MCTS 70 640: Active Directory, Configuring Flashcards

You need to ensure that a specific OU and all objects within it are protected from accidental deletion. Which option in Active Directory Users and Computers should be enabled on the OU?

Answer: Enable the Protect object from accidental deletion checkbox on the Object tab

Checking 'Protect object from accidental deletion' on the Object tab of the OU adds an ACE that prevents deletion by standard admin operations.

Global Catalog servers store a partial replica of all objects in the forest. Which scenario requires a Global Catalog server to be available for user logon to succeed?

Answer: Logging on with a UPN when Universal Group Membership Caching is not configured

When a user logs on with a UPN in a multi-domain environment and UGMC is not enabled, a GC must be contacted to resolve universal group memberships.

You need to create a zone in DNS that AD DS domain controllers will use for replication, and you want the zone to be replicated only to DCs in the same domain. Which replication scope should you choose?

Answer: All DNS servers in the Active Directory domain

Selecting 'All DNS servers in the Active Directory domain' stores the zone in the domain-wide DNS application partition, replicating only to DCs in that domain.

After promoting a new DC, you notice that repadmin /replsummary shows replication errors from the new DC to others. Which tool should you run first to diagnose overall DC health?

Answer: dcdiag /test:replications

Dcdiag /test:replications runs the replication-specific diagnostic tests on a DC and reports errors that indicate the root cause.

You are configuring Universal Group Membership Caching (UGMC) for a remote site that has no Global Catalog server. Where is UGMC configured?

Answer: In Active Directory Sites and Services on the NTDS Site Settings object

UGMC is enabled on the NTDS Site Settings object for a site in Active Directory Sites and Services, applying to all DCs in that site.

A junior administrator accidentally ran 'dcpromo /forceremoval' on an active DC without properly demoting it. What is the immediate next step to clean up the AD DS environment?

Answer: Perform metadata cleanup using ntdsutil

Force removal leaves the DC's metadata in AD DS; ntdsutil metadata cleanup must be run to remove the stale DC object and associated records.

You need to configure an audit policy so that all successful and failed logon attempts are recorded in the Security event log on domain controllers. Which audit policy category should you enable?

Answer: Audit Account Logon Events

Audit Account Logon Events records authentication events (Kerberos ticket requests) on domain controllers where the accounts are validated.