CIS 193 - 70-412 - Active Directory - Infrastructure Testout Practice Questions
Create a site link named Chicago-NY and put the Chicago and New York sites into it. Increase the site link cost for the Chicago-NY site link to 250.
This question includes an image to help you answer the question. You are the network administrator for a company with a single Active Directory domain. The domain and forest functional levels are running Windows Server 2012 R2. The company headquarters is located in Los Angeles, and its three branch offices are located in Denver, Chicago, and New York. There are high speed WAN links that connect all of the branch offices to the corporate headquarters. The Chicago and New York offices also have a separate WAN link between them that should be used only when the connection to Los Angeles is unavailable. There is an Active Directory site configured for each office location, and all sites are connected by the default site link. You notice that there is more replication traffic across the WAN links than there should be, and you decide to create separate site links for the connections between the branch offices and the corporate headquarters. You create site links named Denver-LA, Chicago-LA, and NY-LA, and you disable the Bridge all sites option. After you place each site into its respective site link, the WAN link between Chicago and Los Angeles fails, and you discover that replication between Chicago and New York isn't working across the backup link. What should you do? (Choose two. Each correct answer is part of the solution.) Increase the site link cost for the Chicago-NY site link to 150. Create a site link named Chicago-NY and put the Chicago and New York sites into it. Increase the site link cost for the Chicago-NY site link to 250. Create a site link named Chicago-NY and put the Chicago, New York, and Los Angeles sites into it.
Run repadmin /replicate DC2 DC1.
You are an administrator for the northsim.com domain. The domain has two domain controllers, DC1 and DC2. DC1 is located in the main office, and DC2 is located in a branch office. You work in the branch office and manage the network there. The main office is connected to the branch office with a WAN link. A site object has been created for each location. The DEFAULTIPSITELINK object connects the two locations. To reduce WAN traffic, replication between sites occurs between 8 PM and 5 AM. The branch office has recently hired three new employees. An administrator in the main office has created the user accounts. However, users are unable to log on. You need to make sure the users can log on as soon as possible. What should you do? Run dfsrmig /setglobalstate 2. Run gpupdate /force. Run repadmin /replicate DC1 DC2. Run repadmin /replicate DC2 DC1.
On westsim.com, configure an incoming trust to eastsim.com
You are an enterprise administrator for WestSim Corporation. Because of a recent merger, the network has two forests: westsim.com and eastsim.com. You have a user account in the westsim.com domain. You want to be able to access resources in the eastsim.com domain. You do not want users in the eastsim.com domain to access resources in the westsim.com domain. What should you do? Configure a two-way trust between westsim.com and eastsim.com. On westsim.com, configure an outgoing trust to eastsim.com. On westsim.com, configure an incoming trust to eastsim.com.
Create a one-way external trust where the westsim.com domain trusts the eastsim.com domain
You are the administrator for the Westsim Corporation. The network has a single domain, westsim.com, running at the Windows Server 2008 functional level. Five domains controllers, all running Windows Server 2008 R2 or Windows Server 2012 R2, are located on the network. Your company recently merged with the EastSim Corporation. Their network has a single Active Directory domain running at the Windows 2003 forest functional level. For now, you need to maintain the eastsim.com domain as a separate forest. Users in eastsim.com need access to resources in the westsim.com domain. However, users in westsim.com should not have access to any resources in the eastsim.com domain. What should you do? Create a one-way external trust where the westsim.com domain trusts the eastsim.com domain. Create a two-way external trust between eastsim.com and westsim.com. Create a forest trust between westsim.com and eastsim.com. Create a one-way external trust where the eastsim.com domain trusts the westsim.com domain.
Configure eastsim.com to have a one-way outgoing forest trust with westsim.com. Configure the trust to use selective authentication and grant Domain Users from westsim.com the Allowed to Authenticate permission on the FS1 computer account.
You are the administrator of an Active Directory domain, eastsim.com, which is at the Windows 2008 R2 functional level. Your company has recently acquired a competitor who has an Active Directory domain, westsim.com, which is running at the Windows 2003 functional level. You have access to an administrator account in the westsim.com domain. You need to allow users in westsim.com to access shared folders on FS1 in the eastsim.com domain. You want to make sure that the shared folders on FS1 are the only resources in your domain that the westsim.com users can access. What should you do? Configure eastsim.com to have a one-way incoming forest trust with westsim.com Configure permissions on all shares in eastsim.com so the only shares the westsim.com users can access are the shares on FS1. Configure eastsim.com to have a one-way incoming external trust with westsim.com. Configure the trust to use selective authentication and grant users from westsim.com the Allowed to Authenticate permissions on the FS1 account. Configure eastsim.com to have a one-way outgoing forest trust with westsim.com. Configure the trust to use selective authentication and grant Domain Users from westsim.com the Allowed to Authenticate permission on the FS1 computer account. Configure eastsim.com to have a one-way outgoing external trust with westsim.com. Configure permissions on all shares in eastsim.com so the only shares the westsim.com users can access are the shares on FS1.
Use Active Directory Users and Computers or Active Directory Domains and Trusts to raise the domain functional level. Use Active Directory Domains and Trusts to raise the forest functional level.
You are the manager of a multiple domain network. You need to raise the domain and forest functional levels. Which tools can you use? (Select 2) Use Active Directory Users and Computers or Active Directory Domains and Trusts to raise the domain functional level. Use Active Directory Users and Computers or Active Directory Domains and Trusts to raise the forest functional level. Use Active Directory Domains and Trusts or Active Directory Sites and Services to raise the forest functional level. Use Active Directory Domains and Trusts to raise the forest functional level. Use Active Directory Users and Computers or Active Directory Sites and Services to raise the domain functional level.
Create an external trust
You are the network administrator for Corpnet.com. Corpnet.com has two Active Directory domains, named corpnet.com and production.corpnet.com. They also have a development domain in a separate forest, named development.corpnet.net. You need to configure the Active Directory environment to meet the following requirements: - Users in the development.corpnet.net domain must be able to access resources in the production.corpnet.com domain. - Users in the development.corpnet.net domain must not be able to access resources in the corpnet.com domain. - Users in the production.corpnet.com and the corpnet.com domains must not be able to access resources in the development.corpnet.net domains. What should you do? Create a cross-forest trust. Create a shortcut trust. Create an external trust. Create a realm trust.
Modify the Properties of the File1 computer account in Active Directory Users and Computers
You are the network administrator for Corpnet.com. Corpnet.com uses a vendor named Partner.com. You create a cross-forest trust with Selective Authentication between the corpnet.com Active Directory forest and the partner.com Active Directory forest. On a file server named File1, you create a share named Share1 and assign the following permissions: - Partner\SalesUsers - Allow-Modify NTFS permissions - Partner\SalesUsers - Allow-Full Control share permissions. Users in the Partner\SalesUsers group report that they cannot connect to the \\File1\Share1 share. You need to ensure that the users in the Partner\SalesUsers group can connect to the share and modify data. What should you do? Modify the name suffix routing on the cross-forest share between the two forests. Modify the share permissions on the \\File1\Share1 share. Modify the NTFS permissions on the \\File1\Share1 share. Modify the Properties of the File1 computer account in Active Directory Users and Computers.
Modify the name suffix routing list on the existing cross-forest trust
You are the network administrator for Corpnet.com. The Corpnet.com forest has three Active Directory domains: corpnet.com, sales.corpnet.com, and development.corpnet.com. Corpnet.com has a relationship with a vendor named Partner.com. The Partner.com forest has two Active Directory domains: partner.com and support.partner.com. There is currently a cross-forest trust configured between the two forests. Partner.com has just added a new child domain named operations.partner.com. You need to ensure that users in the new child domain will be able to access resources in all of the domains in the Corpnet.com forest. Users in all of the domains in the Corpnet.com forest will also need to access resources in the operations.partner.com domain. What should you do? Disable SID Filtering on the existing cross-forest trust. Change the existing cross-forest trust to use Forest-Wide authentication. Modify the name suffix routing list on the existing cross-forest trust. Create an external trust between the forest root domain in the Corpnet.com forest and the operations.partner.com domain.
Configure the Options attribute on the new link. Configure the Cost on the new link. Remove the Branch1 office from the DEFAULTIPSITELINK. Create a new IP Site Link and add the main office and the Branch1 office to the new link.
You are the network administrator for Corpnet.com. The company has a main office and four branch offices. All of the servers run Windows Server 2012 R2. All of the sites have been added to the DEFAULTIPSITELINK object which is set to replicate every 15 minutes. The Branch1 office contains one domain controller: DC3. The WAN link between the main office and the Branch1 office has excellent bandwidth and very low latency. You frequently update the user accounts for users located at the Branch1 office and encounter conflicts that require you to force replication. You need to enable replication between the main office and the Branch1 office to occur more frequently than every 15 minutes. The change must not affect replication between the main office and the other branch offices. What should you do? (Choose 3.) Adjust the Frequency on the DEFAULTIPSITELINK. Adjust the Frequency on the new link. Configure the Options attribute on the new link. Configure the Cost on the new link. Remove the Branch1 office from the DEFAULTIPSITELINK. Configure the Options attribute on the DEFAULTIPSITELINK. Change the Cost on the DEFAULTIPSITELINK. Create a new IP Site Link and add the main office and the Branch1 office to the new link.
Increase the cost of the site link between Branch1 and Branch2.
You are the network administrator for Corpnet.com. The company has a main office and two branch offices named Branch1 and Branch2. The main office has two domain controllers named DC1 and DC2. The Branch1 branch office has one domain controller named DC3. There are no domain controllers at the Branch2 location. In Active Directory Sites and Services, you have created a site that corresponds to each location. You have also created IP site links between each site. You discover that users from Branch2 are being authenticated by all three domain controllers. You need to ensure that users in Branch2 are only authenticated by DC1 or DC2. Users in Branch2 should only be authenticated by DC3 if the domain controllers at the main office are unavailable. What should you do? On DC3, set AutoSiteCoverage to 0. Associate the subnet object for Branch2 to the Branch1 site. On DC1 and DC2, set AutoSiteCoverage to 0. Increase the cost of the site link between Branch1 and Branch2.
In Active Directory Sites and Services, move the DC3 computer object.
You are the network administrator for Corpnet.com. The company has a main office that has two domain controllers named DC1 and DC2. The company plans to deploy a new domain controller named DC3 to a branch office. You have created a new site in Active Directory named Branch1. You create a subnet object and associated it with the new site, and then create an IP site link object between the main office and the branch office. At the main office, you install Windows Server 2012 R2 on the new server and promote it to a domain controller. The server is then shipped to the branch office where the local administrator assigns an appropriate IP address to the server. You discover that some users at the branch office continue to be authenticated by the domain controllers at the main office. You need to ensure that users at the branch office are only authenticated by DC1 or DC2 if DC3 is unavailable. What should you do? Configure DC3 to be the preferred bridgehead server for the branch office. On DC1 and DC2, set AutoSiteCoverage to 0. In Active Directory Sites and Services, move the DC3 computer object. Modify the cost of the site link object between the main office and the branch office.
n the SRV records for DC3, change the Priority to 1. In the SRV records for DC2, change the Weight to 50. In the SRV records for DC1, change the Weight to 50.
You are the network administrator for Corpnet.com. The company has one branch office. There are three domain controllers at the branch office: DC1, DC2, and DC3. You need to deploy a custom database to DC3 for testing purposes. During the development period, you do not want DC3 to authenticate users unless DC1 and DC2 are unavailable. You need to configure DNS to distribute user authentication requests between DC1 and DC2. DC3 should only authenticate users if DC1 and DC2 are unavailable. What should you do? (Choose three.) In the SRV records for DC3, change the Priority to 1. In the SRV records for DC2, change the Weight to 50. In the SRV records for DC1, change the Weight to 50. In the SRV records for DC1, change the Priority to 1. In the SRV records for DC3, change the Weight to 50. In the SRV records for DC2, change the Priority to 1.
Create a shortcut trust
You are the network administrator for Corpnet.com. Users in the sales.us.corpnet.com domain frequently need to access shares in sales.eu.corpnet.com, but report that it often takes a long time to be authenticated when accessing the shares. You need to reduce the amount of time it takes the users in sales.us.corpnet.com to be authenticated in sales.eu.corpnet.com. What should you do? Change the share rights on the shares in the sales.eu.corpnet.com domain. Change the NTFS rights on the shares in the sales.eu.corpnet.com domain. Create an external trust. Create a shortcut trust.
Configure a new site link that contains the slow connection sites and the corporate headquarters site and configure an appropriate interval and schedule. Remove the slow connection sites from the default site link.
You are the network administrator for a company with a single Active Directory domain. The company headquarters is located in Boston, and fifteen branch offices exist across the United States. Currently, one Active Directory site is configured for each branch office location. All sites are connected by the default site link. You notice that the default replication interval is too infrequent, and you decide to decrease the interval to 30 minutes. After doing this, several branch office locations with slow WAN links report that replication traffic is interfering with other critical network traffic. You need to ensure that the sites with slow WAN links are not bothered by replication during the normal work hours of 8:00 a.m. to 5:00 p.m., and that the other sites with better connections continue receiving replication at the reduced interval. What should you do? (Choose two. Each correct choice is part of the solution.) Change the schedule for the default site link to only replicate after work hours. Configure a new site link that contains the slow connection sites and the corporate headquarters site and configure an appropriate interval and schedule. Remove the slow connection sites from the default site link. Configure SMTP replication for the sites with slow WAN links.
Create subnets for the new floors in the Boston office and link them to the Boston site.
You are the network administrator for a company with a single Active Directory domain. The corporate office is located in Miami, and there are satellite offices in Boston and Chicago. There are Active Directory sites configured for all three geographic locations. The Default-First-Site-Name was renamed to become the Miami site. Each location has a single IP subnet configured and associated with the appropriate site. Each office has several domain controllers. The Boston office has recently expanded to three additional floors in the office building that they are in. The additional floors each have their own IP subnet and are connected by a router. The domain controllers for the Boston office are all located on one floor and are in the same subnet. You notice that the users working on the new floors in the Boston office are sometimes authenticating to domain controllers from other locations. You need to make sure that all authentication traffic over the WAN links is kept to a minimum. What should you do? Create subnets for the new floors in the Boston office and link them to the Boston site. Create a new Active Directory site for each new floor in the Boston office and move at least one of the domain controllers into each new site. Disable the bridge all sites option in the properties of IP inter-site transports. Remove the DNS records for the domain controllers in the other sites from the Boston DNS servers.
Make the domain controller in New York a global catalog server. Create two sites, one called Los Angeles and one called New York. Assign the IP subnet in use at each location to the appropriate site.
You are the network administrator for a network with a single Active Directory domain and the default site configuration. Your domain consists of three domain controllers, two at the company headquarters in Los Angeles and one in New York. Active Directory Domains and Trusts shows that all three domain controllers are replicating without errors. You have implemented a group structure using Microsoft's recommendation. You have global groups, which are members of universal groups, which are then members of domain local groups. You have assigned permissions to the domain local groups. Users in Los Angeles are not reporting any difficulties logging in and accessing local resources. However, users in New York report that login is very slow and that resource access is also very slow, even for local resources. You want to improve login and resource access performance for New York users. What should you do? (Choose two. Each answer is part of the solution.) Create a GPO named Logon that grants the Log on Locally user right. Link the Logon GPO to the Domain Controllers OU. Create a GPO named Logon that grants the Log on Locally user right. Link the Logon GPO to the Los Angeles and the New York sites. Make the domain controller in New York a global catalog server. Create two sites, one called Los Angeles and one called New York. Assign the IP subnet in use at each location to the appropriate site.
Enable Universal Group Membership Caching for the Denver and Miami sites.
You are the network administrator for a network with a single Active Directory forest. All domains in the forest are at Windows Server 2008 functional level, and the forest is also at a Windows Server 2008 functional level. Offices are located in Denver, Chicago, and Miami. Each geographic location has an Active Directory site configured. The links that connect the Denver and Miami sites to the corporate headquarters in Chicago are highly utilized, and you want to minimize replication traffic over them. Company headquarters is located in Chicago, and that location has multiple global catalog servers to service global queries efficiently. Several users in Denver and Miami are members of universal groups throughout the forest. You need to make sure that, in the event of a WAN link failure, group membership will be protected and logons will be available. What should you do? Create a new global catalog server in the Denver and Miami sites. Move two global catalog servers from the Chicago site to the Denver and Miami sites. Enable Universal Group Membership Caching for the Denver and Miami sites. Enable Universal Group Membership Caching for the Chicago site.
Configure a shortcut trust between the research.westsim.com domains and the support.westsim.com domain.
You are the network administrator for a network with a single Active Directory forest. The forest root domain name is westsim.local, and there are two child domains named support.westsim.local and research.westsim.local. Branch offices are located in Denver and Chicago. The corporate headquarters is located in Dallas. The Denver site has domain controllers from the support.westsim.local domain and research.westsim.local domains. Workstation computer accounts and user accounts for the Denver location are members of the research.westsim.local domain. Some file servers in the Denver site are members of the support.westsim.local domain and are used by Denver users. You notice that authentication traffic is saturating the WAN links between Dallas and the two other offices. You want to decrease authentication traffic over the WAN link. What should you do? Move the file server computer accounts to the Denver domain. Move the user accounts to the support.westsim.com domain. Configure a shortcut trust between the research.westsim.com domains and the support.westsim.com domain. Configure one of the domain controllers in the Denver site as a global catalog server.
Create a two-way forest trust between the northsim.com forest and the southsim.com forest. Enable Selective Authentication for the northsim.com forest.
You are the network administrator for an Active Directory forest with a single domain named northsim.com. All domain controllers are running Windows Server 2012 R2. Your company has just acquired a company that has an Active Directory forest with one Windows 2008 domain named southsim.com. The current structure of both forests must be retained for now. You need to design trusts between the domains or forests to meet the following requirements: - Users in the northsim.com domain must be able to use the resources in the southsim.com domain. - Users in the southsim.com domain should not be able to use resources in the northsim.com domain, with the exception of selected management personnel who will be allowed access to reports on one of the servers in the northsim.com domain. - You would like to minimize the number of trusts created and the amount of effort needed to maintain the trusts. What should you do? (Choose two.) Create a two-way shortcut trust between the northsim.com domain and the southsim.com domain. Create a two-way forest trust between the northsim.com forest and the southsim.com forest. Create a two-way realm trust between the northsim.com domain and the southsim.com domain. Enable Selective Authentication for the southsim.com forest. Create a one-way external trust pointing from the northsim.com domain to the southsim.com domain. Enable Selective Authentication for the northsim.com forest.
Designate the domain controllers at sites 2 and 3 as global catalog servers.
You are the network administrator for an Active Directory forest with a single domain. The network has three sites with one domain controller at each site. You have created and configured sites in Active Directory Sites and Services, and replication is operating normally between sites. You configure two universal groups for use in securing the network. All users are members of one universal group or the other. After configuring the universal groups, users at sites 2 and 3 report slow login and slow access to the corporate database. Users at site 1 can log in and access the corporate database with acceptable performance. You want to improve login and resource access performance for users in sites 2 and 3. What should you do? Edit the site link objects between sites 1 and 2 and between sites 2 and 3. Decrease the replication interval. Change the IP address scheme so that all users are on the IP subnet of site 1. Create site link bridges between sites 1 and 2 and between sites 1 and 3. Designate the domain controllers at sites 2 and 3 as global catalog servers.
Install a Read-Only Domain Controller (RODC) in each branch office. Configure the hard drive to use Bitlocker drive encryption.
You are the network administrator for northsim.com, a company that specializes in extreme sports vacations. The company has one main office and 30 branch offices. All of the branch offices have 3 to 10 users on location, and all of them are located in remote areas of the country. Due to the need to be located near natural resources, many of the branch offices lack basic security and almost all of them are connected to the main office via dial-up. Users at the branch offices complain that it takes a long time to log on to the domain. Management has authorized the purchase and deployment of one Windows Server 2012 R2 server for each branch office. You have been asked to develop a standard installation for the new servers being deployed. Your solution must meet the following requirements: • Each branch office server should perform authentication for users located at that branch office. • Each branch office server should be configured so as to minimize the amount of Active Directory information that will be compromised in the event that the server is stolen. • Each branch office server should be configured so as to minimize the amount of user data that will be compromised in the event that the server is stolen. What should you do? Install a Read-Only Domain Controller (RODC) in each branch office. Configure all of the files on the hard drive to use the Encrypting File System (EFS). Install a Read-Only Domain Controller (RODC) in each branch office. Configure the hard drive to use Bitlocker drive encryption. Install a writable domain controller in each branch office. Configure the hard drive to use Bitlocker drive encryption. Install a writable domain controller in each branch office. Configure all of the files on the hard drive to use the Encrypting File System (EFS).
You should use the Repadmin /rodcpwdrepl command.
You are the network administrator for southsim.com. The network consists of a single Active Directory domain. All of the servers run Windows Server 2012 R2. All of the clients run Windows 7 or Windows 8. southsim.com has one main office and five branch sites. The main office has two writable domain controllers. All of the branch offices have a local read-only domain controller (RODC). A branch office user named Henry Higgins calls to have his password reset. After you reset his password, the user attempts to log on to the domain, but is unsuccessful. You need to force replication of the user's password to the branch office RODC. Company policy states that replication traffic to the branch offices during business hours must be kept to a minimum. You must replicate only the user's changed password from the main office to the RODC. What should you do? You should use the Repadmin /syncall command. You should use Active Directory Sites and Services to force replication. You should use the NTDSUtil command. You should use the Repadmin /rodcpwdrepl command.
Get-ADDomainControllerPasswordReplicationPolicyUsage
You are the network administrator for westsim.com. The network consists of a single Active Directory domain. All of the servers run Windows Server 2012 R2 and all of the clients run Windows 7 or Windows 8. The company has a branch office in Atlanta that has a read-only domain controller (RODC) named ATLRODC1. Management has requested a list of the users who have been authenticated by ATLRODC1 in the past and whose user accounts are cached on the RODC. What command should you use? Get-ADAccountResultantPasswordReplicationPolicy Get-ADDomainControllerPasswordReplicationPolicy Get-ADUser Get-ADDomainControllerPasswordReplicationPolicyUsage
Set the autositecoverage setting on LADC1 to 0.
You are the network administrator for westsim.com. The network consists of a single Active Directory domain. All the servers run Windows Server 2008 R2. All the clients run Windows 7. There are three Active Directory sites; New York, Chicago, and Los Angeles. The New York site contains one domain controller named NYDC1. The Los Angeles site contains one domain controller named LADC1. The Chicago site does not contain any domain controllers. There are partial T1 links between the New York site and the Chicago site, and between the Los Angeles site and the Chicago site. The appropriate site link objects have been configured and the cost for both site links has been set to 100. You determine that users from the Chicago office are being authenticated by the domain controller in Los Angeles. However, the domain controller in New York has more resources available, and management has determined that the domain controller in New York should be used to authenticate all Chicago users. You need to configure Active Directory so that the domain controller in Los Angeles will not be used to authenticate users from the Chicago site. What should you do? Set the autositecoverage setting on NYDC1 to 0. Set the autositecoverage setting on NYDC1 to 1. Set the autositecoverage setting on LADC1 to 1. Set the autositecoverage setting on LADC1 to 0.
Create a new Active Directory site. Create a new subnet object using the 172.16.2.4/32 subnet. Move TNDC2 to the new site.
You are the network administrator for westsim.com. The network consists of a single Active Directory domain. There is one main office located in New York, and several branch offices, including one in Chattanooga, TN. All of the clients in the Chattanooga, TN are configured using DCHP and obtain addresses in the 172.16.0.0/16 subnet, with the scope ranging from 172.16.3.1 to 172.16.3.254. There are two domain controllers in the Chattanooga office named TNDC1 and TNDC2. TNDC1 has a static IP address of 172.16.2.3/16 and TNDC2 has a static IP address of 172.16.2.4/16. During the course of an IT audit, you notice that users authenticated by TNDC2 experience significant logon delays. You order a new server to replace TNDC2. As a temporary fix, you would like to ensure that all users in the Chattanooga, TN site are authenticated by TNDC1. The solution should enable users to be authenticated by TNDC2 only if TNDC1 fails. What should you do? Change the IP address on TNDC2 to 172.16.2.3/24. Create a new Active Directory site. Create a new subnet object using the 172.16.2.4/32 subnet. Move TNDC2 to the new site. Change the IP address on TNDC2 to 172.16.3.254/16. Create a new Active Directory site. Create a new subnet object using the 172.16.2.3/32 subnet. Move TNDC1 to the new site.
Install Active Directory Domain Services (AD DS) using the Install from Media feature and configure the read-only domain controller (RODC) option.
You are the network administrator for westsim.com. westsim.com has one main office and 50 branch offices. The network consists of one Active Directory domain that contains 5,000 users. You plan to deploy a Windows 2012 R2 domain controller in each branch office. Ten of the branch offices do not employ on-site IT staff. You need to recommend a solution for these 10 branch offices. Your solution must meet the following requirements: • Minimize network traffic during the installation of Active Directory Domain Services (AD DS). • Maximize the security of the branch office domain controllers. What should you recommend? Install a Server Core installation of Windows Server 2012 R2, and then install Active Directory Domain Services (AD DS) using the Install from Media feature. Install Active Directory Domain Services (AD DS) using the Install from Media feature and configure the read-only domain controller (RODC) option. Install Active Directory Domain Services (AD DS) and configure the read-only domain controller (RODC) option. Enable Universal Group Membership Caching on each branch office site. Install Active Directory Domain Services (AD DS) and then configure the Global Catalog option.
Create a new site object in Active Directory and move the server object for the Dallas domain controller into the new site.
You are the network administrator of a network that spans two locations: Atlanta and Dallas. Atlanta and Dallas are connected using a dedicated WAN link. The Atlanta location is also connected to the Internet. A single Active Directory domain spans both locations, and each location has a single domain controller. You have not used the Active Directory Sites and Services snap-in to make any changes to the default configuration. Users in Dallas complain that at certain times, Internet access is very slow. After monitoring the network traffic across the WAN link, you discover that the slow performance occurs after making any major changes to Active Directory. What is the first step for solving this problem? Create a new Active Directory domain for the Dallas location. Create a new site object in Active Directory and move the server object for the Dallas domain controller into the new site. Configure the replication schedule for the DEFAULTIPSITELINK site link object to exclude working hours. Create a Computer object in the Dallas OU.
Create two Site Link objects representing the T1 and dial-up connections. Configure the T1 Site Link object with a lower cost than the dial-up Site Link object.
You are the network administrator of a network that spans two locations: Atlanta and Dallas. The network has only one Active Directory domain, named company.local. The Atlanta and Dallas locations are connected using a T1 line. You have also configured an on-demand dial-up connection between the two locations, which should be used only for backup if the T1 line becomes unavailable. You create two site objects named Atlanta and Dallas using the Active Directory Sites and Services snap-in. How should you configure Active Directory to perform replication over the T1 line rather than the dial-up connection? Create two Site Link objects representing the T1 and dial-up connections. Configure the T1 Site Link object with a lower cost than the dial-up Site Link object. Create two Site Link objects representing the T1 and dial-up connections. Configure the replication schedule of the T1 Site Link object to include every hour, every day. Configure the replication schedule of the dial-up Site Link object to exclude every hour, every day. Create two Site Link objects representing the T1 and dial-up connections. Configure the T1 Site Link object with a higher cost than the dial-up Site Link object. Create two Site Link objects representing the T1 and dial-up connections. Keep the default replication interval for the T1 Site Link object, but change the replication interval of the dial-up Site Link object to 0.
Configure the new server as a preferred bridgehead server for its site.
You are the network administrator of a network with a single Active Directory forest. The forest root domain is named westsim.local and there are two child domains named europe.westsim.local and asia.westsim.local. All domain controllers are running Windows Server 2008 R2 or Windows Server 2012 R2. Your network has five Active Directory sites in the U.S., six in Europe, and three in Asia. All sites in Europe have two domain controllers from the europe.westsim.local domain and one domain controller from the westsim.local domain. Several sites in Europe are using outdated hardware for their domain controllers, and you have decided to update them. You install and configure a new domain controller for an office in Europe and move the server into the correct site. After several days, you notice that the new server is not being utilized for replication between sites. What should you do? Force the KCC to recalculate the replication connections. Register the new server's IP address and name in DNS. Configure the new server as a preferred bridgehead server for its site. Manually create a connection from the new server to servers from the other sites.
Configure the new server as a preferred bridgehead server for its site.
You are the network administrator of a network with a single Active Directory forest. The forest root domain is named westsim.local, and there are two child domains named europe.westsim.local and asia.westsim.local. All domain controllers are running Windows Server 2008 or Windows Server 2012 R2. Your network has five Active Directory sites in the U.S., six in Europe, and three in Asia. All sites in Europe have two domain controllers from the europe.westsim.local domain and one domain controller from the westsim.local domain. Several sites in Europe are using outdated hardware for their domain controllers, and you have decided to update them. You install and configure a new domain controller for an office in Europe and move the server into the correct site. After several days, you notice that the new server is not being utilized for replication between sites. What should you do? Register the new server's IP address and name in DNS. Manually create a connection from the new server to servers from the other sites. Force the KCC to recalculate the replication connections. Configure the new server as a preferred bridgehead server for its site.
Configure a site link to represent the dial-up connection between Toronto and Washington D.C. Configure the site link cost to be 150. Configure a site link to represent the high-speed connection between Toronto and Washington D.C.. Configure the site link cost to be 50.
You are working for a company that has a large Active Directory network with locations in New York City, Washington D.C., Seattle, Miami, and Des Moines. The company has just opened an office in Toronto. You are responsible for bringing the new Toronto site online. The Toronto and Washington locations are connected with a high-speed WAN link. A dial-up connection has also been configured between the two locations. You need to configure new site links to accommodate the Toronto office. What should you do? (Choose two. Each correct choice is part of the solution.) Configure a site link to represent the dial up connection between Toronto and Washington D.C. Configure the site link cost to be 50. Configure a site link to represent the high-speed connection between Toronto and Washington D.C. Configure the site link cost to be 150. Configure a site link to represent the dial-up connection between Toronto and Washington D.C. Configure the site link cost to be 150. Configure a site link to represent the high-speed connection between Toronto and Washington D.C.. Configure the site link cost to be 50.
In Active Directory Sites and Services, force replication between a Washington, D.C. domain controller and a Toronto domain controller.
You are working for a company that has a large Active Directory network with locations in New York City, Washington, D.C., Seattle, Miami, and Des Moines. The company has just opened an office in Toronto. You are responsible for bringing the new Toronto site online. You configure a site link to represent the connection between Toronto and Washington, D.C. You make the site link available between 7 pm and 5 am only. You configure the replication interval at 180 minutes. The link between Toronto and Washington, D.C. appears to work as expected and has been operating for several days without any apparent problems. On Monday morning at 9:00 am you publish a new printer named ColorLaser to Active Directory. At noon, a user calls from Toronto to say that a print job must be sent to the new color printer, but the printer does not show up in Active Directory. You instruct the user to be patient, and check again in an hour. One hour later, the user calls back and still cannot see the printer. You think there is a problem with replication. You want the Toronto user to have access to the printer from Active Directory as quickly as possible. What should you do? Check the communication channel to make sure the connection is available. Tell the user to check for the printer in the morning. Edit the site link that represents the connection between Toronto and Washington, D.C. Set the replication interval to 0 minutes. In Active Directory Sites and Services, force replication between a Washington, D.C. domain controller and a Toronto domain controller. Edit the site link that represents the connection between Toronto and Washington, D.C. Configure the site link to be available always.
Configure the site link between Toronto and Washington, D.C. to be available between 7 pm and 5 am.
You are working for a company that has a large Active Directory network with locations in New York City, Washington, D.C., Seattle, Miami, and Des Moines. The company has just opened an office in Toronto. You are responsible for bringing the new Toronto site online. You have created a site link to represent a high-speed connection between Washington, D.C. and Toronto. You anticipate that the link between these two cities will be used heavily during normal Eastern Time Zone business hours (5 am to 7 pm). You need to configure replication between Toronto and Washington, D.C. and minimize the impact of replication traffic during business hours. What should you do? Configure the site link between Toronto and Washington, D.C. to use a replication interval between 180 minutes to 240 minutes. Do not schedule replication. Configure the site link between Toronto and Washington, D.C. to be available between 5 am and 7 pm. Configure the site link between Toronto and Washington, D.C. to be available between 7 pm and 5 am. Move any Toronto servers to the Washington, D.C. site. Delete the Toronto site and rely on intersite replication.
On the domain controller that is the schema master, run Adprep /forestprep
You currently manage a network with a single domain. The forest and domain functional level is at Windows Server 2008. All domain controllers run Windows Server 2008. You want to install a new domain controller running Windows Server 2012 R2 in the forest. Before doing so, you need to update the schema to support Windows Server 2012 R2 domain controllers. What should you do? On any domain controller in the forest, run Adprep /rodcprep. On the domain controller that is the schema master, run Regsrv32.schmmgmt.dll. On the domain controller that is the schema master, run Adprep /forestprep. On the domain controller that is the infrastructure master, run ADSIEdit.
Create a site and a subnet for the branch office. Use DS-RPC replication.
You manage a network with a single domain in a single location. Your company is opening a branch office that will be connected to the main office with a WAN link. You install a domain controller in the branch office. All domain controllers run Windows Server 2012 R2. You want to implement a solution that meets the following requirements: • You want to be able to schedule Active Directory replication between the main office and the branch office. • You want to minimize WAN traffic caused by Active Directory replication. • You want database errors to be automatically detected and corrected, if possible. What should you do? (Select two. Each choice is a required part of the solution.) Configure a domain-based DFS namespace. Create a folder with targets pointing to the SYSVOL folder on each domain controller. Create a site and a subnet for the branch office. Use SMTP replication. Use DS-RPC replication.
Raise the domain and forest functional levels.
You manage a single domain named eastsim.com. The domain currently has domain controllers running Windows Server 2003 and Windows Server 2008. The domain and forest are running in Windows 2000 native mode. You want to install a new domain controller into the existing domain. This domain controller will run Windows Server 2012 R2. What should be the first step of the installation? Run adprep /domain prep Raise the domain and forest functional levels Run dcpromo on the new server Run adprep /forestprep
Create a site for Seattle and a site that includes both the Portland and Boise locations.
You manage a single domain named southsim.com. The network has three locations: Seattle, Portland, and Boise. See the image for a diagram of the WAN links connecting each location as well as the number of users and domain controllers in each location. You need to configure Active Directory sites so that resource access and logon is localized for each location and WAN traffic is minimized. What should you do? Create a site that includes the Seattle and Boise locations, and a site for Portland. Create a single site that includes all three locations. Create three sites, one for each location. Create a site for Seattle and a site that includes both the Portland and Boise locations.
Enable Universal Group Membership Caching on the Orlando site.
You manage a single-domain network named northsim.com. Currently, all users are located at a single site in Miami. You are opening a branch office in Orlando. The Orlando office is connected to the Miami location using a dial-up connection and demand-dial routing. The link between offices is used only during the nighttime to synchronize sales information. About 50 full-time sales people work in the Orlando office. The branch office will have its own domain controller, ORD-DC1. You create a new site object for the Orlando office and move the server into that site. You create a site link object that connects the Orlando site to the Miami site. Users are reporting that logon is slow. You find that during logon, the WAN link must be established before logon is allowed. You want to improve logon for the Orlando location. What should you do? Make ORD-DC1 a global catalog server. Create a connection object between ORD-DC1 and a domain controller in the Miami site. Decrease the site link cost on the site link between Orlando and Miami. Enable Universal Group Membership Caching on the Orlando site.
dfsrmig /getmigrationstate
You manage a single-domain network with a domain named widgets.com. You have received funding to upgrade all of your domain controllers from Windows Server 2003 to Windows Server 2012 R2. You upgrade all domain controllers to Windows Server 2012 R2. You then set the domain and forest functional levels to Windows Server 2012 R2. You decide to migrate from FRS replication to DFS replication using a staged migration approach. During the migration, you run dfsrmig /setglobalstate 1 to start running DFS replication. After a few hours, you would like to be able to confirm that DFS replication has started on all domain controllers. Which command should you use? dfsrmig /showmigrationstate:prepared dfsrmig /getglobalstate dfsrmig /showglobalstate:redirected dfsrmig /getmigrationstate
dfsrmig /setglobalstate 0
You manage a single-domain network with a domain named widgets.com. You have received funding to upgrade all of your domain controllers from Windows Server 2003 to Windows Server 2012 R2. You upgrade all domain controllers to Windows Server 2012 R2. You then set the domain and forest functional levels to Windows Server 2012 R2. You decide to migrate from FRS replication to DFS replication using a staged migration approach. You start replication and progress to the point where both FRS and DFS replication are running. Because everything looks like it is working properly, you configure replication to now use only DFS replication. After a few days, you notice several replication errors. You decide that you want to configure replication so that only FRS replication is used (DFS replication will no longer operate). Which command should you use? dfsrmig /setglobalstate 0 dfsrmig /setglobalstate 1 dfsrmig /setglobalstate 2 dfsrmig /setglobalstate 3 dfsrmig /setglobalstate 4
On the eastsim.com domain, delete the outgoing trust.
You manage the eastsim.com forest with multiple domains. Your company has recently formed a partnership with the westsim.com forest which also has multiple domains. To facilitate sharing of information between locations, you create a two-way forest trust between eastsim.com and westsim.com. After several days, your boss informs you that your network should have access to the westsim.com resources, but they should not have access to your resources. You need to modify the trust relationships to accommodate the change. What should you do? On the eastim.com domain, delete the outgoing trust. On the eastsim.com domain, delete both trusts. Create an external incoming trust to westsim.com. On the eastsim.com domain, delete the incoming trust. On the eastsim.com domain, delete both trusts. Create an external outgoing trust to westsim.com.
Rejoin the computers listed in the rodcpw.txt file to the domain. Manually reset user account passwords for users listed in the rodcpw.txt file. Force users to change their passwords at the next logon.
You manage the network with a single Active Directory domain named eastsim.com. You have installed a read-only domain controller in your branch office. As part of the configuration, you added the Authenticated Users group and the Domain Computers group as members of the Allowed RODC Password Replication Group group. During a break in at the branch office, the RODC was stolen. You are concerned that the passwords can be extracted from the RODC. You delete the RODC account and choose to reset the passwords for user and computer accounts. You save the list of reset passwords to the rodcpw.txt file. You need to enable logon for users and computers. What must you do? (Select two. Each choice is a required part of the solution.) Manually reset user account passwords for all users in the domain. Force users to change their passwords at the next logon. Rejoin all computers to the domain. Rejoin the computers listed in the rodcpw.txt file to the domain. Manually reset user account passwords for users listed in the rodcpw.txt file. Force users to change their passwords at the next logon. Configure user accounts to force a password change at the next logon.
Prepopulate passwords on the RODC.
You manage the network with a single Active Directory domain named eastsim.com. You have installed a read-only domain controller in your branch office. As part of the configuration, you added the Sales Users group and the Sales Computers group as members of the Allowed RODC Password Replication Group group. You get a call from a user in the branch office saying that she can't log on. You verify that her user and computer accounts are members of the correct groups. You check and find that the WAN link to the branch office is down. You need to modify the configuration so that the user can log on even when the WAN link is down. What should you do? Prepopulate passwords on the RODC. Add the Sales Users group and the Sales Computers group to the password replication policy of the RODC. Reset the user account password. Reset the computer account. Add the user and the computer account directly to the password replication policy of the RODC.
Run adprep /forestprep. Install a Windows Server 2012 R2 domain controller. Move the PDC emulator role to this server.
You manage the network with a single Active Directory domain named eastsim.com. All domain controllers run Windows Server 2003. The domain functional level is at Windows Server 2003. You would like to install a read-only domain controller for the eastsim.com domain, to implement in a branch office. Which of the following must you do before installing the read-only domain controller? (Select two.) Raise the forest functional level to Windows Server 2012 R2. Raise the domain functional level to Windows Server 2012 R2. Run adprep /forestprep. Install a Windows Server 2012 domain controller. Move the infrastructure master role to this server. Install a Windows Server 2012 R2 domain controller. Move the PDC emulator role to this server.
Install a full domain controller in the main office, then install the read-only domain controller in the branch office.
You manage the network with a single Active Directory domain named eastsim.com. Domain controllers run both Windows Server 2003 and Windows Server 2012 R2. The domain functional level is at Windows Server 2003. Your company has recently opened a new branch office. You would like to create a new domain named branch1.eastsim.com for the branch office. You want to use a read-only domain controller for this domain. How should you install the RODC? Install a full domain controller in the branch office, then convert it to an RODC. Run Ntdsutil to create installation media. Install the RODC using the install from media option. Install a full domain controller in the main office, then install the read-only domain controller in the branch office. Install the read-only domain controller using an unattended installation. Include ReplicaOrNewDomain=domain in the answer file.
Run adprep /rodcprep
You manage the network with a single Active Directory domain named eastsim.com. Domain controllers run both Windows Server 2008 R2 and Windows Server 2012 R2. The domain functional level is at Windows Server 2008. You would like to install a read-only domain controller for the eastsim.com domain to implement in a branch office. What should you do first? Raise the domain functional level to Windows Server 2008 R2. Run adprep /rodcprep. Run adprep /forestprep. Raise the forest functional level to Windows Server 2008 R2.
Add the SalesGG group as a member of the Allowed RODC Password Replication Group group. Edit the RODC account properties. Add the SalesGG group to the password replication policy with Allow permission.
You manage the network with a single Active Directory domain named eastsim.com. Organizational units (OUs) have been created for each department. All user and computer accounts are members of the departmental OUs. For the Sales department, all users are members of the SalesGG global group. You have installed a read-only domain controller (RODC) in a branch office on a Server Core installation. The RODC is the only domain controller at the branch office. You want to configure the RODC to cache passwords only for members of the Sales team. No other passwords should be cached. What should you do? (Select two. Each choice is a possible solution.) Add the SalesGG group as a member of the Allowed RODC Password Replication Group group. Add the Allowed RODC Password Replication Group group as a member of the SalesGG group. Add the Sales OU as a member of the Allowed RODC Password Replication Group group. Edit the RODC account properties. Add the SalesGG group to the password replication policy with Allow permission.
Add the SalesGG group as a member of the Allowed RODC Password Replication Group group. Add the AccountingGG group to the password replication policy for Rodc2.
You manage the network with a single Active Directory domain named eastsim.com. Organizational units (OUs) have been created for each department. All user and computer accounts are members of the departmental OUs. For the Sales department, all users are members of the SalesGG global group. For the Accounting department, all users are members of the AccountingGG global group. You have two branch offices. • Branch1 has a single RODC named Rodc1. • Branch2 has a single RODC named Rodc2. You want to configure password caching so that passwords are cached for members of the Sales team at both locations. Passwords for the Accounting users should only be cached in Branch2. What should you do? Add the SalesGG and the AccountingGG groups as a members of the Allowed RODC Password Replication Group group. Add the SalesGG group as a member of the Allowed RODC Password Replication Group group. Add the AccountingGG group to the password replication policy for Rodc2. Add the SalesGG group to the password replication policy for Rodc2. Add the AccountingGG group as a member of the Allowed RODC Password Replication Group group. Add the SalesGG group to the password replication policy for Rodc2. Add the AccountingGG group to the password replication policy for Rodc1 and Rodc2.
Install a Read-only Domain Controller (RODC) in the branch office.
You manage the network with a single Active Directory domain named eastsim.com. Your company has a single office in Dallas. You open a second office in San Antonio. The San Antonio location is connected to the Dallas location by a WAN link. All user and computer accounts in the branch office are members of the eastsim.com domain. You do not install a domain controller in the branch office. Recently, the WAN connection between Dallas and San Antonio went down. During the outage, several problems existed because of the lack of a domain controller in the San Antonio location. You want to eliminate these problems in the future. You want to make sure that user passwords are cached on a server in San Antonio, and that directory service replication only happens from Dallas to San Antonio. Changes should not be made at San Antonio and replicated back to domain controllers in Dallas. What should you do? Install a Read-only Domain Controller (RODC) in the branch office. Install a domain controller in San Antonio. Make it a global catalog server. Install a domain controller in San Antonio. Create a new site for the branch office, and move the domain controller into that site. Enable Universal Group Membership Caching on the site. Install Active Directory Lightweight Directory Services (AD LDS) on a member server in the branch office. Configure an instance and run Adamsync once to populate the directory from a domain controller in Dallas.
Set the site link cost from CO-to-MN to 50. Set the site link cost from MN-to-WH to 160. Set the site link cost from CO-to-WH to 50.
Your company has four sites within the Atlanta metropolitan area: Central Office (CO), Shipping (SH), Manufacturing (MN), and Warehouse (WH). Each site connects to the CO site with a T-1 link that operates at 1.544 Mbps. An auxiliary link between the MN and WH sites operates at 56 Kbps. The auxiliary link provides a redundant communication link so manufacturing will always be able to submit orders to the warehouse for the following day's activities. The 56 Kbps link is for fault tolerance only. Normally, network traffic is routed over the T-1 links. Your company is migrating to Active Directory. You are in the process of configuring site links. You want the links to follow the network communication infrastructure. You have the following links configured: CO-to-SH, CO-to-MN, CO-to-WH, and MN-to-WH. You want to be sure that no replication traffic crosses the MN-to-WH site link unless no other links were available. What should you do? (Choose three. Each correct answer is part of the solution.) Set the site link cost from MN-to-WH to 50. Set the site link cost from CO-to-MN to 50. Set the site link cost from MN-to-WH to 160. Set the site link cost from CO-to-WH to 50. Set the site link cost from CO-to-SH to 160.
Create a two-way forest trust between the two forest root domains.
Your network consists of a single Active Directory domain. Your company has recently merged with another company. The acquired company has an Active Directory network with multiple domains. All domain controllers in both forests run Windows Server 2008 R2 or Windows Server 2012 R2. You have been given the task of recommending changes to the Active Directory structure. You want to let users in both companies access each other's resources (subject to applicable permissions), and you want to minimize administrative effort in doing so. What should you do? Create two one-way external trusts between your domain and each domain in the newly acquired company. Create two one-way external trusts between the two forest root domains. Create a two-way external trust between the two forest root domains. Create a two-way shortcut trust between your domain and each domain in the newly acquired company. Create a two-way forest trust between the two forest root domains. Create a one-way forest trust between the two forest root domains.
Do not use selective authentication Create the trust as an incoming trust Create a forest trust between eastsim.com and westsim.com
Your network consists of three domain sin a single fores: eastsim.com, acct.eastsim.com, and dev.eastsim.com. You have formed a partnership with another company. They also have three domains: westsim.com, mktg.westsim.com, and sales.westsim.com. Because of the partnership, users in all domains for the eastsim.com forest need access to resources in all three domains in the partner network. Users in the partner network should not have access to any of your domains. You need to create the trust from the eastsim.com network. What should you do? (Select three.) Create external trusts from eastsim.com to each of the domains in westsim.com. Do not use selective authentication. Create the trust as an outgoing trust. Create the trust as an incoming trust. Create a forest trust between eastsim.com and westsim.com. Use selective authentication.
From the dev.northsim.com domain, create an outgoing trust Create an external trust Do no use selective authentication
Your network consists of three domains in a single forest: northsim.com, acct.northsim.com, and dev.northsim.com. You have formed a partnership with another company that has two domains: southsim.com and sales.southsim.com. Because of the partnership, users in the sales.southsim.com domain need access to resources in the dev.northsim.com domain. No other users in any other domains should have access to resources in any other domain. What should you do? (Select three.) Create a forest root trust. From the dev.northsim.com domain, create an outgoing trust. Create an external trust. From the dev.northsim.com domain, create an incoming trust. Use selective authentication. Do not use selective authentication. From the northsim.com domain, create an incoming trust.
Run adprep /forestprep in the westsim.com domain Run adprep /domainprep in the uk.emea.westsim.com domain
Your network currently has the following Active Directory Domains: westsim.com, emea.westsim.com, uk.emea.westsim.com, and us.westsim.com. All domains have both Windows Server 2003 functional level, and the forest level is at Windows Server 2003. You want to add a Windows Server 2012 R2 domain controller to the uk.emea.westsim.com domain. Which of the following must you do to prepare for the installation? (Select 2) Run adprep /domainprep in all domains. Run adprep /domainprep in the uk.emea.westsim.com, emea.westsim.com, and westsim.com domains. Raise the forest functional level. Run adprep /domain prep in the uk.emea.westsim.com and emea.westsim.com domains. Run adprep /forestprep in the westsim.com domain. Run adprep /domainprep in the uk.emea.westsim.com domain.
DEFAULTIPSITELINK
Your network has two sites as shown in the graphic. Computer3 is the bridgehead server in the Atlanta site, and Computer1 is the bridgehead server for the Denver site. You want to modify the replication schedule between Atlanta and Denver. Which object's properties would you edit to begin modifying the replication schedule? SMTP COMPUTER1 > NTDS Settings Denver DEFAULTIPSITELINK COMPUTER3 > NTDS Settings Atlanta
