Title: Quiz 5
Course: CTS 2392 Configuring Advanced Windows 2012 Services > Section: Module 5

Q: Which of the following statements regarding the server requirements for an IPAM server is false?
- The server must have a dual-core CPU of at least 2.0 GHz
- The server must be running Windows Server 2008 R2 or Windows Server 2012
- The server must have at least 4 GB of RAM installed
- The server must have at least 80 GB of free disk space available
A: The server must be running Windows Server 2008 R2 or Windows Server 2012
If right: Only Windows Server 2012 computers can run IPAM.
If wrong: Only Windows Server 2012 computers can run IPAM.

Q: How do you configure multiple IPAM servers to communicate with each other?
- Configure network load balancing
- Configure a failover cluster
- Configure IPAM replication
- You can’t configure multiple IPAM servers to communicate with each other
A: You can’t configure multiple IPAM servers to communicate with each other
If right: It is important to understand that an IPAM server never communicates with another IPAM server. For example, they will maintain their own IP address spaces and not share that information within their databases. To effectively manage multiple IPAM servers within a forest, it is necessary to manually configure the discovery scope of each server.
If wrong: It is important to understand that an IPAM server never communicates with another IPAM server. For example, they will maintain their own IP address spaces and not share that information within their databases. To effectively manage multiple IPAM servers within a forest, it is necessary to manually configure the discovery scope of each server.

Q: In Window Server 2012 IPAM, what is the highest-level entity within the IP address space?
- IP address range
- IP address block
- IP address container
- IP address
A: IP address block
If right: IP address blocks are the highest-level conceptual entity in an IP address space.
If wrong: IP address blocks are the highest-level conceptual entity in an IP address space.

Q: Which of the followings statements regarding requirements for an IPAM server is false?
- An IPAM server must be a domain member
- An IPAM server can be a domain controller
- An IPAM server should not also provide DNS or DHCP
- An IPAM server should always be logged in to with a domain account
A: An IPAM server can be a domain controller
If right: An IPAM server cannot be a domain controller.
If wrong: An IPAM server cannot be a domain controller.

Q: Which PowerShell cmdlet is the correct one to use to create the IPAM provisioning GPOs?
- Set-IpamGpoProvisioning
- Initiate-IpamGpoProvisioning
- Perform-IpamGpoProvisioning
- Invoke-IpamGpoProvisioning
A: Invoke-IpamGpoProvisioning
If right: The Invoke-IpamGpoProvisioning cmdlet can be used to create IPAM provisioning GPOs.
If wrong: The Invoke-IpamGpoProvisioning cmdlet can be used to create IPAM provisioning GPOs.

Q: Once all IPAM server setup tasks are complete, several scheduled tasks run on the IPAM server. How often does the process run that collects IP address space usage data from DHCP servers?
- Every 1 day
- Every 2 hours
- Every 4 hours
- Every 1 hour
A: Every 2 hours
If right: The AddressUtilization task collects IP address space usage data from DHCP servers to display current and historical utilization.
If wrong: The AddressUtilization task collects IP address space usage data from DHCP servers to display current and historical utilization.

Q: Which of the following database types can be used with Windows IPAM? (Choose all that apply)
- MySQL
- Microsoft SQL
- Windows Internal Database
- Access
A: Windows Internal Database
If right: IPAM supports only the Windows Internal Database.
If wrong: IPAM supports only the Windows Internal Database.

Q: When you opt to use automatic Group Policy–based provisioning of an IPAM server, several Group Policy Objects are created. How many Group Policy Objects are created?
- Three
- Four
- Five
- Six
A: Three
If right: The Group Policy–based provisioning method creates the Group Policy objects (GPOs) that allow the required access settings on all the IPAM managed servers. The GPOs created are: - IPAM1_DHCP for DHCP servers - IPAM1_DNS for DNS servers - IPAM1_DC_NPS for domain controllers and NPS servers
If wrong: The Group Policy–based provisioning method creates the Group Policy objects (GPOs) that allow the required access settings on all the IPAM managed servers. The GPOs created are: - IPAM1_DHCP for DHCP servers - IPAM1_DNS for DNS servers - IPAM1_DC_NPS for domain controllers and NPS servers

Q: Which of the following items would not be considered a logical component of Active Directory?
- Domains
- Organizational Units
- Domain Controllers
- Trust relationships
A: Domain Controllers
If right: A Domain Controller is a physical component of Active Directory.
If wrong: A Domain Controller is a physical component of Active Directory.

Q: Which of the following desirable features first became available with the Windows Server 2003 domain functional level?
- SYSVOL replication using DFSR instead of NTFRS
- Automatic SPN management
- LastLogonTimestamp attribute
- Fine-grained password policies
A: LastLogonTimestamp attribute
If right: The LastLogonTimestamp attribute first became available at the Windows Server 2003 domain functional level.
If wrong: The LastLogonTimestamp attribute first became available at the Windows Server 2003 domain functional level.

Q: Which of the following desirable features first became available with the Windows Server 2008 domain functional level?
- SYSVOL replication using DFSR instead of NTFRS
- Automatic SPN management
- Authentication mechanism assurance
- UserPassword attribute
A: SYSVOL replication using DFSR instead of NTFRS
If right: SYSVOL replication using DFSR instead of NTFRS enables the use of Distributed File System Replication (DFSR) instead of NT File Replication Service (NTFRS), which allows for more efficient and robust replication between domain controllers.
If wrong: SYSVOL replication using DFSR instead of NTFRS enables the use of Distributed File System Replication (DFSR) instead of NT File Replication Service (NTFRS), which allows for more efficient and robust replication between domain controllers.

Q: Which domain functional level is no longer supported by Windows Server 2012 domain controllers?
- Windows 2000 native
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2
A: Windows 2000 native
If right: Windows Server 2012 domain controllers do not support the Windows 2000 native mode functional level that was available with Windows Server 2008 R2 and earlier.
If wrong: Windows Server 2012 domain controllers do not support the Windows 2000 native mode functional level that was available with Windows Server 2008 R2 and earlier.

Q: You want to use the new features of Key Distribution Center (KDC) support for claims, compound authentication, and Kerberos armoring in your domain. What must you do first? (Choose two answers)
- Raise the domain functional level to Windows Server 2008 R2
- Raise the domain functional level to Windows Server 2012
- Install at least one Windows Server 2012 domain controller
- Retire all Windows 2000 Server member servers
A: Raise the domain functional level to Windows Server 2012; Install at least one Windows Server 2012 domain controller
If right: Since these new features depend on the domain functional level being raised to Windows Server 2012, you will need at least one domain controller running Windows Server 2012.
If wrong: Since these new features depend on the domain functional level being raised to Windows Server 2012, you will need at least one domain controller running Windows Server 2012.

Q: What data is found on a Global Catalog server? (Choose two parts)
- A full copy of all Active Directory objects in the directory for its host domain
- A partial copy of all Active Directory objects in the directory for its host domain
- A full copy of all objects for all other domains in the forest
- A partial copy of all objects for all other domains in the forest
A: A full copy of all Active Directory objects in the directory for its host domain; A partial copy of all objects for all other domains in the forest
If right: Global catalog servers are special domain controllers that store a full copy of all Active Directory objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest.
If wrong: Global catalog servers are special domain controllers that store a full copy of all Active Directory objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest.

Q: In an organization that has three Active Directory forests with a total of six Active Directory domains, how many schemas will exist in the organization?
- Three
- Six
- Nine
- Eighteen
A: Three
If right: The schema exists once per Active Directory forest and is shared by all domains in that forest.
If wrong: The schema exists once per Active Directory forest and is shared by all domains in that forest.

Q: Which default security group is created to allow designated users to manage the Active Directory schema of the forest?
- Enterprise Admins
- Schema Admins
- Forest Schema Admins
- Organization Schema Admins
A: Schema Admins
If right: The correct name of this group is Schema Admins.
If wrong: The correct name of this group is Schema Admins.

Q: In which scenario would you want to disable SID filtering?
- There is no trust between all Domain Admins and Enterprise Admins within both trusts
- Forests have been renamed
- Domains have been authoritatively restored
- User accounts have been involved in a domain migration
A: User accounts have been involved in a domain migration
If right: User accounts have been involved in a domain migration. If a domain migration has been done, a user will be given a new principle SID in relation to the domain he or she has been migrated to while maintaining the old SID in the sIDHistory attribute. If the administrator migrated the previous SIDs, the sIDHistory attribute will be populated with the old SID. The previous SID might have been kept to retain access to network resources in the old domain. This can cause problems because if the old SID is filtered off within a trust, the user will lose access to resources still pointing to the old SID.
If wrong: User accounts have been involved in a domain migration. If a domain migration has been done, a user will be given a new principle SID in relation to the domain he or she has been migrated to while maintaining the old SID in the sIDHistory attribute. If the administrator migrated the previous SIDs, the sIDHistory attribute will be populated with the old SID. The previous SID might have been kept to retain access to network resources in the old domain. This can cause problems because if the old SID is filtered off within a trust, the user will lose access to resources still pointing to the old SID.

Q: When using the netdom command to validate a trust, what specific switch will you need to use to ensure validation is performed?
- /test
- /validate
- /verify
- /checkPW
A: /verify
If right: You will use the /verify switch to validate the trust.
If wrong: You will use the /verify switch to validate the trust.

Q: When disabling SID filtering on a forest trust, what netdom switch should be used?
- /disenablesidhistory:Yes
- /enablesidhistory:No
- /quarantine:No
- /sidhistory:Disable
A: /enablesidhistory:No
If right: You will use the /enablesidhistory:No switch to disable SID filtering for the forest trust.
If wrong: You will use the /enablesidhistory:No switch to disable SID filtering for the forest trust.

Q: When do you want to enable domain-wide authentication for a trust?
- When all users in the trusted forest need to authenticate against the trusting domain
- When all users in the trusted domain need to authenticate against the trusting domain
- When all users in the trusted domain need to authenticate against the trusting forest
- When all users in the trusted forest need to authenticate against the trusting forest
A: When all users in the trusted domain need to authenticate against the trusting domain
If right: Enable domain-wide authentication when all users in the trusted domain need to authenticate against the trusting domain.
If wrong: Enable domain-wide authentication when all users in the trusted domain need to authenticate against the trusting domain.

Q: Which of the following scenarios would allow the creation of a shortcut trust? (Choose all that apply)
- Between a third-level child domain and a second-level child domain in a different domain tree of the same forest
- Between two third-level child domains in the same forest
- Between two second-level child domains in different forests
- Between a third-level child domain and a forest root domain in different forests
A: Between a third-level child domain and a second-level child domain in a different domain tree of the same forest; Between two third-level child domains in the same forest
If right: You will not be able to create a shortcut trust between two domains in separate forests.
If wrong: You will not be able to create a shortcut trust between two domains in separate forests.

Q: Which of the following is not a scope of trust authentication?
- Selective authentication
- Domain-wide authentication
- Server authentication
- Forest-wide authentication
A: Server authentication
If right: There are three scopes of trust authentication: selective authentication, domain-wide authentication, and forest-wide authentication.
If wrong: There are three scopes of trust authentication: selective authentication, domain-wide authentication, and forest-wide authentication.

Q: Which of the following commands correctly illustrates how to create a one-way external trust from the adatum.local domain to the contoso.local domain?
- netdom trust adatum.local /Domain:contoso.local /add
- netdom -addtrust /Local:adatum.local /External:contoso.local
- netdom trust –add adatum.local /Domain:contoso.local
- netdom –add /trust adatum.local /Domain:contoso.local
A: netdom trust adatum.local /Domain:contoso.local /add
If right: In this scenario, you would need to run the netdom trust adatum.local /Domain:contoso.local /add command to create the trust.
If wrong: In this scenario, you would need to run the netdom trust adatum.local /Domain:contoso.local /add command to create the trust.

Q: To create a forest trust, which of the following requirements must be met? (Choose all that apply)
- Both domains involved in the trust must be the forest root domain
- Both domains involved in the trust must be at the Windows Server 2000 native domain functional level or higher
- Both domains involved in the trust must be at the Windows Server 2003 forest functional level or higher
- Both domains involved in the trust must be involved in an acquisition or merger
A: Both domains involved in the trust must be the forest root domain; Both domains involved in the trust must be at the Windows Server 2003 forest functional level or higher
If right: To create a forest trust, both domains of the trust must be the forest root domain and have a forest functional level of Windows Server 2003 or higher. Additionally, DNS will need to be able to support name resolution between the forests.
If wrong: To create a forest trust, both domains of the trust must be the forest root domain and have a forest functional level of Windows Server 2003 or higher. Additionally, DNS will need to be able to support name resolution between the forests.

Q: Why would you normally create a shortcut trust?