Upgrade to remove ads
Only $2.99/month

Microsoft 2 Testbank WEEK 2

Terms in this set (61)

d. Active Directory database
The domain controllers are the computers that store and run the _______________.


a. user database
b. services database
c. Managed Service Accounts database
d. Active Directory database
a. one

A domain requires just one Primary Domain Controller Emulator.
How many PDC Emulators are required, if needed, in a domain?

a. one
b. two
c. three
d. four
a. You have a single domain

Do not place the infrastructure master on a global catalog server unless you have only one domain or all the domain controllers in your forest are also global catalogs.
You do not place the infrastructure master on a global catalog server unless what situation exists?

a. You have a single domain.
b. You have Windows NT 4.0 systems to support.
c. You have multiple schemas.
d. Your AD DS is Windows 2008 or higher.
b. schema
When you add attributes to an Active Directory object, what part of the domain database are you actually changing?


a. FSMO
b. schema
c. directory structure
d. organizational units
D. Operations Master

Operations Masters are specialized domain controllers that perform certain tasks so that multi-master domain controllers can operate and synchronize properly.
Which Active Directory object is defined as a specialized domain controller that performs certain tasks so that multi-master domain controllers can operate and synchronize properly?


a. Schema Master
b. Forest
c. RODC
d. Operations Master
b. at least two

Managing Global Catalogs and Configuring Universal Group Membership Caching
Explanation: Initially, it was recommended to have global catalogs at every site. Nonetheless, every organization should have at least two global catalogs for fault tolerance
How many global catalogs are recommended for every organization?

a. at least one
b. at least two
c. at least three
d. no fewer than four
b. Install Active Directory

d. Execute dcpromo from Server Manager

A domain controller is a Windows server that stores a replica of the account and security information for the domain and defines the domain boundaries. To make a computer running Windows Server 2012 or Windows Server 2012 R2 a domain controller, you must install the AD DS and execute dcpromo from Server Manager
What two things must you do to a Windows Server to convert it to a domain controller?

a. Install Server Manager.
b. Install Active Directory Domain Services (AD DS).
c. Install DNS.
d. Execute dcpromo from Server Manager
c. in a remote site

An RODC was created to be used in places where a domain controller is needed but the physical security of the domain controller could not be guaranteed. For example, it might be placed in a remote site that is not very secure and has a slower WAN link. Because it has a slow WAN link, a local domain controller would benefit the users at that site.
Where are you most likely to see a Read-Only Domain Controller (RODC)?

a. in a small network instead of in an enterprise
b. in an enterprise network
c. in a remote site
d. in the place of a standard domain controller
a. seize schema master

c. seize PDC

At the fsmo maintenance prompt, the seize schema master command and the seize PDC command would both seize the role of an Operations Master Holder
Which of the following commands issued at the fsmo maintenance prompt would successfully seize the role of an Operations Master Holder? Select all that apply.


a. seize schema master
b. seize global master
c. seize PDC
d. seize domain control
d. Windows Server 2012

Starting with Windows Server 2012, you can safely virtualize a domain controller and rapidly deploy virtual domain controllers through cloning.
Beginning with which server version can you safely deploy domain controllers in a virtual machine?


a. Windows Server 2003

b. Windows Server 2008

c. Windows Server 2008 R2

d. Windows Server 2012
B. sysprep
What utility must you run on a cloned system to ensure that the clone receives its own SID?

a. adprep /renew
b. sysprep
c. dcpromo
d. ntconfig
b. Windows Server 2003


Managing Global Catalogs and Configuring Universal Group Membership Caching
Explanation: Since Windows Server 2003, incremental universal group membership replication was introduced, which significantly decreased the amount of replication traffic of universal groups.
Which version of Windows Server introduced incremental universal group membership replication?

a. Windows Server 2000
b. Windows Server 2003
c. Windows Server 2008
d. Windows Server 2012
b
. What are the three types of groups in a domain?

a. domain trust groups, domain schema groups, and universal groups
b. domain local groups, global groups, and universal groups
c. global groups, domain trust groups, and schema groups
d. universal groups, global catalog groups, and schema groups
a, b, and c
The global catalog stores a partial copy of all objects in the forest. What are the reasons for keeping that partial copy? Select all that apply.
a. logon
b. object searches
c. universal group membership
d. schema integrity
b
1. What function does the CSVDE tool perform?
a. It decrypts and encrypts Active Directory information.
b. It exports/imports Active Directory information.
c. It exports/imports data from Event Viewer.
d. It extracts Event Viewer information into CSV files.
b
If a single domain controller's AD database becomes corrupt, which type of restore should you perform on it?
a. authoritative
b. nonauthoritative
c. explicit
d. full
d
To perform an authoritative restore, into what mode must you reboot the domain controller?
a. Repair
b. Safe
c. Command line with networking
d. DSRM
a
What is a GUID?
a. a unique identifier for a snapshot
b. a special file permission
c. an Active Directory object ID
d. a group-user ID in Active Directory
b
What utility first appeared in Windows Server 2008 R2 that allows you to undelete Active Directory containers and objects?
a. the Active Directory Lost and Found folder
b. the Active Directory Recycle Bin
c. the Active Directory Undelete utility
d. Active Directory Snapshots
d
By default, how often does Active Directory "garbage collection" occur?
a. every 45 minutes
b. every 2 hours
c. every 8 hours
d. every 12 hours
c
After you undelete a user account with the LDP utility, what action do you need to perform?
a. Remove the old identifier.
b. Re-establish user to domain trust.
c. Reset the user's password.
d. Restore the user-owned objects from a backup.
a
. In interactive mode, what aspect of AD can you check with the ntdsutil integrity command?
a. low-level database corruption
b. fragmentation levels
c. accuracy of entries
d. completeness of entries
c
What is the proper procedure for removing a domain controller from Active Directory?
a. Shut down the domain controller and manually remove it from AD.
b. Use dcdemo to demote the domain controller.
c. Uninstall Active Directory Domain Services.
d. Enter the DSRM and delete Active Directory.
...
Which of the following ntdsutil commands cleans up metadata?
a. metadata defrag
b. metadata restore
c. metadata cleanup
d. metadata repair
...
To perform an authoritative restore of an object or subtree, what bit of information do you need to know about the object?
a. its formal name
b. its exact location
c. its OU and proper name
d. its distinguished name
...
When you do an authoritative restore process, a back-links file is created. What is a back-links file?
a. a reference to an attribute within another object
b. a reference to metadata
c. a pointer to the object's OU
d. a reference to a distinguished name location
b,d
Before you can use the Active Directory Recycle Bin, what two actions do you have to perform?
a. You have to remove the System Recycle Bin.
b. You have to enable the AD Recycle Bin.
c. You have to set the AD forest to Windows Server 2003 or higher.
d. You have to set the AD forest to Windows Server 2008 R2 or higher.
d
. Windows Server 2012 introduces a new time-saving feature when performing tasks such as AD defragmentation. What is that feature?
a. The DSRM console
b. The ntdsutil command-line utility
c. Active Directory Maintenance Mode
d. Restartable Active Directory Domain Services
c
Which utility do you use to defragment Active Directory?
a. CSVDE
b. LDIFDE
c. ntdsutil
d. defrag
d
Which feature affects all users in the domain, including domain controllers?
a. Global Group Policy
b. Default Domain Policy
c. Default Group Policy
d. Default Global Domain Policy
d
In which order are Group Policy objects (GPOs) processed?
a. Local group policy, Site, Domain, User
b. OU, Domain, Site, Local group policy
c. Local security policy, Site, Domain, OU
d. Local group policy, Site, Domain, OU
d
What is the default timeout value for GPOs to process on system startup?
a. 60 seconds
b. 120 seconds
c. 300 seconds
d. 600 seconds
a
GPOs are processed on computer startup and after logon. Why is the user never aware of the processing?
a. Processing is hidden from the user.
b. The user is too busy to be aware of the processing.
c. The processing occurs when the system is not being used.
d. The user is aware of only startup delays.
c
What is the first step in the GPO processing order?
a. The user initiates interactive logon.
b. The computer obtains a list of GPOs from the domain controller.
c. The computer establishes a secure link to the domain controller.
d. The GPOs are applied to the computer and to the user.
d
. The downward flow of group policies is known as what feature of GPOs?
a. cumulative processing
b. inherent processing
c. inheritance
d. control
a
If a site, domain, or OU has multiple GPOs, how are the group policies processed?
a. by precedence
b. by importance
c. by administrative control
d. by GPO controller policy
b,d
Which two filters can you use to control who or what receives a group policy?
a. policy filter
b. security group filter
c. domain filter
d. WMI filter
a,d
For users to receive GPO settings, they must have which two permissions to the GPO?
a. Allow Read
b. Allow Write
c. Allow Modify
d. Allow Apply
a
By default, which GPO permissions are all authenticated users given?
a. Apply Group
b. Allow Group
c. Apply Global
d. Allow Global
d
. At what point are WMI filters evaluated?
a. when the filter is created
b. when the policy is applied
c. when the filter is applied
d. when the policy is processed
c
To use WMI filters, you must have one domain controller running which version of Windows Server or higher?
a. NT 4.0
b. 2000
c. 2003
d. There is no such requirement to use WMI filters.
...
How many WMI filters can be configured for a GPO?
a. one
b. two
c. four
d. eight
b
What kind of group policies should you enable for student computers?
a. generic
b. loopback
c. extensive
d. compliant
b,c
What is the primary purpose of running the Group Policy Results Wizard? Check all that apply.
a. to guarantee that GPOs are enforced in full
b. to analyze the cumulative effect of GPOs
c. for GPO troubleshooting
d. to ensure that you have administrative rights to the client computer
c
You are administrator of a corporation with clients running Windows 8 or Windows 8.1. Your domain controllers are running Windows Server 2012 R2. You have made a change to a GPO and you want the GPO settings to be applied immediately. What can you do?
a. At the domain controller, execute the Gpupdate /force command.
b. Copy the GPO to all domain controllers using Active Directory Sites and Services.
c. On the domain controller, execute the Windows PowerShell Invoke-GPUpdate cmdlet.
d. Enable the Group Policy Caching feature using a GPO.
d
Which of the following Windows 8.1 and Windows Server 2012 R2 features can speed up the performance of processing synchronous policy settings?
a. GPO Turbo Mode
b. GPO Enhanced Mode
c. Group Policy Update
d. Group Policy Caching
...
. What are examples of password policies? Select all that apply.
a. history
b. length
c. complexity
d. age
B
Why primarily are account lockout policies put into place?
a. privacy
b. security
c. policy
d. regulations
D
What is the default setting for password history?
a. 6
b. 10
c. 16
d. 24
b
What is the default minimum password length in characters?
a. 5
b. 7
c. 8
d. 10
A
What setting can you give for account lockout duration that requires an administrator to manually unlock the account?
a. 0
b. 10
c. 99
d. 99,999
D
By default, who has read/write capability to the Default Domain Policy?
a. local administrators
b. power users
c. domain users
d. domain administrators
C
What is the primary advantage of using Group Policies in a domain environment?
a. ease of enforcement
b. user compliance
c. centralized management
d. ease of creation
B
What is the secpol.msc utility used for?
a. editing group policies
b. editing local security policies
c. editing global security policies
d. editing domain-level policies
D
What does the minimum password age setting control?
a. how many seconds a user must wait before a password reset
b. how many minutes a user must wait before a password reset
c. how many hours a user must wait before a password reset
d. how many days a user must wait before a password reset
B
Why should administrator passwords change more often than user passwords?
a. because administrator passwords are usually simpler than user passwords
b. because administrator accounts carry more security sensitivity than users do
c. because administrators are paranoid about security
d. because administrator accounts are watched by management in large companies
C
What is the range of password history settings?
a. 0 to 9
b. 0 to 15
c. 0 to 24
d. 0 to 63
D
What is an easy method of creating a strong password?
a. Use your username and add numbers and special characters.
b. Use your favorite football team's name with numbers and special characters.
c. Ask a friend for some ideas for good passwords and then add your own number and characters.
d. Start with a sentence and then add numbers and special characters.
A,C
Why is a setting of 0 for maximum password age not a good idea? Check all that apply.
a. It means that passwords never expire, which is a major security problem.
b. It means that your passwords expire every day.
c. It means that you've disabled password aging.
d. It means that you've disabled the use of passwords.
A,B,C
Account policies contain various subsets. Which of the following are legitimate subsets of account policies? Check all that apply.
a. Password Policy
b. Account Lockout Policy
c. Kerberos Policy
d. Username Policy
C
By default, which of the following represents the maximum amount of time by which a computer's internal clock can be inaccurate yet still be able to use Kerberos authentication?
a. 30 seconds
b. 1 minute
c. 5 minutes
d. 8 minutes
THIS SET IS OFTEN IN FOLDERS WITH...