of the _msdcs.contoso.com zone on the DNS3 server.
- Configure conditional forwarding on DNS1 and DNS2 to forward fabrikam.com queries to DNS3.
- Configure conditional forwarding on DNS3 to forward contoso.com queries to DNS1. (Correct answer)
Correct answer: Configure conditional forwarding on DNS3 to forward contoso.com queries to DNS1.
Users in the fabrikam.com domain are configured to use DNS3 as their primary DNS server. To ensure these users can resolve queries for the contoso.com domain, DNS3 needs a mechanism to forward those specific queries to the appropriate DNS server for contoso.com. Configuring conditional forwarding on DNS3 to send contoso.com queries to DNS1 (which hosts contoso.com) will achieve this, enabling cross-domain name resolution.
Question 5: There is only one Active Directory domain in your network. Every domain controller is active Operating System 2008 R2. Both the Audit directory services access setting and the Audit account management policy setting are turned on for the entire domain. The ability to log changes to Active Directory objects must be present. The old and new values of any attributes must be included in the modifications that were logged. <br> What ought you to do?
- Run auditpol.exe and then enable the Audit directory service access setting in the Default Domain policy.
- Run auditpol.exe and then configure the Security settings of the Domain Controllers OU. (Correct answer)
- From the Default Domain Controllers policy, enable the Audit directory service access setting and enable directory service changes.
- Enable the Audit account management policy in the Default Domain Controller Policy.
Correct answer: Run auditpol.exe and then configure the Security settings of the Domain Controllers OU.
To log changes to Active Directory objects, including old and new attribute values, you need to enable specific advanced auditing policies and configure object-level auditing. Running `auditpol.exe` allows for granular control over auditing categories, and then configuring the Security settings (SACLs) on the Active Directory objects within the Domain Controllers OU (or the domain itself) specifies *what* changes to audit. This combination ensures detailed logging of attribute modifications.
Question 6: There is an Active Directory domain for your business. The following warning appears when a user attempts to log on to the domain from a client computer: "This user account has expired. Ask your administrator to reactivate the account." <br> You must guarantee that the user can access the domain. <br> What ought you to do?
- Modify the properties of the user account to set the account to never expire. (Correct answer)
- Modify the properties of the user account to extend the Logon Hours setting.
- Modify the default domain policy to decrease the account lockout duration.
- Modify the properties of the user account to set the password to never expire.
Correct answer: Modify the properties of the user account to set the account to never expire.
The error message 'This user account has expired' directly indicates that the user account in Active Directory has reached its configured expiration date. To resolve this, the administrator must modify the user account properties. This involves either setting a new expiration date or configuring the account to 'never expire,' allowing the user to log on again.
Question 7: The Active Directory domain for your business is contoso.com. Two DNS servers, DNS1 and DNS2, are part of the firm network. The configuration of the DNS servers is displayed in the following table. <br> <br> Users of the domain who have DNS2 set as their preferred DNS server are unable to access Internet websites. <br> All client PCs must have Internet name resolution enabled. <br> What ought you to do?
- Update the Cache.dns file on DNS2. Configure conditional forwarding on DNS1.
- Update the list of root hints servers on DNS2.
- Create a copy of the .(root) zone on DNS1.
- Delete the .(root) zone from DNS2. Configure conditional forwarding on DNS2. (Correct answer)
Correct answer: Delete the .(root) zone from DNS2. Configure conditional forwarding on DNS2.
DNS2 is currently authoritative for the root zone (.), meaning it's attempting to resolve all Internet queries itself without relying on external root hints or forwarders, leading to resolution failures. To enable Internet name resolution for clients using DNS2, the root zone must be deleted from DNS2. Subsequently, configuring conditional forwarding on DNS2 to send Internet queries to a reliable external DNS server (like DNS1 or public DNS) will ensure proper name resolution.
Free MCTS 70 640: Active Directory, Configuring Question and Answers
There is only one Active Directory domain in your network.
Every domain controller is active
Operating System 2003.
The domain controllers are all upgraded to Windows Server 2008.
The Active Directory system has to be set up to accommodate the use of multiple password policies.
What should you do?