Title: Quiz 6
Course: CTS 2346 Windows Server 2012 > Section: Module 6

Q: The domain controllers are the computers that store and run the _______________.
- user database
- services database
- Managed Service Accounts database
- Active Directory database
A: Active Directory database
If right: The domain controllers are the servers that store and run the Active Directory database.
If wrong: The domain controllers are the servers that store and run the Active Directory database.

Q: Which Active Directory object is defined as a specialized domain controller that performs certain tasks so that multi-master domain controllers can operate and synchronize properly?
- Schema Master
- Forest
- RODC
- Operations Master
A: Operations Master
If right: Operations Masters are specialized domain controllers that perform certain tasks so that multi-master domain controllers can operate and synchronize properly.
If wrong: Operations Masters are specialized domain controllers that perform certain tasks so that multi-master domain controllers can operate and synchronize properly.

Q: When you add attributes to an Active Directory object, what part of the domain database are you actually changing?
- FSMO
- schema
- directory structure
- organizational units
A: schema
If right: When you add attributes to an Active Directory object, you change the schema of the domain database.
If wrong: When you add attributes to an Active Directory object, you change the schema of the domain database.

Q: You do not place the infrastructure master on a global catalog server unless what situation exists?
- You have a single domain.
- You have Windows NT 4.0 systems to support.
- You have multiple schemas.
- Your AD DS is Windows 2008 or higher.
A: You have a single domain.
If right: Do not place the infrastructure master on a global catalog server unless you have only one domain or all the domain controllers in your forest are also global catalogs.
If wrong: Do not place the infrastructure master on a global catalog server unless you have only one domain or all the domain controllers in your forest are also global catalogs.

Q: How many PDC Emulators are required, if needed, in a domain?
- one
- two
- three
- four
A: one
If right: A domain requires just one Primary Domain Controller Emulator.
If wrong: A domain requires just one Primary Domain Controller Emulator.

Q: Which of the following commands issued at the fsmo maintenance prompt would successfully seize the role of an Operations Master Holder? Select all that apply.
- seize schema master
- seize global master
- seize PDC
- seize domain control
A: seize schema master; seize PDC
If right: At the fsmo maintenance prompt, the seize schema master command and the seize PDC command would both seize the role of an Operations Master Holder.
If wrong: At the fsmo maintenance prompt, the seize schema master command and the seize PDC command would both seize the role of an Operations Master Holder.

Q: Where are you most likely to see a Read-Only Domain Controller (RODC)?
- in a small network instead of in an enterprise
- in an enterprise network
- in a remote site
- in the place of a standard domain controller
A: in a remote site
If right: An RODC was created to be used in places where a domain controller is needed but the physical security of the domain controller could not be guaranteed. For example, it might be placed in a remote site that is not very secure and has a slower WAN link. Because it has a slow WAN link, a local domain controller would benefit the users at that site.
If wrong: An RODC was created to be used in places where a domain controller is needed but the physical security of the domain controller could not be guaranteed. For example, it might be placed in a remote site that is not very secure and has a slower WAN link. Because it has a slow WAN link, a local domain controller would benefit the users at that site.

Q: What two things must you do to a Windows Server to convert it to a domain controller?
- Install Server Manager.
- Install Active Directory Domain Services (AD DS).
- Install DNS.
- Execute dcpromo from Server Manager.
A: Install Active Directory Domain Services (AD DS).; Execute dcpromo from Server Manager.
If right: A domain controller is a Windows server that stores a replica of the account and security information for the domain and defines the domain boundaries. To make a computer running Windows Server 2012 a domain controller, you must install the AD DS and execute dcpromo from Server Manager.
If wrong: A domain controller is a Windows server that stores a replica of the account and security information for the domain and defines the domain boundaries. To make a computer running Windows Server 2012 a domain controller, you must install the AD DS and execute dcpromo from Server Manager.

Q: If a single domain controller’s AD database becomes corrupt, which type of restore should you perform on it?
- authoritative
- nonauthoritative
- explicit
- full
A: nonauthoritative
If right: With a nonauthoritative restore, you restore a backup of Active Directory as of the date of the backup. The AD DS restarts on the domain controller, and the domain controller contacts the other domain controllers to get updates since the backups were completed. The other domain controllers replicate the information to the restored domain controller so that they are the same.
If wrong: With a nonauthoritative restore, you restore a backup of Active Directory as of the date of the backup. The AD DS restarts on the domain controller, and the domain controller contacts the other domain controllers to get updates since the backups were completed. The other domain controllers replicate the information to the restored domain controller so that they are the same.

Q: What function does the CSVDE tool perform?
- It decrypts and encrypts Active Directory information.
- It exports/imports Active Directory information.
- It exports/imports data from Event Viewer.
- It extracts Event Viewer information into CSV files.
A: It exports/imports Active Directory information.
If right: The CSVDE command-line tool exports or imports Active Directory Domain Services (AD DS) objects to or from a comma-delimited text file (also known as a comma-separated value text file or .csv file).
If wrong: The CSVDE command-line tool exports or imports Active Directory Domain Services (AD DS) objects to or from a comma-delimited text file (also known as a comma-separated value text file or .csv file).

Q: What is a GUID?
- a unique identifier for a snapshot
- a special file permission
- an Active Directory object ID
- a group-user ID in Active Directory
A: a unique identifier for a snapshot
If right: A globally unique identifier (GUID) is what’s returned by the create snapshot command or displayed with the list all command.
If wrong: A globally unique identifier (GUID) is what’s returned by the create snapshot command or displayed with the list all command.

Q: To perform an authoritative restore, into what mode must you reboot the domain controller?
- Repair
- Safe
- Command line with networking
- DSRM
A: DSRM
If right: To perform an authoritative restore, you need to reboot the computer into the Directory Services Restore Mode (DSRM), which is a Windows mode that takes the Active Directory offline.
If wrong: To perform an authoritative restore, you need to reboot the computer into the Directory Services Restore Mode (DSRM), which is a Windows mode that takes the Active Directory offline.

Q: By default, how often does Active Directory “garbage collection” occur?
- every 45 minutes
- every 2 hours
- every 8 hours
- every 12 hours
A: every 12 hours
If right: As long as the object has not been scavenged by the garbage collection process after reaching the end of the object tombstone lifetime, you can restore the deleted object. However, when the item is deleted, certain attributes are removed, such as group membership. By default, garbage collection occurs every 12 hours.
If wrong: As long as the object has not been scavenged by the garbage collection process after reaching the end of the object tombstone lifetime, you can restore the deleted object. However, when the item is deleted, certain attributes are removed, such as group membership. By default, garbage collection occurs every 12 hours.

Q: What utility first appeared in Windows Server 2008 R2 that allows you to undelete Active Directory containers and objects?
- the Active Directory Lost and Found folder
- the Active Directory Recycle Bin
- the Active Directory Undelete utility
- Active Directory Snapshots
A: the Active Directory Recycle Bin
If right: Starting with Windows Server 2008 R2, Windows has offered the Active Directory Recycle Bin. Similar to the Recycle Bin found in Windows that is used to undelete deleted files, the Active Directory Recycle Bin can be used to undelete deleted Active Directory containers and objects.
If wrong: Starting with Windows Server 2008 R2, Windows has offered the Active Directory Recycle Bin. Similar to the Recycle Bin found in Windows that is used to undelete deleted files, the Active Directory Recycle Bin can be used to undelete deleted Active Directory containers and objects.

Q: In interactive mode, what aspect of AD can you check with the ntdsutil integrity command?
- low-level database corruption
- fragmentation levels
- accuracy of entries
- completeness of entries
A: low-level database corruption
If right: You can also use the ntdsutil command to look for errors in Active Directory. The integrity command is used to detect low-level (binary level) database corruption, which reads every byte of the data file to ensure that the correct headers exist in the database itself and that all the tables are functioning and are consistent.
If wrong: You can also use the ntdsutil command to look for errors in Active Directory. The integrity command is used to detect low-level (binary level) database corruption, which reads every byte of the data file to ensure that the correct headers exist in the database itself and that all the tables are functioning and are consistent.

Q: After you undelete a user account with the LDP utility, what action do you need to perform?
- Remove the old identifier.
- Re-establish user to domain trust.
- Reset the user’s password.
- Restore the user-owned objects from a backup.
A: Reset the user’s password.
If right: After the account has been undeleted, you need to reset the password for a user object.
If wrong: After the account has been undeleted, you need to reset the password for a user object.

Q: Why is a setting of 0 for maximum password age not a good idea? Check all that apply.
- It means that passwords never expire, which is a major security problem.
- It means that your passwords expire every day.
- It means that you’ve disabled password aging.
- It means that you’ve disabled the use of passwords.
A: It means that passwords never expire, which is a major security problem.; It means that you’ve disabled password aging.
If right: The minimum password age setting must be set to a lower value than the maximum password age, unless the maximum password age is set to 0, which means passwords never expire, which is never appropriate in a production environment.
If wrong: The minimum password age setting must be set to a lower value than the maximum password age, unless the maximum password age is set to 0, which means passwords never expire, which is never appropriate in a production environment.

Q: Account policies contain various subsets. Which of the following are legitimate subsets of account policies? Check all that apply.
- Password Policy
- Account Lockout Policy
- Kerberos Policy
- Username Policy
A: Password Policy; Account Lockout Policy; Kerberos Policy
If right: Account policies contain three subsets: Password Policy, Account Lockout Policy, and Kerberos Policy.
If wrong: Account policies contain three subsets: Password Policy, Account Lockout Policy, and Kerberos Policy.

Q: What is the range of password history settings?
- 0 to 9
- 0 to 15
- 0 to 24
- 0 to 63
A: 0 to 24
If right: Microsoft allows you to set the password history value between 0 and 24. In standard environments, 10 is a fairly common setting, although Windows Server 2012 defaults to 24 on domain controllers.
If wrong: Microsoft allows you to set the password history value between 0 and 24. In standard environments, 10 is a fairly common setting, although Windows Server 2012 defaults to 24 on domain controllers.

Q: What is an easy method of creating a strong password?
- Use your username and add numbers and special characters.
- Use your favorite football team’s name with numbers and special characters.
- Ask a friend for some ideas for good passwords and then add your own number and characters.
- Start with a sentence and then add numbers and special characters.
A: Start with a sentence and then add numbers and special characters.
If right: The trick with strong passwords is how to create a strong password that you can remember. One way is to start with a phrase or sentence, remove the spaces between the words in a sentence and then do some character substitution. For example, instead of using the a character, you substitute @. You also can add a couple of digits at the end.
If wrong: The trick with strong passwords is how to create a strong password that you can remember. One way is to start with a phrase or sentence, remove the spaces between the words in a sentence and then do some character substitution. For example, instead of using the a character, you substitute @. You also can add a couple of digits at the end.

Q: What does the minimum password age setting control?
- how many seconds a user must wait before a password reset
- how many minutes a user must wait before a password reset
- how many hours a user must wait before a password reset
- how many days a user must wait before a password reset
A: how many days a user must wait before a password reset
If right: The minimum password age setting controls how many days users must wait before they can reset their password.
If wrong: The minimum password age setting controls how many days users must wait before they can reset their password.

Q: Why should administrator passwords change more often than user passwords?
- because administrator passwords are usually simpler than user passwords
- because administrator accounts carry more security sensitivity than users do
- because administrators are paranoid about security
- because administrator accounts are watched by management in large companies
A: because administrator accounts carry more security sensitivity than users do
If right: The maximum password age setting controls the maximum period of time that can elapse before you are forced to reset your password. This setting can range from 1 to 999 days, or it can be set to 0 if you never want passwords to expire. A general rule for this setting is 90 days for user accounts, although for administrative accounts, it’s generally a good idea to reset passwords more frequently.
If wrong: The maximum password age setting controls the maximum period of time that can elapse before you are forced to reset your password. This setting can range from 1 to 999 days, or it can be set to 0 if you never want passwords to expire. A general rule for this setting is 90 days for user accounts, although for administrative accounts, it’s generally a good idea to reset passwords more frequently.

Q: What is the primary advantage of using Group Policies in a domain environment?
- ease of enforcement
- user compliance
- centralized management
- ease of creation
A: centralized management
If right: Group Policies provide centralized management and configuration of operating systems, applications, and user settings in an Active Directory environment.
If wrong: Group Policies provide centralized management and configuration of operating systems, applications, and user settings in an Active Directory environment.

Q: What is the secpol.msc utility used for?
- editing group policies
- editing local security policies
- editing global security policies
- editing domain-level policies
A: editing local security policies
If right: The easiest method to access the account policies is to execute secpol.msc from a command prompt to open the Local Security Policy.
If wrong: The easiest method to access the account policies is to execute secpol.msc from a command prompt to open the Local Security Policy.

Q: By default, who has read/write capability to the Default Domain Policy?
- local administrators
- power users
- domain users
- domain administrators
A: domain administrators
If right: By default, the Domain Admins group has Read and Write capabilities to the Default Domain Policy.
If wrong: By default, the Domain Admins group has Read and Write capabilities to the Default Domain Policy.