Case Studies & Practical Application Flashcards

Coho Winery's Active Directory schema needs to be extended for a new application. The administrator runs the extension tool and receives 'Access Denied'. What is the minimum group membership required?

Answer: Schema Admins

Schema Admins is the only group with permission to modify the Active Directory schema.

Lucerne Publishing runs a Windows Server 2008 R2 forest. An admin must transfer the Infrastructure Master FSMO role because the current holder is being decommissioned. What tool should be used?

Answer: Active Directory Users and Computers (ADUC)

The Infrastructure Master can be transferred using ADUC by right-clicking the domain and selecting 'Operations Masters'.

A Contoso branch office loses its WAN connection. Local users cannot log on because there is no local DC. Which solution would have prevented this outcome?

Answer: Deploying an RODC in the branch office

An RODC provides local authentication services, eliminating dependency on WAN connectivity for logon.

Fabrikam wants to block a specific GPO setting from applying to one computer in an OU without moving the computer or using a new OU. What is the correct approach?

Answer: Apply a security filter denying Apply Group Policy to that computer's account

Denying Apply Group Policy permission to a specific computer account via security filtering prevents the GPO from applying to that computer.

Southridge Video needs to ensure that a GPO applying desktop wallpaper cannot be overridden by GPOs linked at lower levels. What setting should be configured on that GPO link?

Answer: Enforced (No Override)

Setting a GPO link to Enforced (formerly No Override) prevents child OU GPOs or Block Inheritance from overriding it.

A technician at City Power & Light seizes the RID Master role because the original holder crashed and cannot be recovered. Two weeks later, the original DC is restored. What must be done before bringing the old DC back online?

Answer: The restored DC must be demoted or its AD database discarded before rejoining

Bringing a seized FSMO holder back online causes dual FSMO conflict; the old DC must be demoted or kept permanently offline.

Wingtip Toys is implementing AD DS for the first time. They want a design that allows delegation of administration per business unit while keeping a single Kerberos authentication boundary. What design meets these requirements?

Answer: A single domain with multiple OUs, each delegated to the respective business unit

A single domain with delegated OUs satisfies both single authentication boundary and per-unit administrative delegation.