CTEC305 Chapter 6

b. PDC emulator

User authentications are taking a long time. The domain controller performing which FSMO role will most likely decrease authentication times if it's upgraded? a. RID master b. PDC emulator c. Infrastructure master d. Domain naming master

d. Create a new subnet and add the subnet to the site that maps to the physical location of the clients.

Users of a new network subnet have been complaining that logons and other services are taking much longer than they did before being moved to the new subnet. You discover that many logons and requests for DFS resources from clients in the new subnet are being handled by domain controllers in a remote site instead of local domain controllers. What should you do to solve this problem? a. Create a new site and add the clients and new GC server to the new site. b. Change the IP addresses of the clients to correspond to the network of the DCs that are handling the logons. c. Compact the Active Directory database because fragmentation must be causing latency. d. Create a new subnet and add the subnet to the site that maps to the physical location of the clients.

False

Users usually notice a failure of the domain naming master immediately. True or False?

d. Garbage collection

What's the term for removing deleted objects in Active Directory? a. Tombstoning b. Offline defragmentation c. Recycling objects d. Garbage collection

b. %systemroot%\SYSVOL

Where would you find files related to logon and logoff scripts in an Active Directory environment? a. C:\Windows\NTDS b. %systemroot%\SYSVOL c. %Windir%\ntds.dit d. C:\Windows\edb.log

c. ntdsutil with the authoritative restore command

Which command must you use to restore deleted Active Directory objects in a domain with two or more writeable DCs if the Active Directory Recycle Bin isn't enabled? a. wbadmin with the -authsysvol option b. wbadmin with the -restoreobject option c. ntdsutil with the authoritative restore command d. ntdsutil with the create snapshot command

b. wbadmin start systemstatebackup -backuptarget:B:

Which of the following commands backs up the Registry, boot files, the Active Directory database, and the SYSVOL folder to the B drive? a. robocopy C:\Windows /r /destination:B: b. wbadmin start systemstatebackup -backuptarget:B: c. backup %systemroot% -selectsystemstate > B: d. ntdsutil create snapshot -source C:\Windows\ntds -dest B:

c. Infrastructure master configured as a global catalog server

Which of the following configurations should you avoid? a. Domain naming master and schema master on the same domain controller b. PDC emulator and RID master on the same computer c. Infrastructure master configured as a global catalog server d. Schema master configured as a global catalog server

a. Improving authentication efficiency c. Reducing traffic on the WAN

Which of the following is a reason for establishing multiple sites? (Choose all that apply.) a. Improving authentication efficiency b. Enabling more frequent replication c. Reducing traffic on the WAN d. Having only one IP subnet

c. Facilitates intersite replication

Which of the following is not a function of the global catalog? a. Facilitates forest-wide searches b. Keeps universal group memberships c. Facilitates intersite replication d. Facilitates forest-wide logons

a. Tombstone lifetime

Which of the following is the period between an object being deleted and being removed from the Active Directory database? a. Tombstone lifetime b. Defragmentation limit c. Object expiration d. Restoration period

c. Bridgehead server

Which of the following is the term for a DC in a site that handles replication of a directory partition for that site? a. Inter-Site Topology Generator b. Knowledge Consistency Checker c. Bridgehead server d. Global catalog server

b. The forest functional level must be at least Windows Server 2003.

Which of the following is true about an RODC installation? a. A Windows server running at least Windows Server 2012 is required. b. The forest functional level must be at least Windows Server 2003. c. Adprep /rodcprep must be run in Windows Server 2008 forests. d. Another RODC must be available as a replication partner.

c. The first domain controller in the forest root domain

You have an Active directory Forest of two trees and eight domains. You haven't changed any of the operation master domain controllers. On which domain controller is the schema master? a. all domain controllers b. the last domain controller installed c. The first domain controller in the forest root domain d. The first domain controller in each tree

b. Configure a filtered attribute set, and specify the application-related objects.

You have an application integrated with AD DS that maintains Active Directory objects containing credential information, and there are serious security implications if these objects are compromised. An RODC at one branch office isn't physically secure, and theft is a risk. How can you best protect this application's sensitive data? a. Configure the PRP for the RODC, and specify a Deny setting for the application object. b. Configure a filtered attribute set, and specify the application-related objects. c. Use EFS to encrypt the files storing the sensitive objects. d. Turn off all password replication on the RODC.

b. Perform metadata cleanup.

You have four DCs in your domain. Active Directory appears to be corrupted on one of the DCs, and you suspect a failing hard drive. You attempt to remove it from the domain, but the procedure fails. You take the DC offline permanently and will replace it with another DC of the same name. What must you do before you can replace the DC? a. Restore the system state. b. Perform metadata cleanup. c. Back up SYSVOL. d. Transfer the FSMO roles.

d. The DNS service sends a referral to the client. The client registers its name with the referred DNS server.

You have installed an RODC at a branch office that also runs the DNS Server role. All DNS zones are Active Directory integrated. What happens when a client computer attempts to register its name with the DNS service on the RODC? a. The DNS service rejects the registration. The client must be configured with a static DNS entry. b. The DNS service passes the request to another DNS server. After registration is completed, the DNS server that performed the registration sends the record to the DNS service on the RODC. c. The DNS service creates a temporary record in a dynamically configured primary zone. The record is replicated to other DNS servers and then deleted on the RODC. d. The DNS service sends a referral to the client. The client registers its name with the referred DNS server.

a. Create a new global group named AllBranches. Add the four users to this group, and add the AllBranches group to the Allowed RODC Password Replication group.

You have three users who travel to four branch offices often and need to log on to the RODCs at these offices. The branch offices are connected to the main office with slow WAN links. You don't want domain controllers at the main office to authenticate these four users when they log on at the branch offices. What should you do that requires the least administrative effort yet adheres to best practices? a. Create a new global group named AllBranches. Add the four users to this group, and add the AllBranches group to the Allowed RODC Password Replication group. b. Add the four users to a local group on each RODC. Add the local groups to the PRP on each RODC with an Allow setting. c. Add each user to the PRP on each RODC with an Allow setting. d. Create a group policy and set the "Allow credential caching on RODCs" policy to Enabled. Add the four users to the policy, and link the policy to the Domain Controllers OU.

a. Assign the employee's account as a delegated administrator in the RODC's computer account settings.

You maintain an RODC running Windows Server 2016 at a branch office, and you want one employee with solid computer knowledge to perform administrative tasks, such as driver and software updates and device management. How can you do this without giving her broader domain rights? a. Assign the employee's account as a delegated administrator in the RODC's computer account settings. b. Create a local user on the RODC, and add it to the Administrators group. Have the user log on with this account when necessary. c. Create a script that adds the user to the Domain Admins group each day at a certain time, and then removes the user from the group one hour later. Tell the user to log on and perform the necessary tasks during the specified period. d. Send the user to extensive Windows Server 2016 training, and then add the user to the Domain Admins group.

c. Create the computer account for the RODC in the Domain Controllers OU, and specify Michael's account as one that can join the computer to the domain.

You need to install an RODC in a new branch office and want to use an existing workgroup server running Windows Server 2016. The office is a plane flight away and is connected via a WAN. You want an employee at the branch office, Michael, to do the RODC installation because he's good at working with computers and following directions. What should you do? a. Add Michael to the Domain Admins group, and give him directions on how to install the RODC. b. Add Michael's domain account to the Administrators group on the server, and give him directions on how to install the RODC. c. Create the computer account for the RODC in the Domain Controllers OU, and specify Michael's account as one that can join the computer to the domain. d. Create a group policy that specifies that Michael's account can join RODCs to the domain. Then use the Delegation of Control Wizard on the Domain Controllers OU.

d. Enable universal group membership caching.

You want to decrease users' logon time at SiteA but not increase replication traffic drastically. You have 50 users at this site with one domain controller. Overall, your network contains 3000 user and computer accounts. What solution can decrease logon times with the least impact on replication traffic? a. Configure the domain controller as a domain naming master. b. Configure the domain controller as a global catalog server. c. Configure multiple connection objects between the domain controller in SiteA and a remote global catalog server. d. Enable universal group membership caching.

a. Transfer the RID master role to the new domain controller, and then shut down the old server.

You're taking an older server performing the RID master role out of service and will be replacing it with a new server configured as a domain controller. What should you do to ensure the smoothest transition? a. Transfer the RID master role to the new domain controller, and then shut down the old server. b. Shut down the current RID master and seize the RID master role from the new domain controller. c. Back up the domain controller that's currently the RID master, restore it to the new domain controller, and then shut down the old RID master. d. Shut down the current RID master, and then transfer the RID master role to the new domain controller.

d. Create a temporary folder and a backup folder. Stop the Active Directory service. Run ntdsutil and compact the database in the temporary folder. Copy the original data-base to the backup folder, and delete the ntds log files. Copy the ntds.dit file from the temporary folder to its original location. Verify the integrity of the new database, and restart the Active Directory service.

Your Active Directory database has been operating for several years and undergone many object creations and deletions. You want to make sure it's running at peak efficiency, so you want to defragment and compact the database. What procedure should you use that will be least disruptive to your network? a. Create a temporary folder to hold a copy of the database. Restart the server in DSRM. Run ntdsutil and compact the database in the temporary folder. Copy the ntds.dit file from the temporary folder to its original location. Verify the integrity of the new database, and restart the server normally. b. Create a temporary folder and a backup folder. Stop the Active Directory service. Run ntdsutil and compact the database in the temporary folder. Copy the original data-base to the backup folder, and delete the ntds log files. Copy the ntds.dit file from the temporary folder to its original location. Verify the integrity of the new database, and restart the server. c. Create a temporary folder and a backup folder. Restart the server in DSRM. Run ntdsutil and compact the database in the temporary folder. Copy the original data-base to the backup folder, and delete the ntds log files. Copy the ntds.dit file from the temporary folder to its original location. Verify the integrity of the new database, and restart the Active Directory service. d. Create a temporary folder and a backup folder. Stop the Active Directory service. Run ntdsutil and compact the database in the temporary folder. Copy the original data-base to the backup folder, and delete the ntds log files. Copy the ntds.dit file from the temporary folder to its original location. Verify the integrity of the new database, and restart the Active Directory service.

c. Create a snapshot and export the accounts with ldifde.

Your company has had a major reorganization, and you need to transfer several hundred user accounts to another domain. Which of the following can help with this task? a. Create a system state backup and restore ntds.dit to the new domain. b. In Active Directory Users and Computers, select each account and export it. c. Create a snapshot and export the accounts with ldifde. d. Use the Export-ADUser PowerShell cmdlet.