Final study

How often does garbage collection run on a DC?

12 hours

By default, for how long are deleted objects stored within the Active Directory database before they are removed entirely?

180 days

Which of the following is the company whose users are accessing resources from another company?

Account partner

Which type of cryptography procides the most security?

Asymmetric cryptography

In which LDAP-compatible database are claims values stored

Attribute store

Which feature was first introduced with Windows Server 2012 R2, and are new Active Directory containers to which authentication policies can be applied to restrict where high-privilege user accounts can be used in the domain?

Authentication Policy silos

What is the last step, just before you review the relying party trust information, in the Add Relving Party Trust Wizard?

Configure an access control policy

What is created automatically by the KCC and allows the configuration of replication between sites?

Connection object

What assigned value represents the bandwidth of the connection between sites?

Cost

Which of the following is created using a hash algorithm and can be used to verify the authenticity of a document

Digital signature

Select below the FSMO role that is a forest-wide FSMO role:

Domain naming master

What can you install on a Windows Server 2016 server that can scan documents and apply rights policy templates automatically based on resource properties?

FSRM

A claims provider is the resource partner that accepts claims from the business partner to make authentication and authorization decisions.

False

A site bridge is needed to connect two or more sites for replication

False

A tree can cost of a single domain or a parent domain and child domains, which cannot have child domains of their own

False

Active Directory metadata describes the actual Active Directory data, not the Active Directory database.

False

Applications that are not claims-aware can't be used in an AD FS deployment

False

By default, subnets are created in Active Directory Sites and Services

False

CA Administrator approves requests for certificate enrollment and revocation

False

Group conversion facilitates migrating user accounts from one domain to another

False

If a certificate is not renewed before the validity period expires, the certificate can still be used and the renewal period ends.

False

If your domain includes Windows Server 2003 or older DCs, it's using DFSR to replicate SYSVOL

False

Intrasite replication takes place between DCs in two or more sites

False

Primary authentication is not required for all users who access applications that use AD FS

False

The intermediate CA is the most critical and is the server typically configured for offline operation

False

The logical components of Active Directory are forests, domains, and sites

False

Version 5 templates allow custimization of most certificate setttings and permit autoenrollment

False

With AD FS preauthentication, client requests for the application are sent via a proxy server to the application server.

False

With separate domains, stricter resource control and administrative permissions are more difficult.

False

What is the first domain installed as a forest called?

Forest root

Which of the following is responsible for assigning a bridgehead server to handle replication for each directory partition?

Inter-Site Topology Generator

Which type of CA in the three-level hierarchy is sometimes referred to as a policy CA and issues certificates to issuing CAs?

Intermediate

For intrasite replication, what component builds a replication topology for DCs a site and establishes replication partners?

KCC

You want to configure automatic key archival to ease the burden of managing backup of private keys. What role must you assign to at least one trusted user in the organization?

KRA

You have a member of Cisco routers and switches that you wish to secure using IPsec. You want IPsec authentication to use digital certificates. You already have a PKI in place using Certificate Services on Windows Server 2016. What should you install to secure your device?

NDES roles Service

Why might it be a good idea to configure multiple domains in a forest

Need for differing account policies

By default, replication between DCs when no changes have occurred is scheduled to happen how often?

Once per hour

Which of the following contains a list of users and specifies what the users can do with a rights protected document?

Publushing license

What is the name of a domain controller on which changes can't be written?

Read only domain controller

What feature should you enable to prevent the sIDHistory attribute from being used to falsely gain administrative privileges in a trusting forest?

SID filtering

A Web Application Proxy server needs two NICS installed to function correctly.

True

A delegated installation allows a domain administrator to create the RODC computer account in Active Directory, so a that a regular user can perform the installation at a later time

True

A domain controller clone is a replica of an existing DC

True

A revocation configuration tells the CA what methods are available for clients to access CRLs.

True

AD FS is designed to work over the public Internet with a Web browser interface

True

Adding a subdomain is a common reason for expanding an Active Directory forest

True

An Active Directory snapshot is a replica of the Active Directory database at a specific moment

True

Authentication efficiency, replication efficiency, and application efficiency are the three main reasons for establishing multiple sites.

True

Before you can install a DC running a newer Windows Server version in an existing forest with a lower factional level, you must prepare existing DCs with the adprep.exe command-line program

True

Before you can install an RODC, the forest functional level must be at least Windows Server 2003

True

Certificate autoenrollment is an option only on enterprise CAs

True

Device registration is a feature that allows non domain-joined devices to access claims-based resources securely.

True

Intrasite replication occurs between bridgehead servers

True

Multi-factor authentication means users must authenticate with more than one device.

True

Remote Desktop Gateway applications are a convenient way for organizations to make applications available to users without having to install the application on every user's computer

True

The PowerShell cmdlet "Restore-CARoleService" restores the CA database and all private key data

True

The federated Web SSO with forest trust design is most often used in business-to-employee relationships.

True

The repadmin /repliacate command causes replication of a specified partition from one DC to another

True

Universal groups allow administrators to assign rights and permissions to forest-wide resources to users from any domain.

True

Users can request certificates that aren't configured for autoenrollment by using the Certificates snap-in.

True

When a full backup or system state backup is performed on a CA server, the certificate store is backed up along with other data

True

Which command analyzes the overall health of Active Directory and perfomas replication security checks?

dcdiag

What feature allows non domain-joined devices to access claims based resources securely?

device registration

Which of the following manages adding, removing, and renaming domains in the forest?

domain naming master

Which option will allow private keys to be locked away and then restored if the user's private key is lost?

key archival

What tool can a user use to request certificates that are not configured for autoenrollment?

Certificates snap-in

What folder contains group policy templates, logon logoff scripts, and DeS synchronization data?

SYSVOL

What features should you configure if you want to limit access to resources by users in a traited forest, regardless of permission settings on these resources?

Selective authentication

Which of the following is a self signed certificate and identifies the AD RMS cluster?

Server licensor certificate

What type of key is used in symmetric cryptography, must be known by both parties, and is used for both encryption and decryption?

Shared secret

What type of certificate enrollment issues certificates that users can use to log on to a system by entering a PIN?

Smart card enrollment

Before you configure a forest trust, what should you configure to ensure you can contact the forest root of both forests from both forests?

Stub Zones

During garbage collection, what setting controls how long deleted objects remain within the database before such objects are completely removed?

Tombstone lifetime

You run a PKI that has issued tens of thousands of certificates to hundreds of thousands of clients. You have found that the traffic created when clients download the CRL is becoming excessive. What can you do to reduce the traffic caused by clients downloading the CRL?

Use a Delta CRL

Which of the following is issued to users when they request access to a rights protected document?

Use license

You have a network of Windows Server 2016 servers, and you wish to allow remote users the ability to access network applications from any device that supports a Web browser?

Web Application Proxy

Which of the following is the international standard that defines a PKI and certificate formats?

X.509

Which of the following is true about the domain functional level?

You can have different functional levels within the forest

What are conditions that determine what attributes are required in a claims and how claims are processed by the federation server?

claim rules

Which option below is not one of the three main methods for cleaning up metadata?

wbsadmin.exe