Title: Final Exam
Course: CTS 2392 Configuring Advanced Windows 2012 Services > Section: Module 8

Q: Server Message Block (SMB) 3.0 provides many changes that add functionality and improve performance. Which of the following features allows users to scale shared bandwidth by adding cluster nodes?
- SMB Transparent Failover
- SMB Encryption
- SMB Scale Out
- SMB Directory Leasing
A: SMB Scale Out
If right: SMB Scale Out allows users to scale shared bandwidth by adding cluster nodes.
If wrong: SMB Scale Out allows users to scale shared bandwidth by adding cluster nodes.

Q: Server Message Block (SMB) 3.0 provides many changes that add functionality and improve performance. Which of the following features encrypts traffic?
- SMB Transparent Failover
- SMB Encryption
- SMB Scale Out
- SMB Directory Leasing
A: SMB Encryption
If right: SMB Encryption performs encryption by selecting a check box. Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Encryption functionality.
If wrong: SMB Encryption performs encryption by selecting a check box. Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Encryption functionality.

Q: Server Message Block (SMB) 3.0 provides many changes that add functionality and improve performance. Which of the following features allows SMB 3.0 clients to not lose an SMB session when failover occurs?
- SMB Transparent Failover
- SMB Encryption
- SMB Scale Out
- SMB Directory Leasing
A: SMB Transparent Failover
If right: SMB Transparent Failover provides Continuously Available properties that allow SMB 3 clients to not lose an SMB session when failover occurs. Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Transparent Failover functionality.
If wrong: SMB Transparent Failover provides Continuously Available properties that allow SMB 3 clients to not lose an SMB session when failover occurs. Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Transparent Failover functionality.

Q: Server Message Block (SMB) 3.0 provides many changes that add functionality and improve performance. Which of the following features reduces the latency when accessing files over slow WAN links?
- SMB Transparent Failover
- SMB Encryption
- SMB Scale Out
- SMB Directory Leasing
A: SMB Directory Leasing
If right: SMB Directory Leasing reduces the latency when accessing files over slow WAN links by caching directory and file meta-data for longer periods, which reduces the associated round-trips to fetch the meta-data from the server.
If wrong: SMB Directory Leasing reduces the latency when accessing files over slow WAN links by caching directory and file meta-data for longer periods, which reduces the associated round-trips to fetch the meta-data from the server.

Q: When configuring a cluster to provide highly available Hyper-V services, which of the following hardware requirements must your server hardware meet?
- Provide hardware-assisted virtualization
- Use Fibre Channel
- Use SAS
- Provide MBR disks
A: Provide hardware-assisted virtualization
If right: Hosts require an x64-based processor with hardware-assisted virtualization.
If wrong: Hosts require an x64-based processor with hardware-assisted virtualization.

Q: Which SMB 3.0 feature minimizes processor utilization when performing large file I/O operations?
- SMB Multichannel
- VSS for SMB file shares
- SMB Direct
- SMB Scale Out
A: SMB Direct
If right: SMB Direct (SMB over Remote Direct Memory Access [RDMA]) enables direct memory-to-memory data transfers between servers, with minimal CPU utilization and low latency, using standard RDMA-capable network adapters (iWARP, InfiniBand, and RoCE). It also minimizes the processor utilization when performing large file I/O operations.
If wrong: SMB Direct (SMB over Remote Direct Memory Access [RDMA]) enables direct memory-to-memory data transfers between servers, with minimal CPU utilization and low latency, using standard RDMA-capable network adapters (iWARP, InfiniBand, and RoCE). It also minimizes the processor utilization when performing large file I/O operations.

Q: When creating a new General Use File Server role, which SMB settings are enabled by default, but can be disabled if desired? (Choose all that apply)
- Enable access-based enumeration
- Enable continuous availability
- Allow caching of share
- Encrypt data access
A: Enable continuous availability; Encrypt data access
If right: The Enable continuous availability and Encrypt data access options are selected by default. The Enable continuous availability takes advantage of SMB v3 functionality (Transparent Failover), whereas the Encrypt data access enables encryption of the SMB connections.
If wrong: The Enable continuous availability and Encrypt data access options are selected by default. The Enable continuous availability takes advantage of SMB v3 functionality (Transparent Failover), whereas the Encrypt data access enables encryption of the SMB connections.

Q: To configure an NLB cluster after installing NLB on the Windows Server 2012 computer, you must configure three types of parameters. Which of the following is not one of the three you must configure?
- Host parameters
- Port rules
- Firewall rules
- Cluster parameters
A: Firewall rules
If right: To configure the NLB cluster, you must configure three types of parameters: - Host parameter: Defines what each node can do in an NLB cluster. - Cluster parameter: Configures the NLB cluster as a whole. - Port rules: Controls what ports the NLB cluster services and how requests are balanced across all servers.
If wrong: To configure the NLB cluster, you must configure three types of parameters: - Host parameter: Defines what each node can do in an NLB cluster. - Cluster parameter: Configures the NLB cluster as a whole. - Port rules: Controls what ports the NLB cluster services and how requests are balanced across all servers.

Q: Which PowerShell cmdlet here will correctly install NLB and the NLB management console?
- Install-WindowsFeature NLB,NLB-Console
- Add-WindowsFeature NLB,RSAT-NLB
- Add-WindowsFeature NLB,NLB-RSAT
- Add-WindowsComponents NLB,NLB-Manager
A: Add-WindowsFeature NLB,RSAT-NLB
If right: To install the NLB cluster and the NLB tools using PowerShell, you can use the following cmdlet: Add-WindowsFeature NLB,RSAT-NLB.
If wrong: To install the NLB cluster and the NLB tools using PowerShell, you can use the following cmdlet: Add-WindowsFeature NLB,RSAT-NLB.

Q: Which of the following statements about Network Load Balancing is incorrect?
- Windows Server 2012 NLB clusters can have between 2 and 32 nodes.
- All hosts in the NLB cluster receive the incoming traffic.
- NLB detects the failure of a cluster node using a heartbeat.
- Network adapters in the NLB cluster can use both multicast and unicast simultaneously.
A: Network adapters in the NLB cluster can use both multicast and unicast simultaneously.
If right: Within each cluster, all network adapters must be either multicast or unicast. You cannot have some nodes configured as multicast while other nodes are configured as unicast within a single cluster.
If wrong: Within each cluster, all network adapters must be either multicast or unicast. You cannot have some nodes configured as multicast while other nodes are configured as unicast within a single cluster.

Q: From where would you add Network Load Balancing to a Windows Server 2012 computer?
- Programs and Features
- Server Manager
- Add/Remove Programs
- Computer Management
A: Server Manager
If right: To add the NLB feature to a computer running Windows Server 2012, you use Server Manager.
If wrong: To add the NLB feature to a computer running Windows Server 2012, you use Server Manager.

Q: Which of the following technologies transparently distributes traffic across multiple servers by using virtual IP addresses and a shared name?
- Redundant network cards
- Network Load Balancing
- Failover cluster
- RAID array
A: Network Load Balancing
If right: Network Load Balancing (NLB) transparently distributes traffic across multiple servers by using virtual IP addresses and a shared name. With NLB, you gain fault tolerance and enhanced performance. It is often used with mission-critical web servers but can also be found with other types of servers.
If wrong: Network Load Balancing (NLB) transparently distributes traffic across multiple servers by using virtual IP addresses and a shared name. With NLB, you gain fault tolerance and enhanced performance. It is often used with mission-critical web servers but can also be found with other types of servers.

Q: Which cluster operation mode is designed to prevent the network switch from flooding with traffic?
- Unicast
- IGMP Multicast
- BGP Simulcast
- Multicast
A: IGMP Multicast
If right: Another mode available is the Internet Group Management Protocol Multicast mode, which is a special form of multicast mode that prevents the network switch from flooding with traffic. When you use IGMP multicast mode, traffic is forwarded only through the switch ports that are part of the NLB cluster.
If wrong: Another mode available is the Internet Group Management Protocol Multicast mode, which is a special form of multicast mode that prevents the network switch from flooding with traffic. When you use IGMP multicast mode, traffic is forwarded only through the switch ports that are part of the NLB cluster.

Q: Which NLB control command would be the correct one to use to gracefully prepare a node for a planned maintenance activity?
- Stop
- Suspend
- Resume
- Drainstop
A: Drainstop
If right: To perform maintenance on an NLB node that needs to be temporarily removed from the NLB cluster, you should choose drainstop so that connections are not prematurely stopped before the requests are completed.
If wrong: To perform maintenance on an NLB node that needs to be temporarily removed from the NLB cluster, you should choose drainstop so that connections are not prematurely stopped before the requests are completed.

Q: In which NLB cluster operation mode is the MAC address of every node’s network adapter replaced with a single shared MAC address?
- Unicast
- Multicast
- Class C
- Single
A: Unicast
If right: When you configure an NLB cluster to use unicast mode, NLB replaces the network cards original MAC address, and all cluster hosts use the same unicast MAC address.
If wrong: When you configure an NLB cluster to use unicast mode, NLB replaces the network cards original MAC address, and all cluster hosts use the same unicast MAC address.

Q: Which of the following is a constraint of using NLB clusters in unicast mode that you will need to design for?
- You will need separate cluster and management network adapters if you manage the nodes from a different TCP/IP subnet than the cluster network.
- You will need to configure routers to duplicate packets for delivery to all cluster nodes.
- You will need to manually add ARP entries to the routers.
- You will need to ensure you have at least one node in the NLB cluster configured to handle traffic for each class C subnet in your network.
A: You will need separate cluster and management network adapters if you manage the nodes from a different TCP/IP subnet than the cluster network.
If right: When you use unicast mode with a single network adapter on each node, the computer can communicate only with other computers within the same subnet. If you perform management tasks on the computer, you need to perform these tasks on a computer that is on the same TCP/IP subnet as the node, or you have to use a second network adapter and address.
If wrong: When you use unicast mode with a single network adapter on each node, the computer can communicate only with other computers within the same subnet. If you perform management tasks on the computer, you need to perform these tasks on a computer that is on the same TCP/IP subnet as the node, or you have to use a second network adapter and address.

Q: While logged into a Windows Server 2012 computer that is part of an NLB cluster, which of the following PowerShell one-liners is the correct way to change or set the primary IP address of the cluster?
- Get-NlbCluster | Set-NlbCluster –ClusterPrimaryIP IPaddress
- Set-NlbCluster –ClusterPrimaryIP IPaddress
- Find-NlbCluster | Set-NlbCluster –ClusterVIP IPaddress
- Attach-NlbCluster | Set-NlbCluster –ClusterPrimaryIP IPaddress
A: Get-NlbCluster | Set-NlbCluster –ClusterPrimaryIP IPaddress
If right: You would need to use the Get-NlbCluster | Set-NlbCluster –ClusterPrimaryIP IPaddress PowerShell one-liner to change or set the primary IP address of the cluster.
If wrong: You would need to use the Get-NlbCluster | Set-NlbCluster –ClusterPrimaryIP IPaddress PowerShell one-liner to change or set the primary IP address of the cluster.

Q: When you configure port rules for NLB clusters, you will need to configure all of the options listed here, except for one. Which option in this list will you not configure for a port rule?
- The node IP address the rule should apply to
- The TCP or UDP port(s) the rule should apply to
- The filtering mode
- The protocols that this rule should apply to
A: The node IP address the rule should apply to
If right: When you configure the port rules, you configure the following: - The virtual IP address that the rule should apply to - The TCP or UDP port range that this rule should apply to - The protocols that this rule should apply to, including TCP, UDP, or both - The filtering mode that specifies how the cluster handles traffic, which is described by the port range and the protocols
If wrong: When you configure the port rules, you configure the following: - The virtual IP address that the rule should apply to - The TCP or UDP port range that this rule should apply to - The protocols that this rule should apply to, including TCP, UDP, or both - The filtering mode that specifies how the cluster handles traffic, which is described by the port range and the protocols

Q: Which PowerShell cmdlet is used to add a new dedicated IP to an NLB cluster node?
- Add-NlbClusterNodeDip
- Add-NlbClusterDip
- Add-NlbClusterNodeIp
- Add-NlbClusterIp
A: Add-NlbClusterNodeDip
If right: You can use the Add-NlbClusterNodeDip cmdlet to add a dedicated IP to an NLB cluster node.
If wrong: You can use the Add-NlbClusterNodeDip cmdlet to add a dedicated IP to an NLB cluster node.

Q: Which PowerShell cmdlet is used to delete an NLB cluster?
- Drop-NlbCluster
- Delete-NlbCluster
- Remove-NlbCluster
- Disband-NlbCluster
A: Remove-NlbCluster
If right: You can use the Remove-NlbCluster cmdlet to delete a specified NLB cluster.
If wrong: You can use the Remove-NlbCluster cmdlet to delete a specified NLB cluster.

Q: Many components can be configured redundantly within a server system. Of the components listed, which one is typically not available in a redundant arrangement in a single server system?
- Power supplies
- Mainboards (motherboards)
- Network cards
- Disks
A: Mainboards (motherboards)
If right: To make a server more fault tolerant, you should first look at what components are the most likely to fail and implement technology to make the system less likely to fail. Some of the components that are made redundant within a system are usually the following: - Disks: Use some form of RAID and hot spares. - Power supplies: Use redundant power supplies. - Network cards: Use redundant network cards.
If wrong: To make a server more fault tolerant, you should first look at what components are the most likely to fail and implement technology to make the system less likely to fail. Some of the components that are made redundant within a system are usually the following: - Disks: Use some form of RAID and hot spares. - Power supplies: Use redundant power supplies. - Network cards: Use redundant network cards.

Q: Offline P2V migrations are the only available migration method for what types of source servers? (Choose all that apply)
- Servers with FAT32 volumes
- Severs with NTFS volumes
- Servers with any VSS writers installed
- Servers that are domain controllers
A: Servers with FAT32 volumes; Servers that are domain controllers
If right: An offline P2V conversion is the only way to migrate FAT volumes and domain controllers.
If wrong: An offline P2V conversion is the only way to migrate FAT volumes and domain controllers.

Q: What minimum version of VMware ESX/ESXi must a source VM be running on to allow it to be migrated to Hyper-V using P2V?
- 3.5
- 3.5 update 5
- 4.1
- 5.1
A: 3.5 update 5
If right: The prerequisites for V2V using SCVMM are as follows: - VMware ESX/ESXi version 3.5 update 5 or higher (4.0, 4.1, or 5.1). - The VMware Tools must be removed. - VMware virtual hard disks cannot be connected to an IDE bus.
If wrong: The prerequisites for V2V using SCVMM are as follows: - VMware ESX/ESXi version 3.5 update 5 or higher (4.0, 4.1, or 5.1). - The VMware Tools must be removed. - VMware virtual hard disks cannot be connected to an IDE bus.

Q: When performing a P2V migration using SCVMM, there are several limitations that must be observed. Which of the following source operating systems would be disqualified from a P2V migration?
- Windows XP Professional SP3 32-bit
- Windows Server 2003 SP1 32-bit
- Windows Server 2003 R2 SP2 64-bit
- Windows Vista SP1 64-bit
A: Windows Server 2003 SP1 32-bit
If right: VMM does not support P2V conversion for computers running NT Server 4.0 or Windows Server 2003 SP1.
If wrong: VMM does not support P2V conversion for computers running NT Server 4.0 or Windows Server 2003 SP1.

Q: When performing a P2V migration using SCVMM, there are several limitations that must be observed. Which of the following source server specifications would disqualify it from a P2V migration? (Choose all that apply)
- 256 MB of RAM installed
- 1024 GB data volume
- ACPI BIOS
- Uses BitLocker Drive Encryption on the data volume
A: 256 MB of RAM installed; Uses BitLocker Drive Encryption on the data volume
If right: Source servers to be migrated using P2V must have at least 512 MB of RAM and cannot have any encrypted volumes.
If wrong: Source servers to be migrated using P2V must have at least 512 MB of RAM and cannot have any encrypted volumes.

Q: Before you can work with OVF files on your SCVMM server, what must you first do?
- Apply SCVMM SP1
- Upgrade the SCVMM server to Windows Server 2012
- Apply the OVF Import/Export tool
- Upgrade the SCVMM license to Enterprise
A: Apply the OVF Import/Export tool
If right: Open Virtualization Format (OVF) is an open standard for packaging and distributing virtual machines and needs the OVF Import/Export tool, which is available from the Microsoft Download Center. The OVF Import/Export tool must be installed into an existing VMM management server that has the VMM console installed.
If wrong: Open Virtualization Format (OVF) is an open standard for packaging and distributing virtual machines and needs the OVF Import/Export tool, which is available from the Microsoft Download Center. The OVF Import/Export tool must be installed into an existing VMM management server that has the VMM console installed.

Q: Which of the following VM file formats can be migrated using the V2V method by Microsoft System Center Virtual Machine Manager? (Choose all that apply)
- VHD
- OVF
- VMware
- Citrix XenServer
A: OVF; VMware; Citrix XenServer
If right: Currently, SCVMM supports migrations from VMware, XenServer, or OVF. You wouldnt migrate a VHD, you would export and import it instead.
If wrong: Currently, SCVMM supports migrations from VMware, XenServer, or OVF. You wouldnt migrate a VHD, you would export and import it instead.

Q: You want to use Microsoft System Center Virtual Machine Manager 2012 SP1 in your network to allow you to perform P2V migrations. What operating system must you install on the server to house SCVMM?
- Window Server 2008 R2 or Windows Server 2012
- Windows Server 2012 only
- Windows Server 2012 or Windows 8
- Windows 8 only
A: Windows Server 2012 only
If right: SCVMM SP1 runs only on Windows Server 2012
If wrong: SCVMM SP1 runs only on Windows Server 2012

Q: If you want to use an exported VM as a template to create multiple VMs, what should you do on the source VM before performing the export?
- Activate Windows
- Configure the network adapters for DHCP
- Run sysprep
- Run msconfig
A: Run sysprep
If right: If you want to use an exported VM as a template to create multiple VMs, you should run sysprep on the VM prior to performing the export.
If wrong: If you want to use an exported VM as a template to create multiple VMs, you should run sysprep on the VM prior to performing the export.

Q: When importing a VM in Windows Server 2012, you have three options available to select from that affect how the import is performed. Which of the following is not one of those options?
- Restore the virtual machine (create a new unique ID)
- Restore the virtual machine (use the existing unique ID)
- Copy the virtual machine (create a new unique ID)
- Register the virtual machine in place (use the existing unique ID)
A: Restore the virtual machine (create a new unique ID)
If right: There is no option available to Restore the virtual machine (create a new unique ID).
If wrong: There is no option available to Restore the virtual machine (create a new unique ID).

Q: What two factors are the primary items impacting the speed of a Quick Migration? (Choose two answers)
- The speed of the network between the source and destination servers
- The speed of the disks in the source and destination servers
- The speed of the RAM in the source and destination servers
- The amount of memory that needs to be written to disk
A: The speed of the network between the source and destination servers; The amount of memory that needs to be written to disk
If right: The speed of the Quick Migration is dependent on how much memory needs to be written to disk and the speed of the network connection between the source and destination servers.
If wrong: The speed of the Quick Migration is dependent on how much memory needs to be written to disk and the speed of the network connection between the source and destination servers.

Q: Quick Migration occurs within the confines of what?
- A failover cluster
- An Active Directory Forest
- A Virtual Machine Manager farm
- A network load balanced cluster
A: A failover cluster
If right: Quick Migration occurs within the confines of a cluster, allowing you to quickly migrate a running VM from one cluster node to another.
If wrong: Quick Migration occurs within the confines of a cluster, allowing you to quickly migrate a running VM from one cluster node to another.

Q: When performing a Live Migration using the “Move the virtual machine’s data by selecting where to move the items” option, you have three additional, advanced options available to you. Which of the following is not one of those advance options?
- Move the VM’s data automatically
- Move the VM’s data to different locations
- Move the VM’s hard disks to different locations
- Move the VM’s items to different locations
A: Move the VM’s data to different locations
If right: There is no option Move the VMs data to different locations in the advanced options available to you when using the Move the virtual machines data by selecting where to move the items Live Migration option.
If wrong: There is no option Move the VMs data to different locations in the advanced options available to you when using the Move the virtual machines data by selecting where to move the items Live Migration option.

Q: When performing a Live Migration, there are several options available to choose from that control how the LM will occur. Which of the following is not one of these options?
- Move the virtual machine’s data to a single location
- Move the virtual machine’s data by selecting where to move the items
- Move only the virtual machine
- Move only the snapshot files
A: Move only the snapshot files
If right: There is no option when performing a Live Migration to move only snapshot files.
If wrong: There is no option when performing a Live Migration to move only snapshot files.

Q: If you will be performing Live Migration using remote management tools, what must you first do to allow for Kerberos authentication to function?
- Configure Kerberos constrained delegation on the target server
- Configure Kerberos constrained delegation on the source server
- Configure Credential Security Support Provider permissions on the target server
- Configure Credential Security Support Provider permissions on the source server
A: Configure Kerberos constrained delegation on the source server
If right: If you are using remote management tools, you need to configure constrained delegation and select Kerberos as the authentication protocol. You will perform the delegation on the source server, selecting services on the target server.
If wrong: If you are using remote management tools, you need to configure constrained delegation and select Kerberos as the authentication protocol. You will perform the delegation on the source server, selecting services on the target server.

Q: In regard to Live Migration, which of the following prerequisites must be met before attempting the Live Migration? (Choose all that apply)
- All hosts must use processors from the same manufacturer
- All hosts must support hardware virtualization
- All hosts must be running on the same model server
- All VMs must be configured to use OVH format disks on SCSI disks
A: All hosts must use processors from the same manufacturer; All hosts must support hardware virtualization
If right: Additionally, the involved hosts must be running Windows Server 2012, must be in the same Active Directory domain (or trusting domains), the VMs must be using VMD or VMDX disks and you must have the required administrative permissions to perform the LM.
If wrong: Additionally, the involved hosts must be running Windows Server 2012, must be in the same Active Directory domain (or trusting domains), the VMs must be using VMD or VMDX disks and you must have the required administrative permissions to perform the LM.

Q: How is Identity Management for UNIX installed?
- Using Server Manager
- Using Programs and Features
- Using dism.exe
- Using sc.exe
A: Using dism.exe
If right: You must install the Identity Management for UNIX using the Deployment Image Servicing and management command-line tool, dism.exe.
If wrong: You must install the Identity Management for UNIX using the Deployment Image Servicing and management command-line tool, dism.exe.

Q: What can be configured to create targeted audit policies based on resource properties, and expressions, so that you don’t have to audit every file?
- Dynamic Access Control
- Dynamic Auditing Control
- Dynamic Audit Policies
- Direct Access Auditing
A: Dynamic Access Control
If right: You can use Dynamic Access Control to create targeted audit policies based on resource properties, and expressions, so that you dont have to audit every file.
If wrong: You can use Dynamic Access Control to create targeted audit policies based on resource properties, and expressions, so that you dont have to audit every file.

Q: Before you can audit access to files, what must you first do? (Choose all that apply)
- Specify files to be audited
- Specify times to be audited
- Enable object access auditing
- Enable file server auditing
A: Specify files to be audited; Enable object access auditing
If right: When you want to audit files, you must first enable object access auditing. Then you must specify what files you want to audit.
If wrong: When you want to audit files, you must first enable object access auditing. Then you must specify what files you want to audit.

Q: What can you use to configure automatic procedures for defining a desired property on a file based on the conditions specified in a rule?
- File attribution
- File classification
- File indexing
- File archiving
A: File classification
If right: File classification allows you to configure automatic procedures for defining a desired property on a file, based on the conditions specified in classification rules. Once the classification has been made, however, you can then do many other things such as deleting files, archiving files, or other automated tasks.
If wrong: File classification allows you to configure automatic procedures for defining a desired property on a file, based on the conditions specified in classification rules. Once the classification has been made, however, you can then do many other things such as deleting files, archiving files, or other automated tasks.

Q: What feature, first available in Windows 7 and Windows Server 2008, enables you to configure object access auditing for every file and folder on the computer’s file system?
- Total Object Access Auditing
- Server Object Access Auditing
- System Object Access Auditing
- Global Object Access Auditing
A: Global Object Access Auditing
If right: Starting with Windows 7 and Windows Server 2008 R2, you can enable Global Object Access Auditing, which enables you to configure object access auditing for every file and folder in a computers file system.
If wrong: Starting with Windows 7 and Windows Server 2008 R2, you can enable Global Object Access Auditing, which enables you to configure object access auditing for every file and folder in a computers file system.

Q: When configuring file access auditing, which of the following audit types are available to choose from?
- Success, Fail, Both
- Pass, Fail, Both
- Success, Fail, All
- Pass, Fail, All
A: Success, Fail, All
If right: You will need to select Success, Fail, or the All type when configuring what type of actions to perform auditing on.
If wrong: You will need to select Success, Fail, or the All type when configuring what type of actions to perform auditing on.

Q: By default, where will backups of DHCP be sent when you configure backups to occur?
- %systemroot%\Windows\Dhcp\Backup
- %systemroot%\Windows\System32\Dhcp\Backup
- %systemroot%\Windows\System32\Backup\Dhcp
- %systemroot%\Windows\Backup\Dhcp
A: %systemroot%\Windows\System32\Dhcp\Backup
If right: DHCP backups are sent, by default, to the %systemroot%\Windows\System32\Dhcp\Backup location. This is configurable when enabling backups in the DHCP console.
If wrong: DHCP backups are sent, by default, to the %systemroot%\Windows\System32\Dhcp\Backup location. This is configurable when enabling backups in the DHCP console.

Q: Which of the following commands correctly demonstrates how to back up the forward lookup zone contoso.com to a backup folder location?
- DNSCMD /backup contoso.com c:\backup\contoso.com.dns.bak
- DNSCMD /export contoso.com c:\backup\contoso.com.dns.bak
- DNSCMD /zonebackup contoso.com c:\backup\contoso.com.dns.bak
- DNSCMD /zoneexport contoso.com c:\backup\contoso.com.dns.bak
A: DNSCMD /zoneexport contoso.com c:\backup\contoso.com.dns.bak
If right: You would need to use the DNSCMD /zoneexport contoso.com c:\backup\contoso.com.dns.bak command to back up the forward lookup zone contoso.com to a backup folder location.
If wrong: You would need to use the DNSCMD /zoneexport contoso.com c:\backup\contoso.com.dns.bak command to back up the forward lookup zone contoso.com to a backup folder location.

Q: When you select the “Faster backup performance” option for your backups, what is the net result of this configuration? (Choose all that apply)
- Full backups are performed
- Incremental backups are performed
- Windows keeps a shadow copy of the source volume
- Each volume is backed up separately
A: Incremental backups are performed; Windows keeps a shadow copy of the source volume
If right: When you select the Faster backup performance option, you are performing incremental backups; therefore, Windows keeps a shadow copy on the source volume, which it will use to track changes.
If wrong: When you select the Faster backup performance option, you are performing incremental backups; therefore, Windows keeps a shadow copy on the source volume, which it will use to track changes.

Q: Which of the following items is not a limitation to keep in mind when deciding to use Windows Online Backups?
- They only work with Windows Server 2012
- BitLocker must be disabled to allow backups to occur
- System state cannot be backed up
- Files and folders (data) cannot be backed up
A: Files and folders (data) cannot be backed up
If right: When using Windows Online Backups, you need to keep the following in mind: - It’s only used with Windows Server 2012. - If BitLocker is enabled to protect your data files, it must be turned off for the software agent to back up your data files. - You can back up only files and folders (data); system state and system drives are not supported.
If wrong: When using Windows Online Backups, you need to keep the following in mind: - It’s only used with Windows Server 2012. - If BitLocker is enabled to protect your data files, it must be turned off for the software agent to back up your data files. - You can back up only files and folders (data); system state and system drives are not supported.

Q: What is contained within the Backup <Date><ID number> folder created by Windows Server Backup? (Choose all that apply)
- Virtual hard disk (VHD) files that are basically duplicates of your volumes
- Metadata cache information
- Log files that contain a record of errors that occur
- XML files that provide backup history details
A: Virtual hard disk (VHD) files that are basically duplicates of your volumes; XML files that provide backup history details
If right: The Backup DateID number folder contains several XML files that provide backup history details along with virtual hard disk (VHD) files that are basically duplicates of your volumes.
If wrong: The Backup DateID number folder contains several XML files that provide backup history details along with virtual hard disk (VHD) files that are basically duplicates of your volumes.

Q: What advantage is offered by using block-level backup in Windows Server Backup?
- The blocks are read in the order they appear in files
- The blocks are read in the order they appear on the disk
- The blocks are read in the order they were allocated
- The blocks are read in the order they were released to slack space
A: The blocks are read in the order they appear on the disk
If right: Block-level backup technology increases performance by bypassing the files and file system. In other words, Windows Server Backup reads the blocks in the order they appear on the disk instead of reading them in the order they appear in files, which are usually fragmented across the disk.
If wrong: Block-level backup technology increases performance by bypassing the files and file system. In other words, Windows Server Backup reads the blocks in the order they appear on the disk instead of reading them in the order they appear in files, which are usually fragmented across the disk.

Q: Which of the following would not be a good usage of manual backups?
- Backing up a volume that is not included in the regularly scheduled backup routine
- Making a special backup outside of the current backup schedule
- Making normal backups without a schedule
- Making a backup to store in a different location than the scheduled backups
A: Making normal backups without a schedule
If right: Never use manual backups as a replacement for your regularly scheduled backup. Instead, use them as a complement to your ongoing backups.
If wrong: Never use manual backups as a replacement for your regularly scheduled backup. Instead, use them as a complement to your ongoing backups.

Q: What is the limitation you must be aware of when configuring Windows Server Backup to backup to a shared network folder?
- Backups will be purged as the volume fills up
- Only one backup at a time can exist
- Multiple backups will be appended together into one backup
- Backups cannot be scheduled, but must instead be run manually
A: Only one backup at a time can exist
If right: The backup to a shared network folder option allows you to store your backups on a remote folder share that will hold only one backup at a time. This means that each time the backup is run, it overwrites the previous backup in the folder.
If wrong: The backup to a shared network folder option allows you to store your backups on a remote folder share that will hold only one backup at a time. This means that each time the backup is run, it overwrites the previous backup in the folder.

Q: What Windows feature captures and stores copies of folders and files at specific points in time, allowing users or administrators to recover accidentally deleted or overwritten files as well as compare different versions of the same file?
- Version Management Copies
- Shadow Copy Version Control
- Shadow Copies for Shared Volumes
- Version Control Shadow Copy Provider
A: Shadow Copies for Shared Volumes
If right: Shadow Copies for Shared Volumes (SCSV) uses the capabilities of the VSS to capture and store copies of folders and files (located on shared network resources) at a specific point in time. When SCSV is implemented on a volume, both end users and administrators can recover accidentally deleted or overwritten files as well as compare different versions of the same file. Because end users can restore their own files, implementing SCSV can dramatically reduce not only the time but the associated costs of having to recover their folder and files via the IT support desk.
If wrong: Shadow Copies for Shared Volumes (SCSV) uses the capabilities of the VSS to capture and store copies of folders and files (located on shared network resources) at a specific point in time. When SCSV is implemented on a volume, both end users and administrators can recover accidentally deleted or overwritten files as well as compare different versions of the same file. Because end users can restore their own files, implementing SCSV can dramatically reduce not only the time but the associated costs of having to recover their folder and files via the IT support desk.

Q: What is the minimum forest functional level your Active Directory forest must meet to enable the Active Directory Recycle Bin?
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2003 R2
A: Windows Server 2008 R2
If right: To use Active Directory Recycle Bin, your forest functional level should be set to at least Windows Server 2008 R2 or greater and all domain controllers must be running Windows Server 2008 R2 or Windows Server 2012.
If wrong: To use Active Directory Recycle Bin, your forest functional level should be set to at least Windows Server 2008 R2 or greater and all domain controllers must be running Windows Server 2008 R2 or Windows Server 2012.

Q: Which VSS component is responsible for ensuring that the data to be backed up is ready for the shadow copy to be created?
- VSS requestor
- VSS writer
- VSS provider
- VSSAdmin
A: VSS writer
If right: The VSS writer is responsible for ensuring that the data is ready for the shadow copy to be created.
If wrong: The VSS writer is responsible for ensuring that the data is ready for the shadow copy to be created.

Q: Which term corresponds to a portion of a storage subsystem?
- Logical Unit Number
- iSCSI Qualified Name
- iSCSI Initiator
- iSCSI Target
A: Logical Unit Number
If right: A Logical Unit Number (LUN) is a logical reference to a portion of a storage subsystem.
If wrong: A Logical Unit Number (LUN) is a logical reference to a portion of a storage subsystem.

Q: Which term corresponds to an entity that sends SCSI commands to iSCSI storage devices?
- Logical Unit Number
- iSCSI Qualified Name
- iSCSI Initiator
- iSCSI Target
A: iSCSI Initiator
If right: iSCSI allows clients, called iSCSI initiators, to send SCSI commands to iSCSI storage devices, which are known as iSCSI targets.
If wrong: iSCSI allows clients, called iSCSI initiators, to send SCSI commands to iSCSI storage devices, which are known as iSCSI targets.

Q: Which of the following Hyper-V disk types is characterized as only allocating the amount of physical disk space that is required at that point in time, while still being able to grow to a fixed limit?
- Differencing disk
- Thin provisioned disk
- Dynamically expanding disk
- Trimming disk
A: Dynamically expanding disk
If right: The dynamically expanding disk is given a maximum allowable size and will grow as needed until that maximum is reached. This is referred to as thin provisioning.
If wrong: The dynamically expanding disk is given a maximum allowable size and will grow as needed until that maximum is reached. This is referred to as thin provisioning.

Q: You have just attached an iSCSI device to a server running Windows Server 2012. The disk does not show up in Windows Explorer. What is the best way to make the disk available to the server for usage?
- Rescan disks in Disk Management
- Reboot the server
- Reboot the iSCSI storage system
- Verify that the iSCSI Initiator ID is correct
A: Rescan disks in Disk Management
If right: After opening Computer Management, if the disk does not show up, right-click Disk Management and try to perform a Rescan disk.
If wrong: After opening Computer Management, if the disk does not show up, right-click Disk Management and try to perform a Rescan disk.

Q: Fibre Channel of Ethernet (FCoE) is capable of _________ per second or more.
- 100 megabits
- 1000 megabits
- 1 gigabit
- 10 gigabits
A: 10 gigabits
If right: Fibre Channel of Ethernet (FCoE) is capable of 10 gigabits per second or more. Thus all answers are correct, but D is the best answer.
If wrong: Fibre Channel of Ethernet (FCoE) is capable of 10 gigabits per second or more. Thus all answers are correct, but D is the best answer.

Q: What is the limitation of backing up system state using Windows Server Backup?
- It cannot be backed up to a remote disk
- It cannot be backed up to a disk
- It can only be backed up using Data Protection Manager
- It cannot be backed up to a DVD drive
A: It cannot be backed up to a DVD drive
If right: The system state cannot be backed up to a DVD drive.
If wrong: The system state cannot be backed up to a DVD drive.

Q: The maximum amount of time you have to bring a system back online before it has a significant impact on your organization is known as what?
- Recovery Point Objective
- Recovery Impact Objective
- Recovery Time Objective
- Recovery Backup Objective
A: Recovery Time Objective
If right: The maximum amount of time you have to bring a system back online before it has a significant impact on your organization is called the Recovery Time Objective (RTO).
If wrong: The maximum amount of time you have to bring a system back online before it has a significant impact on your organization is called the Recovery Time Objective (RTO).

Q: How can you manage the Windows Server Backup feature that has been installed on a server that only has the Server Core installation? (Choose all that apply)
- Use the command-line backup tool
- Use RSAT from another computer
- Use the Windows Server Backup MMC from another computer
- Use PowerShell cmdlets
A: Use the command-line backup tool; Use RSAT from another computer; Use the Windows Server Backup MMC from another computer; Use PowerShell cmdlets
If right: The Windows Server Backup MMC snap-in is not installed on Windows Server 2012 systems running the Server Core installation option only. To run backups on these systems, you need to use either the command-line tool wbadmin or the Windows PowerShell cmdlets, or manage them remotely from another computer using the Windows Server Backup MMC. You can also use the Windows 8 Remote Server Administration Tools (RSAT).
If wrong: The Windows Server Backup MMC snap-in is not installed on Windows Server 2012 systems running the Server Core installation option only. To run backups on these systems, you need to use either the command-line tool wbadmin or the Windows PowerShell cmdlets, or manage them remotely from another computer using the Windows Server Backup MMC. You can also use the Windows 8 Remote Server Administration Tools (RSAT).

Q: What command-line tool is installed when you install the Windows Server Backup feature?
- wbadmin.exe
- backup.exe
- wsbackup.exe
- wsbadmin.exe
A: wbadmin.exe
If right: The wbadmin.exe tool is installed when you install the Windows Server Backup feature to allow you to manage backups from the command line.
If wrong: The wbadmin.exe tool is installed when you install the Windows Server Backup feature to allow you to manage backups from the command line.

Q: Which term corresponds to an entity that receives iSCSI commands?
- Logical Unit Number
- iSCSI Qualified Name
- iSCSI Initiator
- iSCSI Target
A: iSCSI Target
If right: iSCSI allows clients, called iSCSI initiators, to send SCSI commands to iSCSI storage devices, which are known as iSCSI targets.
If wrong: iSCSI allows clients, called iSCSI initiators, to send SCSI commands to iSCSI storage devices, which are known as iSCSI targets.

Q: What network services will you require in the remote site used to host a multi-site cluster? (Choose all that apply)
- AD Domain Services
- DHCP
- QoS
- DNS
A: AD Domain Services; DNS
If right: You will need to place one or more domain controllers and DNS servers in the remote site to ensure client computers in that site have uninterrupted access to those services at all times.
If wrong: You will need to place one or more domain controllers and DNS servers in the remote site to ensure client computers in that site have uninterrupted access to those services at all times.

Q: What is the default heartbeat interval in a Windows Server 2012 failover cluster?
- 10 milliseconds
- 10 seconds
- 100 milliseconds
- 1 second
A: 1 second
If right: By default, the heartbeat occurs once every second (1,000 milliseconds).
If wrong: By default, the heartbeat occurs once every second (1,000 milliseconds).

Q: When configuring a multi-site cluster using Windows Server 2012, how can you configure data replication to occur? (Choose all that apply)
- Block level hardware-based replication
- Software-based file replication
- Application-based replication
- Windows MPIO-based replication
A: Block level hardware-based replication; Software-based file replication; Application-based replication
If right: You will need to find a solution for data replication outside of Windows when configuring a multi-site cluster. Some applications handle replication internally, such as Exchange Server and SQL Server.
If wrong: You will need to find a solution for data replication outside of Windows when configuring a multi-site cluster. Some applications handle replication internally, such as Exchange Server and SQL Server.

Q: Regarding DNSSEC, what is used to sign the zone data?
- Key Signing Key
- Zone Signing Key
- Trust Anchor
- DNSSEC Resource Records
A: Zone Signing Key
If right: The ZSK is used to sign zone data.
If wrong: The ZSK is used to sign zone data.

Q: Regarding DNSSEC, what are the new records created once a zone is signed?
- Key Signing Key
- Zone Signing Key
- Trust Anchor
- DNSSEC Resource Records
A: DNSSEC Resource Records
If right: Once a zone is signed, there are a number of new DNSSEC Resource records available. These records are in addition to the standard A, NS, and SRV records in an unsigned zone. These DNSSEC Resource records include DNSKEY, RRSIG, and NSEC.
If wrong: Once a zone is signed, there are a number of new DNSSEC Resource records available. These records are in addition to the standard A, NS, and SRV records in an unsigned zone. These DNSSEC Resource records include DNSKEY, RRSIG, and NSEC.

Q: What advantage does asynchronous replication offer over synchronous replication?
- Application performance is typically improved
- Data latency is typically reduced
- Data concurrency is typically higher
- Storage systems can be purchased with lower specifications
A: Application performance is typically improved
If right: Application performance is typically improved since the asynchronous replication to the remote site occurs on a scheduled basis, removing the need to wait for a successful acknowledgment of replication completion as with synchronous replication.
If wrong: Application performance is typically improved since the asynchronous replication to the remote site occurs on a scheduled basis, removing the need to wait for a successful acknowledgment of replication completion as with synchronous replication.

Q: In a Windows Server 2012 failover cluster, after how many missed heartbeats in a row will a node become failed?
- 3
- 5
- 7
- 9
A: 5
If right: If a node misses five heartbeats in a row, another node will initiate failover.
If wrong: If a node misses five heartbeats in a row, another node will initiate failover.

Q: Which of the following quorum configurations would not be acceptable for a multi-site cluster configuration? (Choose all that apply)
- Node Majority
- Node and Disk Majority
- Node and File Share Majority
- No Majority
A: Node Majority; No Majority
If right: Because sites are geographically dispersed, you cannot use a quorum configuration that requires a witness disk. If there is an odd number of nodes, then use the Node Majority quorum. If there is an even number of nodes, which is typical in a geographically dispersed cluster, you can use the Node Majority with File Share Majority quorum.
If wrong: Because sites are geographically dispersed, you cannot use a quorum configuration that requires a witness disk. If there is an odd number of nodes, then use the Node Majority quorum. If there is an even number of nodes, which is typical in a geographically dispersed cluster, you can use the Node Majority with File Share Majority quorum.

Q: Which of the following initial replication methods might be best for organizations that wish to configure Hyper-V replication across a slow network connection?
- Send initial copy over the network
- Send initial copy using external media
- Use an existing virtual machine on the Replica server as the initial copy
- Use an existing virtual machine on the Target server as the initial copy
A: Send initial copy using external media
If right: The Send initial copy using external media option may be the best option in this scenario.
If wrong: The Send initial copy using external media option may be the best option in this scenario.

Q: What is the biggest drawback when using Hyper-V replication?
- The replication must be configured individually on each VM
- The replication can use a large amount of network bandwidth
- The replica VM is a cold VM that must be manually brought online
- The replica VM must be configured to utilize a different IP than the original VM
A: The replica VM is a cold VM that must be manually brought online
If right: The Hyper-V replica is a cold server that must be brought online when the primary site is unavailable.
If wrong: The Hyper-V replica is a cold server that must be brought online when the primary site is unavailable.

Q: What is the primary security implication of choosing the Kerberos authentication option over the certificate-based authentication option when configuring Hyper-V replication?
- Kerberos provides mutual authentication of the client and server
- The data will not be encrypted while in transit on the network
- The data will be compressed while in transit on the network
- Kerberos requires that the KDC be functional and reachable
A: The data will not be encrypted while in transit on the network
If right: When you select the Kerberos authentication (HTTP) option, you will not be able to encrypt the replication data while it is being transmitted over the network. Compression is an option with either authentication method. The other statements regarding Kerberos are true of Kerberos in general, but they really have nothing to do with this scenario.
If wrong: When you select the Kerberos authentication (HTTP) option, you will not be able to encrypt the replication data while it is being transmitted over the network. Compression is an option with either authentication method. The other statements regarding Kerberos are true of Kerberos in general, but they really have nothing to do with this scenario.

Q: What extensions must be present in the enhanced key usage (EKU) section of the digital certificate to be used for Hyper-V replica? (Choose all correct answers)
- Code Signing
- Response Provider
- Client Authentication
- Server Authentication
A: Client Authentication; Server Authentication
If right: The certificate must include both client and server authentication extensions for enhanced key usage (EKU).
If wrong: The certificate must include both client and server authentication extensions for enhanced key usage (EKU).

Q: What must you use to apply encryption to replication traffic for Hyper-V replica?
- IPSec
- X.25
- X.509
- SSH
A: X.509
If right: To apply encryption to the replication traffic, you need to use certificate-based authentication (HTTPS). You then need to use an existing X.509v3 certificate or create a self-signed certificate.
If wrong: To apply encryption to the replication traffic, you need to use certificate-based authentication (HTTPS). You then need to use an existing X.509v3 certificate or create a self-signed certificate.

Q: In what way might using a multi-site failover cluster to provide Hyper-V VMs be a better option than using Hyper-V replication?
- There is no shared storage used
- Windows does not include a built-in mechanism for data replication
- A multi-site cluster has lower hardware requirements
- A multi-site cluster automatically fails over the clustered service or application to another
A: A multi-site cluster automatically fails over the clustered service or application to another
If right: A multi-site failover cluster has the following advantages, as compared to a replica VM: - When a failure occurs, a multi-site cluster automatically fails over the clustered service or application to another. - Because a site fails over automatically, a multi-site cluster has less administrative overhead than a cold standby server, which needs to be turned on and configured.
If wrong: A multi-site failover cluster has the following advantages, as compared to a replica VM: - When a failure occurs, a multi-site cluster automatically fails over the clustered service or application to another. - Because a site fails over automatically, a multi-site cluster has less administrative overhead than a cold standby server, which needs to be turned on and configured.

Q: In order for a digital certificate to be considered valid, what conditions must it generally meet? (Choose all that apply)
- The certificate must posses required EKU attributes.
- The certificate must terminate at a valid root certificate.
- The certificate must not be expired or revoked.
- The certificate must be 2048 bits or longer for key length.
A: The certificate must terminate at a valid root certificate.; The certificate must not be expired or revoked.
If right: While the EKU attributes will be required for specific usages of digital certificates, they are not a factor in determining if the certificate itself is valid or invalid. Key length of 2048 bits or higher is recommended, but again it has no bearing on the validity of the certificate.
If wrong: While the EKU attributes will be required for specific usages of digital certificates, they are not a factor in determining if the certificate itself is valid or invalid. Key length of 2048 bits or higher is recommended, but again it has no bearing on the validity of the certificate.

Q: When configuring the subject common name (CN) on an X.509 digital certificate to be used for Hyper-V replication, what value should be used for the subject CN if a failover cluster hosts the VM?
- The FQDN of the Hyper-V Replica Broker
- The NetBIOS name of the Hyper-V Replica Broker
- The FQDN of the Hyper-V cluster name
- The NetBIOS name of the Hyper-V cluster name
A: The FQDN of the Hyper-V Replica Broker
If right: If the VM is hosted by a failover cluster, the subject common name (CN) should contain the FQDN of the Hyper-V Replica Broker.
If wrong: If the VM is hosted by a failover cluster, the subject common name (CN) should contain the FQDN of the Hyper-V Replica Broker.

Q: When configuring the subject common name (CN) on an X.509 digital certificate to be used for Hyper-V replication, what value should be used for the subject CN if a standalone server hosts the VM?
- The FQDN of the Hyper-V Replica Broker
- The NetBIOS name of the Hyper-V Replica Broker
- The FQDN of the Hyper-V host
- The NetBIOS name of the Hyper-V host
A: The FQDN of the Hyper-V host
If right: If the VM is hosted by a standalone server, the subject common name (CN) contains the fully qualified domain name (FQDN) of the host.
If wrong: If the VM is hosted by a standalone server, the subject common name (CN) contains the fully qualified domain name (FQDN) of the host.

Q: When configuring Split Scopes for DHCP, what is the traditional percentage split of the scope range?
- 50% to the primary server, 50% to the secondary server
- 60% to the primary server, 40% to the secondary server
- 70% to the primary server, 30% to the secondary server
- 80% to the primary server, 20% to the secondary server
A: 80% to the primary server, 20% to the secondary server
If right: For years, if you wanted high availability, you would use a split-scope configuration, also known as the 80-20 configuration. It is known as the 80-20 configuration because the primary server is assigned 80 percent of the available addresses, whereas the secondary server is assigned 20 percent of the available addresses.
If wrong: For years, if you wanted high availability, you would use a split-scope configuration, also known as the 80-20 configuration. It is known as the 80-20 configuration because the primary server is assigned 80 percent of the available addresses, whereas the secondary server is assigned 20 percent of the available addresses.

Q: Which DHCP client option is used to provide a list of IP addresses for WINS servers?
- Option 3
- Option 6
- Option 15
- Option 44
A: Option 44
If right: Option 44 specifies a list of IP addresses for WINS name servers available to the client.
If wrong: Option 44 specifies a list of IP addresses for WINS name servers available to the client.

Q: When configuring DHCP failover partners, the time synchronization between the partners is critical. What is the maximum allowable time skew between DHCP failover partners?
- 15 seconds
- 30 seconds
- 45 seconds
- 60 seconds
A: 60 seconds
If right: DHCP failover is time sensitive. The time between partners must be no greater than one minute. If the time is greater, the failover process will halt with a critical error.
If wrong: DHCP failover is time sensitive. The time between partners must be no greater than one minute. If the time is greater, the failover process will halt with a critical error.

Q: Which DHCP client option is used to provide a list of IP addresses for the default gateway to the client?
- Option 3
- Option 6
- Option 15
- Option 44
A: Option 3
If right: Option 3 specifies a list of IP addresses for the default gateway or router on the client's subnet.
If wrong: Option 3 specifies a list of IP addresses for the default gateway or router on the client's subnet.

Q: In which scenario would you want to disable SID filtering?
- There is no trust between all Domain Admins and Enterprise Admins within both trusts
- Forests have been renamed
- Domains have been authoritatively restored
- User accounts have been involved in a domain migration
A: User accounts have been involved in a domain migration
If right: User accounts have been involved in a domain migration. If a domain migration has been done, a user will be given a new principle SID in relation to the domain he or she has been migrated to while maintaining the old SID in the sIDHistory attribute. If the administrator migrated the previous SIDs, the sIDHistory attribute will be populated with the old SID. The previous SID might have been kept to retain access to network resources in the old domain. This can cause problems because if the old SID is filtered off within a trust, the user will lose access to resources still pointing to the old SID.
If wrong: User accounts have been involved in a domain migration. If a domain migration has been done, a user will be given a new principle SID in relation to the domain he or she has been migrated to while maintaining the old SID in the sIDHistory attribute. If the administrator migrated the previous SIDs, the sIDHistory attribute will be populated with the old SID. The previous SID might have been kept to retain access to network resources in the old domain. This can cause problems because if the old SID is filtered off within a trust, the user will lose access to resources still pointing to the old SID.

Q: When using the netdom command to validate a trust, what specific switch will you need to use to ensure validation is performed?
- /test
- /validate
- /verify
- /checkPW
A: /verify
If right: You will use the /verify switch to validate the trust.
If wrong: You will use the /verify switch to validate the trust.

Q: When disabling SID filtering on a forest trust, what netdom switch should be used?
- /disenablesidhistory:Yes
- /enablesidhistory:No
- /quarantine:No
- /sidhistory:Disable
A: /enablesidhistory:No
If right: You will use the /enablesidhistory:No switch to disable SID filtering for the forest trust.
If wrong: You will use the /enablesidhistory:No switch to disable SID filtering for the forest trust.

Q: When do you want to enable domain-wide authentication for a trust?
- When all users in the trusted forest need to authenticate against the trusting domain
- When all users in the trusted domain need to authenticate against the trusting domain
- When all users in the trusted domain need to authenticate against the trusting forest
- When all users in the trusted forest need to authenticate against the trusting forest
A: When all users in the trusted domain need to authenticate against the trusting domain
If right: Enable domain-wide authentication when all users in the trusted domain need to authenticate against the trusting domain.
If wrong: Enable domain-wide authentication when all users in the trusted domain need to authenticate against the trusting domain.

Q: Which of the following scenarios would allow the creation of a shortcut trust? (Choose all that apply)
- Between a third-level child domain and a second-level child domain in a different domain tree of the same forest
- Between two third-level child domains in the same forest
- Between two second-level child domains in different forests
- Between a third-level child domain and a forest root domain in different forests
A: Between a third-level child domain and a second-level child domain in a different domain tree of the same forest; Between two third-level child domains in the same forest
If right: You will not be able to create a shortcut trust between two domains in separate forests.
If wrong: You will not be able to create a shortcut trust between two domains in separate forests.

Q: Which of the following is not a scope of trust authentication?
- Selective authentication
- Domain-wide authentication
- Server authentication
- Forest-wide authentication
A: Server authentication
If right: There are three scopes of trust authentication: selective authentication, domain-wide authentication, and forest-wide authentication.
If wrong: There are three scopes of trust authentication: selective authentication, domain-wide authentication, and forest-wide authentication.

Q: Which of the following commands correctly illustrates how to create a one-way external trust from the adatum.local domain to the contoso.local domain?
- netdom trust adatum.local /Domain:contoso.local /add
- netdom -addtrust /Local:adatum.local /External:contoso.local
- netdom trust –add adatum.local /Domain:contoso.local
- netdom –add /trust adatum.local /Domain:contoso.local
A: netdom trust adatum.local /Domain:contoso.local /add
If right: In this scenario, you would need to run the netdom trust adatum.local /Domain:contoso.local /add command to create the trust.
If wrong: In this scenario, you would need to run the netdom trust adatum.local /Domain:contoso.local /add command to create the trust.

Q: To create a forest trust, which of the following requirements must be met? (Choose all that apply)
- Both domains involved in the trust must be the forest root domain
- Both domains involved in the trust must be at the Windows Server 2000 native domain functional level or higher
- Both domains involved in the trust must be at the Windows Server 2003 forest functional level or higher
- Both domains involved in the trust must be involved in an acquisition or merger
A: Both domains involved in the trust must be the forest root domain; Both domains involved in the trust must be at the Windows Server 2003 forest functional level or higher
If right: To create a forest trust, both domains of the trust must be the forest root domain and have a forest functional level of Windows Server 2003 or higher. Additionally, DNS will need to be able to support name resolution between the forests.
If wrong: To create a forest trust, both domains of the trust must be the forest root domain and have a forest functional level of Windows Server 2003 or higher. Additionally, DNS will need to be able to support name resolution between the forests.

Q: Which of the following attributes are true when discussing manually created trusts?
- The trust is two-way between the child domain and the root domain
- The trust can be configured to be one-way or two-way
- The trust can be configured to be incoming or outgoing, or both
- The trust is always transitive
A: The trust can be configured to be one-way or two-way; The trust can be configured to be incoming or outgoing, or both
If right: Manually created trusts can be created to connect two domains within the same forest to one another, or to a forest or domain in a completely separate enterprise. These trusts can be one-way or two-way trusts and can be transitive or nontransitive in nature.
If wrong: Manually created trusts can be created to connect two domains within the same forest to one another, or to a forest or domain in a completely separate enterprise. These trusts can be one-way or two-way trusts and can be transitive or nontransitive in nature.

Q: What is the disadvantage of configuring selective authentication for a trust?
- The inability to definitively control who is accessing what resources
- The administrative overhead involved to configure and maintain user access to resources
- The SIDs of the foreign security principals will need to be manually obtained
- Security groups from the external domain must be used for the foreign security principals
A: The administrative overhead involved to configure and maintain user access to resources
If right: The downside of implementing selective authentication is the administrative overhead involved to configure and maintain user access to resources. Each member server or computer account in the trusting domain that holds a required resource needs to be configured to allow authentication to the users in the trusted domain.
If wrong: The downside of implementing selective authentication is the administrative overhead involved to configure and maintain user access to resources. Each member server or computer account in the trusting domain that holds a required resource needs to be configured to allow authentication to the users in the trusted domain.

Q: You have just created a two-way trust in your domain to an external domain used by a partner company to allow your domain’s users to access a resource in the partner’s domain. What is the next step that will need to be performed to complete the trust?
- You will need to create two one-way outgoing trusts in the external domain
- The partner will need to create a two-way trust in the external domain
- You will need to create a two-way incoming trust in your domain
- The partner will need to create two one-way trusts in your domain
A: The partner will need to create a two-way trust in the external domain
If right: Similarly to the creation of the one-way trust, the administrator in the external domain will need to create the two-way trust in their domain to complete the process you started by creating the two-way trust first in your domain.
If wrong: Similarly to the creation of the one-way trust, the administrator in the external domain will need to create the two-way trust in their domain to complete the process you started by creating the two-way trust first in your domain.

Q: What type of trust allows users to authenticate and access resources in a non-Windows Kerberos v5 realm, or allows users in a non-Windows Kerberos v5 realm access to resources in an AD DS domain?
- Realm trusts
- Shortcut trusts
- Forest trusts
- External trusts
A: Realm trusts
If right: Realm trusts are used to allow users to authenticate and access resources in a non-Windows Kerberos v5 realm, or to allow users in a non-Windows Kerberos v5 realm access to resources in an AD DS domain.
If wrong: Realm trusts are used to allow users to authenticate and access resources in a non-Windows Kerberos v5 realm, or to allow users in a non-Windows Kerberos v5 realm access to resources in an AD DS domain.

Q: What type of trust is a one-way or two-way nontransitive trust between domains that are not in the same forest, and that are not already included in a forest trust?
- Realm trusts
- Shortcut trusts
- Forest trusts
- External trusts
A: External trusts
If right: An external trust is a one-way or two-way nontransitive trust between domains that are not in the same forest, and that are not already included in a forest trust. External trusts connect two domains in separate forests to allow users in the trusted domain the capability to authenticate and/or access resources in the trusting domain.
If wrong: An external trust is a one-way or two-way nontransitive trust between domains that are not in the same forest, and that are not already included in a forest trust. External trusts connect two domains in separate forests to allow users in the trusted domain the capability to authenticate and/or access resources in the trusting domain.

Q: What type of trust allows users of an internal forest to authenticate to and/or gain access to all resources of an external forest?
- Realm trusts
- Shortcut trusts
- Forest trusts
- External trusts
A: Forest trusts
If right: Forest trusts are implemented when users of an internal forest need to authenticate to and/or gain access to all resources of an external forest.
If wrong: Forest trusts are implemented when users of an internal forest need to authenticate to and/or gain access to all resources of an external forest.

Q: To enable foreign security principals to access the shared folder with the UNC path of \\SERVER1\DocsShare, what permission(s) will you need to configure on the ACL of SERVER1 for the foreign security principals?
- Full Control
- Allowed to Authenticate
- Read
- Read and Allowed to Authenticate
A: Read and Allowed to Authenticate
If right: You will need to allow the foreign security principals read access to the server, and also the Allowed to authenticate permission, before you can grant access to the share hosted on the server.
If wrong: You will need to allow the foreign security principals read access to the server, and also the Allowed to authenticate permission, before you can grant access to the share hosted on the server.

Q: Which of the following scenarios represents the best reason for creating a forest trust between two Active Directory forests?
- Company A has purchased Company B
- Company A wants to use an application developed by Company B
- Company B wants to access data on a Company A web server
- Company B wants to send email to recipients in Company A
A: Company A has purchased Company B
If right: Consider creating forest trusts in the following scenarios: - Integrating two forests during an acquisition or merger - Collaborating two businesses closely with one another - Combining all resources and users of a single company with multiple forests - Accessing an application provided by a service provider in a forest with another user forest
If wrong: Consider creating forest trusts in the following scenarios: - Integrating two forests during an acquisition or merger - Collaborating two businesses closely with one another - Combining all resources and users of a single company with multiple forests - Accessing an application provided by a service provider in a forest with another user forest

Q: The creation of a trust between external forests or domains depends on both sides of the trust (domains or forests, as applicable) being able to resolve the forest or domain names on each side of the trust. Which DNS configuration is most commonly used in the real world?
- Configure conditional forwarders
- Configure a shared DNS server
- Configure secondary zones
- None of the above
A: Configure conditional forwarders
If right: Considered to be the most common configuration in real-world environments, you can configure conditional forwarders in each domain or forest to route name resolution to the DNS servers of the domains or forests included in the trust.
If wrong: Considered to be the most common configuration in real-world environments, you can configure conditional forwarders in each domain or forest to route name resolution to the DNS servers of the domains or forests included in the trust.

Q: What type of trust can be used to improve performance when accessing resources in an internal forest?
- Realm trusts
- Shortcut trusts
- Forest trusts
- External trusts
A: Shortcut trusts
If right: A shortcut trust is a one-way or two-way transitive trust between domains that are in the same forest. Shortcut trusts are primarily used to improve performance when authenticating to and accessing resources in an internal forest.
If wrong: A shortcut trust is a one-way or two-way transitive trust between domains that are in the same forest. Shortcut trusts are primarily used to improve performance when authenticating to and accessing resources in an internal forest.

Q: Which of the following desirable features first became available with the Windows Server 2003 domain functional level?
- SYSVOL replication using DFSR instead of NTFRS
- Automatic SPN management
- LastLogonTimestamp attribute
- Fine-grained password policies
A: LastLogonTimestamp attribute
If right: The LastLogonTimestamp attribute first became available at the Windows Server 2003 domain functional level.
If wrong: The LastLogonTimestamp attribute first became available at the Windows Server 2003 domain functional level.

Q: Which of the following desirable features first became available with the Windows Server 2008 domain functional level?
- SYSVOL replication using DFSR instead of NTFRS
- Automatic SPN management
- Authentication mechanism assurance
- UserPassword attribute
A: SYSVOL replication using DFSR instead of NTFRS
If right: SYSVOL replication using DFSR instead of NTFRS enables the use of Distributed File System Replication (DFSR) instead of NT File Replication Service (NTFRS), which allows for more efficient and robust replication between domain controllers.
If wrong: SYSVOL replication using DFSR instead of NTFRS enables the use of Distributed File System Replication (DFSR) instead of NT File Replication Service (NTFRS), which allows for more efficient and robust replication between domain controllers.

Q: Which domain functional level is no longer supported by Windows Server 2012 domain controllers?
- Windows 2000 native
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2
A: Windows 2000 native
If right: Windows Server 2012 domain controllers do not support the Windows 2000 native mode functional level that was available with Windows Server 2008 R2 and earlier.
If wrong: Windows Server 2012 domain controllers do not support the Windows 2000 native mode functional level that was available with Windows Server 2008 R2 and earlier.

Q: To most effectively configure and use a Filtered Attribute Set, what should your domain and forest functional levels be, at a minimum?
- Windows Server 2003 or higher in the domain, Windows Server 2008 or higher in the forest
- Windows Server 2008 or higher in the domain, Windows Server 2008 or higher in the forest
- Windows Server 2012 in the domain, Windows Server 2008 or higher in the forest
- Windows Server 2008 or higher in the domain, Windows Server 2003 or higher in the forest
A: Windows Server 2008 or higher in the domain, Windows Server 2008 or higher in the forest
If right: Although configuring the Filtered Attribute Set does not require a forest functional level of Windows Server 2008, it is highly recommended, because malicious users can take advantage of attribute replication from Windows Server 2003 domain controllers. Windows Server 2003 domain controllers permit requested changes to be replicated, whether configured as confidential or not. When the forest functional level is raised to Windows Server 2008, there can be no Windows Server 2003 domain controllers in the forest.
If wrong: Although configuring the Filtered Attribute Set does not require a forest functional level of Windows Server 2008, it is highly recommended, because malicious users can take advantage of attribute replication from Windows Server 2003 domain controllers. Windows Server 2003 domain controllers permit requested changes to be replicated, whether configured as confidential or not. When the forest functional level is raised to Windows Server 2008, there can be no Windows Server 2003 domain controllers in the forest.

Q: Which of the following scenarios best represents an urgent replication-inducing event?
- A change in the domain account lockout policies
- The creation of a new user account in the domain
- The changing of a user account password
- Replication performed to correct a replication conflict
A: A change in the domain account lockout policies
If right: Urgent replication allows for critical directory information to be delivered to replica domain controllers without waiting the normal, non-urgent, fifteen-second and three-second subsequent intervals. Examples of directory updates that are urgently replicated include account lockouts, changes in account lockout policies, changes in the domain password policy, and changes of a domain controller account password.
If wrong: Urgent replication allows for critical directory information to be delivered to replica domain controllers without waiting the normal, non-urgent, fifteen-second and three-second subsequent intervals. Examples of directory updates that are urgently replicated include account lockouts, changes in account lockout policies, changes in the domain password policy, and changes of a domain controller account password.

Q: When you initiate the deletion of an RODC, you are given several options to choose from with actions you can take for the passwords that were cached on the RODC. Which of these options is the default configuration when you receive the prompt?
- Reset all passwords for user accounts that were cached on this Read-Only Domain Controller
- Reset all passwords for computer accounts that were cached on this Read-Only Domain Controller
- Export the list of accounts that were cached on this Read-Only Domain Controller to this file
- All of the above options
A: Reset all passwords for user accounts that were cached on this Read-Only Domain Controller; Export the list of accounts that were cached on this Read-Only Domain Controller to this file
If right: By default, the Reset all passwords for user accounts that were cached on this Read-Only Domain Controller and the Export the list of accounts that were cached on this Read-Only Domain Controller to this file check boxes are selected.
If wrong: By default, the Reset all passwords for user accounts that were cached on this Read-Only Domain Controller and the Export the list of accounts that were cached on this Read-Only Domain Controller to this file check boxes are selected.

Q: What requirements must be met in order to perform the configuration of the Filtered Attribute Set? (Choose all that apply)
- The Schema Master must be on a domain controller running Windows Server 2008 or Windows Server 2012
- The Schema Master must be on a domain controller running Windows Server 2012
- You must perform the change directly on the Schema Master
- You must perform the change at the command line using the netdom command
A: The Schema Master must be on a domain controller running Windows Server 2008 or Windows Server 2012; You must perform the change directly on the Schema Master
If right: To configure the Filtered Attribute Set, the configuration of the attribute must be done on a Windows Server 2008 or Windows Server 2012 domain controller that holds the Schema Master FSMO role.
If wrong: To configure the Filtered Attribute Set, the configuration of the attribute must be done on a Windows Server 2008 or Windows Server 2012 domain controller that holds the Schema Master FSMO role.

Q: When you mark an attribute as “Confidential” in the schema, what are you effectively doing?
- Enforcing attribute-level encryption on the data
- Disabling access to read or write that attribute other than to members of the Schema Admins groups
- Marking that attribute to not be replicated to an RODC
- Marking that attribute as requiring replication to an RODC
A: Marking that attribute to not be replicated to an RODC
If right: Implementing Filter Attribute Sets allows administrators the ability to mark attributes as Confidential when being replicated to RODCs. Attributes marked as confidential and that are part of the Filtered Attribute Set will not be replicated to an RODC.
If wrong: Implementing Filter Attribute Sets allows administrators the ability to mark attributes as Confidential when being replicated to RODCs. Attributes marked as confidential and that are part of the Filtered Attribute Set will not be replicated to an RODC.

Q: Why must an RODC be able to connect to at least one Windows Server 2008 or higher domain controller? (Choose all that apply)
- To replicate the domain partition
- To replicate the global catalog partition
- So that the Password Replication Policy (PRP) applied to the RODC can be configured and enforced
- So that the SYSVOL folder can be replicated using Distributed File System Replication (DFSR)
A: To replicate the domain partition; So that the Password Replication Policy (PRP) applied to the RODC can be configured and enforced
If right: Read-only domain controllers can only pull the domain partition from a writable Windows Server 2008 or higher domain controller. Additionally, the need to connect to a writable Windows Server 2008 domain controller is required because the Password Replication Policy (PRP) applied to the RODC can be configured and enforced only from a writable Windows Server 2008 domain controller.
If wrong: Read-only domain controllers can only pull the domain partition from a writable Windows Server 2008 or higher domain controller. Additionally, the need to connect to a writable Windows Server 2008 domain controller is required because the Password Replication Policy (PRP) applied to the RODC can be configured and enforced only from a writable Windows Server 2008 domain controller.

Q: What will happen if the SYSVOL or NETLOGON shares are open (being viewed) anywhere during the DFSR SYSVOL migration?
- The migration will fail silently and you will need to look at the netlogon.log file for error information
- The migration will fail, and you will be notified of the failure on screen
- The migration will succeed, but the domain controllers will require a reboot after the migration is done
- The migration will succeed, but the folders in the file system that correspond to the old share locations will not be deleted
A: The migration will succeed, but the folders in the file system that correspond to the old share locations will not be deleted
If right: If any of the shares are open, they will be locked and not deleted during the Eliminated state.
If wrong: If any of the shares are open, they will be locked and not deleted during the Eliminated state.

Q: On what domain controller should the DFSR SYSVOL migration process be performed from?
- Any writable domain controller in the domain
- Any global catalog server in the domain
- The PDC Emulator of the domain
- The Infrastructure Master of the domain
A: The PDC Emulator of the domain
If right: The migration process must be performed from the PDC Emulator of the domain.
If wrong: The migration process must be performed from the PDC Emulator of the domain.

Q: What minimum domain functional level will you need to be at before attempting to migrate to DFSR SYSVOL replication?
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012
A: Windows Server 2008
If right: To upgrade from FRS to DFSR, the domain functional level must be Windows Server 2008 or higher.
If wrong: To upgrade from FRS to DFSR, the domain functional level must be Windows Server 2008 or higher.

Q: What is the net result of deleting an RODC and leaving the “Reset all passwords for user accounts that were cached on this Read-Only Domain Controller” option selected?
- Users will be forced to use their previous password to log in the next time
- Users will be forced to request a password reset before they can log in the next time
- Users will be forced to request an account unlock before they can log in the next time
- Users will need to have their accounts rejoined to the domain before they can log in the next time
A: Users will be forced to request a password reset before they can log in the next time
If right: Users that had their user account passwords cached need to reset their password or contact the helpdesk to reset their passwords.
If wrong: Users that had their user account passwords cached need to reset their password or contact the helpdesk to reset their passwords.

Q: Which SYSVOL replication migration state is done entirely using DFSR?
- Start (State 0)
- Prepared (State 1)
- Redirected (State 2)
- Eliminated (State 3)
A: Eliminated (State 3)
If right: In Eliminated (State 3), all Live AD DS SYSVOL replication between domain controllers is performed using DFSR. FRS SYSVOL replication is removed, including the SYSVOL folder and its contents, if it was not open during the elimination operation. DFSR occurs with the SYSVOL_DFSR folder.
If wrong: In Eliminated (State 3), all Live AD DS SYSVOL replication between domain controllers is performed using DFSR. FRS SYSVOL replication is removed, including the SYSVOL folder and its contents, if it was not open during the elimination operation. DFSR occurs with the SYSVOL_DFSR folder.

Q: __________ define the logical replication path between sites to perform _________ replication, allowing for faster and optimized replication between sites based on configured costs and frequencies.
- Site links, Intrasite
- Replication links, Intersite
- Site links, Intersite
- Connection objects, Intrasite
A: Site links, Intersite
If right: Site links define the logical replication link between sites to perform Intersite replication, allowing for faster and optimized replication between sites based on configured costs and frequencies. Site links manage the logical flow of replication between physical sites.
If wrong: Site links define the logical replication link between sites to perform Intersite replication, allowing for faster and optimized replication between sites based on configured costs and frequencies. Site links manage the logical flow of replication between physical sites.

Q: Which SYSVOL replication migration state is done entirely using FRS?
- Start (State 0)
- Prepared (State 1)
- Redirected (State 2)
- Eliminated (State 3)
A: Start (State 0)
If right: In Start (State 0), live AD DS SYSVOL replication between domain controllers is performed using FRS. DFSR is not being performed. FRS replication occurs with the SYSVOL folder.
If wrong: In Start (State 0), live AD DS SYSVOL replication between domain controllers is performed using FRS. DFSR is not being performed. FRS replication occurs with the SYSVOL folder.

Q: Which PowerShell cmdlet is the correct one to use to create a new Active Directory site?
- New-ADSite
- New-ADReplicationSite
- New-ADSiteLocation
- Add-ADReplicationSite
A: New-ADReplicationSite
If right: You can use the New-ADReplicationSite cmdlet to create a new Active Directory site.
If wrong: You can use the New-ADReplicationSite cmdlet to create a new Active Directory site.

Q: Which of the following represents the best reason why you might want to prepopulate passwords on an RODC?
- To speed up the initial login for the user at that site
- To speed up every login for the user at that site
- To reduce replication traffic to that site
- To prevent security principals from needing to be added to the “Allowed RODC Password Replication Group” security group
A: To speed up the initial login for the user at that site
If right: Initial logons are faster, since the authentication process wont have to traverse the WAN to the closest, writable, Windows 2008 or later, domain controller. You must still add the security principals at that site to have their password prepopulated to the Allowed RODC Password Replication Group security group.
If wrong: Initial logons are faster, since the authentication process wont have to traverse the WAN to the closest, writable, Windows 2008 or later, domain controller. You must still add the security principals at that site to have their password prepopulated to the Allowed RODC Password Replication Group security group.

Q: What management console is used to manage Active Directory Sites?
- Active Directory Topology Manager
- Active Directory Sites and Services
- Active Directory Domains and Trusts
- Active Directory Sites and Subnets
A: Active Directory Sites and Services
If right: You will use the Active Directory Sites and Services console to manage Active Directory sites.
If wrong: You will use the Active Directory Sites and Services console to manage Active Directory sites.

Q: Which SYSVOL replication migration state is the first state in which DFSR replication is used as the primary replication mechanism?
- Start (State 0)
- Prepared (State 1)
- Redirected (State 2)
- Eliminated (State 3)
A: Redirected (State 2)
If right: In Redirected (State 2), live AD DS SYSVOL replication between domain controllers is performed using DFSR. A separate behind-the-scenes SYSVOL replication using FRS is performed on the domain controllers in parallel with the live replication.
If wrong: In Redirected (State 2), live AD DS SYSVOL replication between domain controllers is performed using DFSR. A separate behind-the-scenes SYSVOL replication using FRS is performed on the domain controllers in parallel with the live replication.

Q: What will happen to a client that needs to authenticate against Active Directory, but has no site defined for its subnet?
- The client will not be able to authenticate
- The client will be able to authenticate as long as it can contact a global catalog server
- The client will authenticate to a domain controller in another site, over the WAN link
- The client will use cached credentials until the site configuration is corrected
A: The client will authenticate to a domain controller in another site, over the WAN link
If right: If there are no sites defined or if they are defined improperly, the authentication or service request might get sent to another physical site. By crossing over the WAN to find resources and to authenticate against domain controllers in a separate site, increased latency and decreased response time to the client are highly likely across slow connections.
If wrong: If there are no sites defined or if they are defined improperly, the authentication or service request might get sent to another physical site. By crossing over the WAN to find resources and to authenticate against domain controllers in a separate site, increased latency and decreased response time to the client are highly likely across slow connections.

Q: Your organization has six offices spread over three cities in North America. At a minimum, how many Active Directory sites should you plan to have?
- One
- Three
- Six
- Eighteen
A: Three
If right: Sites should match up to physical locations, so since you operate offices in three cities, a minimum of three sites, but certainly no more than six if the links between offices in the same city are poor.
If wrong: Sites should match up to physical locations, so since you operate offices in three cities, a minimum of three sites, but certainly no more than six if the links between offices in the same city are poor.

Q: In which SYSVOL replication migration state is DFSR replication performed in the background?
- Start (State 0)
- Prepared (State 1)
- Redirected (State 2)
- Eliminated (State 3)
A: Prepared (State 1)
If right: In Prepared (State 1), live AD DS SYSVOL replication between domain controllers is performed using FRS. A separate behind-the-scenes SYSVOL replication using DFSR is performed on the domain controllers in parallel with the live replication.
If wrong: In Prepared (State 1), live AD DS SYSVOL replication between domain controllers is performed using FRS. A separate behind-the-scenes SYSVOL replication using DFSR is performed on the domain controllers in parallel with the live replication.

Q: Which PKI role in AD CS can be used to issue certificates to routers and switches?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: Network Device Enrollment Service
If right: The Network Device Enrollment Service component can be used to assign certificates to routers, switches, and other network devices.
If wrong: The Network Device Enrollment Service component can be used to assign certificates to routers, switches, and other network devices.

Q: Which PKI role in AD CS issues certificates and manages certificate validity?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: CA
If right: The CA issues certificates to users and computers, and services and manages certificate validity.
If wrong: The CA issues certificates to users and computers, and services and manages certificate validity.

Q: Which PKI role in AD CS is used to allow non-Windows operation system users to request certificates?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: CA Web Enrollment
If right: The CA Web Enrollment component provides a method to issue and renew certificates for users, computers, and devices that are not joined to the domain, are not connected directly to the network, or are for users of non-Windows operating systems.
If wrong: The CA Web Enrollment component provides a method to issue and renew certificates for users, computers, and devices that are not joined to the domain, are not connected directly to the network, or are for users of non-Windows operating systems.

Q: Which PKI role in AD CS is used to validate certificates?
- CA
- Online Responder
- Network Device Enrollment Service
- CA Web Enrollment
A: Online Responder
If right: The Online Responder provides the Online Certificate Status Protocol (OCSP), which is used to validate certificates.
If wrong: The Online Responder provides the Online Certificate Status Protocol (OCSP), which is used to validate certificates.

Q: What is the best way to fully back up the CA without backing up more than necessary?
- System state backup
- Full system backup
- CA backup using Certification Authority console
- Bare metal recovery
A: System state backup
If right: To get a full CA backup, you really need to back up the system state, as this includes the CA database, the registry and the IIS metabase. In practice, many CA administrators just script the backup of the CA database and perform a one-time (or periodic) backup of the system state, as that information (IIS metabase and registry for the CA) typically doesnt change. Youll want to include your CAPolicy.inf file as well as a listing of all published templates in your backup plans.
If wrong: To get a full CA backup, you really need to back up the system state, as this includes the CA database, the registry and the IIS metabase. In practice, many CA administrators just script the backup of the CA database and perform a one-time (or periodic) backup of the system state, as that information (IIS metabase and registry for the CA) typically doesnt change. Youll want to include your CAPolicy.inf file as well as a listing of all published templates in your backup plans.

Q: Why would you want to consider making the Root CA an offline CA?
- This improves certificate issuing speed
- This improves security of the root CA and its private keys
- This reduces the number of CAs you actively need to manage
- This prevents requests from inadvertently being sent to the Root CA
A: This improves security of the root CA and its private keys
If right: If a CA is compromised, all certificates issued by the CA and any subordinate CAs that are under the compromised CA (and corresponding issued certificates) are also considered compromised. To maximize the security of the root CA, the root CA can be disconnected from the network, and subordinate CAs are used to issue certificates to other subordinate CAs or to end users.
If wrong: If a CA is compromised, all certificates issued by the CA and any subordinate CAs that are under the compromised CA (and corresponding issued certificates) are also considered compromised. To maximize the security of the root CA, the root CA can be disconnected from the network, and subordinate CAs are used to issue certificates to other subordinate CAs or to end users.

Q: What is the benefit of using asymmetric encryption instead of symmetric encryption?
- Asymmetric encryption is faster to encrypt and decrypt
- Asymmetric encryption does not require out-of-band key exchange
- Asymmetric encryption does not require a complex infrastructure to manage private keys
- Asymmetric encryption does not require the usage of a digital certificate for the public keys
A: Asymmetric encryption does not require a complex infrastructure to manage private keys
If right: Unlike symmetric key algorithms, this method does not require a secure initial exchange of one or more secret keys to both sender and receiver. Instead, you can make the public key known to anyone and use the other key to encrypt or decrypt the data. The public key can be sent to someone or can be published within a digital certificate through a CA.
If wrong: Unlike symmetric key algorithms, this method does not require a secure initial exchange of one or more secret keys to both sender and receiver. Instead, you can make the public key known to anyone and use the other key to encrypt or decrypt the data. The public key can be sent to someone or can be published within a digital certificate through a CA.

Q: What options are available for the storage of the AD FS configuration settings? (Choose all that apply)
- SQL Server
- AD LDS or ADAM
- Windows Internal Database
- AD DS
A: SQL Server; Windows Internal Database
If right: The actual AD FS configuration settings (not the attribute store data) can either be stored in an SQL server instance or locally on the AD FS server within the Windows Internal Database.
If wrong: The actual AD FS configuration settings (not the attribute store data) can either be stored in an SQL server instance or locally on the AD FS server within the Windows Internal Database.

Q: What PowerShell cmdlet would you use to list the attribute stores currently configured for AD FS?
- List-ADFSAttributeStore
- Show-ADFSAttributeStore
- Display-ADFSAttributeStore
- Get-ADFSAttributeStore
A: Get-ADFSAttributeStore
If right: You will use the Get-ADFSAttributeStore cmdlet to list the attribute stores currently configured for AD FS.
If wrong: You will use the Get-ADFSAttributeStore cmdlet to list the attribute stores currently configured for AD FS.

Q: Which of the following are supported as attribute stores for AD FS?
- ADAM in Windows Server 2003, and AD LDS in Windows Server 2008 and higher
- Microsoft SQL Server 2005
- Microsoft SQL Server 2008
- All of the above
A: All of the above
If right: AD FS supports the following attribute stores: - Active Directory Application Mode (ADAM) in Windows Server 2003 - Active Directory Lightweight Directory Services (AD LDS) in Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 - Microsoft SQL Server 2005 (all editions) - Microsoft SQL Server 2008 (all editions) - A custom attribute store
If wrong: AD FS supports the following attribute stores: - Active Directory Application Mode (ADAM) in Windows Server 2003 - Active Directory Lightweight Directory Services (AD LDS) in Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 - Microsoft SQL Server 2005 (all editions) - Microsoft SQL Server 2008 (all editions) - A custom attribute store

Q: In order to utilize AD FS, what is the oldest version of Windows Server that any domain controller can be using?
- Windows Server 2003 SP1
- Windows Server 2008 SP1
- Windows Server 2008 R2
- Windows Server 2012
A: Windows Server 2003 SP1
If right: The domain controllers must be running a minimum of Windows Server 2003 with SP1.
If wrong: The domain controllers must be running a minimum of Windows Server 2003 with SP1.

Q: While testing AD FS claims-based authentication with a sample application, you encounter an error due to the self-signed certificate you opted to use. What can you do to eliminate this error? (Choose all that apply)
- Add the self-signed certificate to your computer’s Trusted Root Certification Authorities store
- Add the self-signed certificate to the application server’s Trusted Root Certification Authorities store
- Issue a valid certificate from your internal CA
- Configure AD FS to ignore self-signed certificate errors
A: Add the self-signed certificate to your computer’s Trusted Root Certification Authorities store; Issue a valid certificate from your internal CA
If right: You can either issue a valid certificate or configure your computer to trust the self-signed certificate.
If wrong: You can either issue a valid certificate or configure your computer to trust the self-signed certificate.

Q: By default, the AD FS server is configured with a claims provider trust named Active Directory. If you are communicating with other organizations, you need to create additional claims provider trusts for each federated organization. What options are available to get the data you need for the creation of these claims provider trusts? (Choose all that apply)
- Import data about the claims provider through the federation metadata
- Manually configure the claims provider trust
- Import data about the claims provider from a file
- Create a site-to-site VPN tunnel to bridge networks together
A: Import data about the claims provider through the federation metadata; Manually configure the claims provider trust; Import data about the claims provider from a file
If right: If you are communicating with other organizations, you need to create additional claims provider trusts for each federated organization. The Claims Provider Trust has similar options to the relying party trusts. The options include: - Import data about the claims provider through the federation metadata. - Import data about the claims provider from a file. - Manually configure the claims provider trust.
If wrong: If you are communicating with other organizations, you need to create additional claims provider trusts for each federated organization. The Claims Provider Trust has similar options to the relying party trusts. The options include: - Import data about the claims provider through the federation metadata. - Import data about the claims provider from a file. - Manually configure the claims provider trust.

Q: AD FS makes extensive use of HTTPS communications to provide data security. Which certificate is used by the claims provider to identify itself?
- Server communications certificate
- Token-signing certificate
- Token-decrypting certificate
- Root certificate
A: Token-signing certificate
If right: The token-signing certificate is used by the claims provider to identify itself and is used by the relying party to verify that the token is coming from a trusted federation partner. The relying party also requires a token-signing certificate to sign the tokens it prepares for AD FS.
If wrong: The token-signing certificate is used by the claims provider to identify itself and is used by the relying party to verify that the token is coming from a trusted federation partner. The relying party also requires a token-signing certificate to sign the tokens it prepares for AD FS.

Q: What add-on component can you download from the Microsoft.com website to create a test Windows Identity Foundation (WIF) application that you can use to test AD FS claims-based authentication?
- AD FS Claims-Based Authentication Accelerator
- Windows Identity Foundation SDK 4.0
- Windows Identity Foundation 3.5
- AD FS Sample Application Accelerator
A: Windows Identity Foundation SDK 4.0
If right: You would need to download and install the Windows Identity Foundation SDK 4.0 to create a sample WIF application for testing AD FS claims-based authentication.
If wrong: You would need to download and install the Windows Identity Foundation SDK 4.0 to create a sample WIF application for testing AD FS claims-based authentication.

Q: What benefit does Single Sign-On provide for application users?
- Prohibits users from being able to register multiple accounts within an application
- Prevents users from needing to remember multiple usernames and passwords
- Provides users an easy way to remember the login information for the application
- Provides for faster account lockout remediation
A: Prevents users from needing to remember multiple usernames and passwords
If right: Single Sign-On (SSO) for web-based applications prevents users from needing to remember multiple usernames and passwords, one for each application.
If wrong: Single Sign-On (SSO) for web-based applications prevents users from needing to remember multiple usernames and passwords, one for each application.

Q: Which of the following components of Active Directory Federaation Services is the application or web service that accepts claims?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Relying party
If right: The Relying party is the application or web service that accepts claims from the claims provider.
If wrong: The Relying party is the application or web service that accepts claims from the claims provider.

Q: Which of the following components of Active Directory Federaation Services is the server that issues claims and authenticates users?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Claims provider
If right: The claims provider is the server that issues claims and authenticates users.
If wrong: The claims provider is the server that issues claims and authenticates users.

Q: Which of the following commands would be the best option to use to configure a new AD FS farm using the Windows Internal Database?
- fsconfig.exe StandAlone
- fsconfig.exe CreateFarm
- fsconfig.exe CreateSQLFarm
- fsconfig.exe JoinFarm
A: fsconfig.exe CreateFarm
If right: You will need to use the fsconfig.exe CreateFarm command to configure a new AD FS farm using the Windows Internal Database.
If wrong: You will need to use the fsconfig.exe CreateFarm command to configure a new AD FS farm using the Windows Internal Database.

Q: Which of the following components of Active Directory Federation Services is responsible for forwarding packets from external hosts to internal federation servers?
- Federation server proxy
- Claims provider
- Relying party
- Claim
A: Federation server proxy
If right: The Federation server proxy is an optional component that is usually deployed in a perimeter network such as DMZ that can receive externally and forward the packets to the internal federation server.
If wrong: The Federation server proxy is an optional component that is usually deployed in a perimeter network such as DMZ that can receive externally and forward the packets to the internal federation server.

Q: What are the contents of the certificate chain?
- It is a list of all trusted root certificates
- It is a list of certificate authorities that can be used to authenticate an entity certificate
- It is a list of all trusted root certificate authorities
- It is a list of certificates that can be used to authenticate an entity certificate
A: It is a list of certificates that can be used to authenticate an entity certificate
If right: The certificate chain, also known as the certification path, is a list of certificates used to authenticate an entity. It begins with the certificate of the entity and ends with the root CA certificate.
If wrong: The certificate chain, also known as the certification path, is a list of certificates used to authenticate an entity. It begins with the certificate of the entity and ends with the root CA certificate.

Q: When you configure and use Active Directory Rights Management (AD RMS) in your network, what provides the extra level of security on the documents and email messages?
- Rights
- Encryption
- Permissions
- Keys
A: Encryption
If right: Active Directory Rights Management Services (AD RMS) is technology used to provide an extra level of security to documents such as email and Microsoft Office documents by using encryption to limit who can access a document or web page and what can be done with a document or web page. This protection goes above the normal constraints, and usage, of rights and permissions.
If wrong: Active Directory Rights Management Services (AD RMS) is technology used to provide an extra level of security to documents such as email and Microsoft Office documents by using encryption to limit who can access a document or web page and what can be done with a document or web page. This protection goes above the normal constraints, and usage, of rights and permissions.

Q: What is the best reason you might choose to use RMS templates when configuring RMS policies across your organization?
- They allow you to standardize the implementation of AD RMS policies across the organization.
- They allow you to speed up the implementation of AD RMS policies across the organization.
- They allow you to delegate the implementation of AD RMS policies across the organization.
- They allow you to visualize the implementation of AD RMS policies across the organization.
A: They allow you to standardize the implementation of AD RMS policies across the organization.
If right: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content. They allow you to standardize implementing AD RMS policies across the organization. For example, one template may be used on documents to grant view-only rights, which blocks the ability to edit, save, or print.
If wrong: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content. They allow you to standardize implementing AD RMS policies across the organization. For example, one template may be used on documents to grant view-only rights, which blocks the ability to edit, save, or print.

Q: The AD RMS certificate issued to computers that are not part of the trusted forest where the AD RMS cluster is located is known as what?
- Server licensor certificate
- Rights account certificate
- Client licensor certificate
- Temporary rights account certificate
A: Temporary rights account certificate
If right: A temporary rights account certificate is issued to users who are accessing AD RMS-protected content from a computer that is not a member of the same or trusted forest as the AD RMS cluster.
If wrong: A temporary rights account certificate is issued to users who are accessing AD RMS-protected content from a computer that is not a member of the same or trusted forest as the AD RMS cluster.

Q: The AD RMS certificate issued the first time a user attempts to access AD RMS-protected content is known as what?
- Server licensor certificate
- Rights account certificate
- Client licensor certificate
- Temporary rights account certificate
A: Rights account certificate
If right: The rights account certificate, which is used to identify a specific user, is issued the first time a user attempts to access AD RMS-protected content.
If wrong: The rights account certificate, which is used to identify a specific user, is issued the first time a user attempts to access AD RMS-protected content.

Q: The AD RMS certificate that contains the private key used to encrypt the content key in a publishing licensing is known as what?
- Server licensor certificate
- Rights account certificate
- Client licensor certificate
- Temporary rights account certificate
A: Server licensor certificate
If right: The server licensor certificate is the certificate that contains the public key that encrypts the content key in a publishing license.
If wrong: The server licensor certificate is the certificate that contains the public key that encrypts the content key in a publishing license.

Q: Which of the following represents the correctly formatted command to recover the keys from the CA database?
- certutil –getkey 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
- certutil –recover jdoe@contoso.local c:\outfile
- certutil –exportBlob 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
- certutil –getkey E491A9091F91DB1E4750EB05ED5E79842DEB36A2574C55EC8B1989DEF94B6CF507AB223002E8183EF85009D37F41A898F9D1CA669C246B11D0A3BBE41B2AC31F959E7A0CA4478B5BD4163733CBC40F4DCE1469D1C91972F55D0ED57F5F9BF22503BA558F4D5D0DF1643523154B15591DB394F7F69C9ECF50BAC15850678F08B420F7CBAC2C206F70B63F01308CB743CF0F9D3DF32B49281AC8FECEB5B90ED95E1CD6CB3DB53AADF40F0E00920BB121162E74D53C0DDB6216ABA37192475355C1AF2F41B3F8FBE370CDE6A34C457E1F4C6B50964189C474620B10834187338A81B13058EC5A04328C68B38F1DDE6573FF675E65BC49D8769F331465A17794C92D c:\outfile
A: certutil –getkey 2BD06947947609FEF46B8D2E40A6F7474D7F085E c:\outfile
If right: You will need to use the certutil –getkey <serial number> c:\outfile command to perform the initial export from the CA database. The other option that has the correct command is actually using the public key of the certificate, not the serial number of the certificate.
If wrong: You will need to use the certutil –getkey <serial number> c:\outfile command to perform the initial export from the CA database. The other option that has the correct command is actually using the public key of the certificate, not the serial number of the certificate.

Q: The AD RMS certificate that allows a user to publish AD RMS-protected content when the client computer is not connected to the same network as the AD RMS cluster is known as what?
- Server licensor certificate
- Rights account certificate
- Client licensor certificate
- Temporary rights account certificate
A: Client licensor certificate
If right: The client licensor certificate allows a user to publish AD RMS-protected content when the client computer is not connected to the same network as the AD RMS cluster.
If wrong: The client licensor certificate allows a user to publish AD RMS-protected content when the client computer is not connected to the same network as the AD RMS cluster.

Q: When performing key recovery as a KRA, in what format will you retrieve the key from the database?
- Base64-encoded X.509
- DER-encoded binary X.509
- Personal Information Exchange (PKCS #12)
- Cryptographic Message Syntax Standard (PKCS #7)
A: Cryptographic Message Syntax Standard (PKCS #7)
If right: When you need to recover a certificate key, you will first retrieve the PKCS #7 BLOB from the database and then convert the file to a PKCS #12 (.pfx).
If wrong: When you need to recover a certificate key, you will first retrieve the PKCS #7 BLOB from the database and then convert the file to a PKCS #12 (.pfx).

Q: To recover a key from the CA database using the certutil utility, what information will you need to know about the certificate?
- The password for the private keys
- The certificate serial number
- The certificate subject name
- The certificate key length
A: The certificate serial number
If right: You will need to locate the certificate serial number for the certificate using the Certification Authority console.
If wrong: You will need to locate the certificate serial number for the certificate using the Certification Authority console.

Q: As a security precaution, what should you do immediately after you have configured a CA to issue a KRA certificate?
- Configure the ACL on the template with the specific security principals who will be designated KRAs
- Perform a backup of the CA database
- Perform a backup of the server’s system state
- Publish a new Certificate Revocation List (CRL)
A: Configure the ACL on the template with the specific security principals who will be designated KRAs
If right: When you have configured CA to issue a KRA certificate, any user with Read and Enroll permission on the KRA certificate template can enroll and become a KRA. You should assign the KRA certificate to trusted users only.
If wrong: When you have configured CA to issue a KRA certificate, any user with Read and Enroll permission on the KRA certificate template can enroll and become a KRA. You should assign the KRA certificate to trusted users only.

Q: What must you do immediately after issuing the first KRA certificate to a trusted user to enable key archival and recovery on the CA? (Choose all that apply)
- Restart the CA
- Configure key archival on the CA properties
- Archive the keys for the issued KRA certificate
- Perform a backup of the CA database
A: Configure key archival on the CA properties; Archive the keys for the issued KRA certificate
If right: If you hadnt configured key archival ahead of time, you need to do that immediately (before you forget and before disaster strikes!), then youll possibly also need to manually archive the keys for the KRA certificate(s) you just issued. Going forward, the CA will automatically archive the keys once the configuration has been made.
If wrong: If you hadnt configured key archival ahead of time, you need to do that immediately (before you forget and before disaster strikes!), then youll possibly also need to manually archive the keys for the KRA certificate(s) you just issued. Going forward, the CA will automatically archive the keys once the configuration has been made.

Q: In addition to the permissions required on the certificate templates used for autoenrollment, what other requirements must be met to support autoenrollment in your organization? (Choose all that apply)
- The certificate template must be a version 3 or higher
- The issuing CA must be a standalone CA
- DNS must be configured to support autoenrollment
- Group Policy must be configured to support autoenrollment
A: The issuing CA must be a standalone CA; Group Policy must be configured to support autoenrollment
If right: Most certificates will be assigned through autoenrollment and are deployed using group policies. Autoenrollment can be applied only to enterprise CA (not standalone CA), and you have to deploy schema template version 2 or higher.
If wrong: Most certificates will be assigned through autoenrollment and are deployed using group policies. Autoenrollment can be applied only to enterprise CA (not standalone CA), and you have to deploy schema template version 2 or higher.

Q: What minimum certificate version is required to enable key archival and recovery?
- Version 1
- Version 2
- Version 3
- Version 4
A: Version 2
If right: You can apply a key archival in a version 2 (or higher) certificate template, which then makes the CA store the subjects private key in the CA database as certificates are requested.
If wrong: You can apply a key archival in a version 2 (or higher) certificate template, which then makes the CA store the subjects private key in the CA database as certificates are requested.

Q: Which of the following permissions must be configured on the ACL of a certificate template in order for a user to be able to automatically enroll for the certificate via Group Policy? (Choose all that apply)
- Read
- Write
- Enroll
- Autoenroll
A: Read; Enroll; Autoenroll
If right: The Autoenroll permission requires the user or computer to also have both Read and Enroll permissions for a certificate template. You will also need to configure a Group Policy Object (or Group Policy Preference for more advanced scenarios) to put the users in the scope of autoenrollment.
If wrong: The Autoenroll permission requires the user or computer to also have both Read and Enroll permissions for a certificate template. You will also need to configure a Group Policy Object (or Group Policy Preference for more advanced scenarios) to put the users in the scope of autoenrollment.

Q: Which of the following URLs would be the correct one to visit to get to the Web Enrollment pages?
- https://<servername>/certificates
- https://<servername>/ca
- https://<servername>/certsrv
- https://<servername>/certsrvcs
A: https://<servername>/ca
If right: The CA Web enrollment uses a website on a CA to obtain certificates. The website uses Internet Information Server (IIS), and the AD CS web enrollment role has been installed and configured. The URL to make a request is https://<servername>/certsrv. It is mandatory to configure this site to use SSL.
If wrong: The CA Web enrollment uses a website on a CA to obtain certificates. The website uses Internet Information Server (IIS), and the AD CS web enrollment role has been installed and configured. The URL to make a request is https://<servername>/certsrv. It is mandatory to configure this site to use SSL.

Q: Your organization issues certificates for code signing and user authentication to employees from a Windows Server 2012–based certificate authority. In what folders of the Certificates MMC snap-in would a user find the certificates that have been issued to him or her? (Choose all that apply)
- Personal
- Trusted People
- Other People
- Active Directory User Object
A: Personal; Active Directory User Object
If right: Your users will find their certificates duplicated in both the Personal and Active Directory User Object folders in most cases.
If wrong: Your users will find their certificates duplicated in both the Personal and Active Directory User Object folders in most cases.

Q: What usages does the User certificate allow by default? (Choose all that apply)
- Secure Email
- Encrypting File System
- Client Authentication
- Document Signing
A: Secure Email; Encrypting File System; Client Authentication
If right: The User certificate allows for Secure Email, Encrypting File System, and Client Authentication by default.
If wrong: The User certificate allows for Secure Email, Encrypting File System, and Client Authentication by default.

Q: What is the name of the objects that are used to enforce the rights a user or group has on rights-protected content?
- Protections policy templates
- Rights policy templates
- Restrictions policy templates
- Rights protection templates
A: Rights policy templates
If right: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content.
If wrong: Rights policy templates, also known as RMS templates, are used to enforce the rights that a user or group has on rights-protected content.

Q: To enable mobile devices running Windows Mobile 6 and above operating systems to obtain certificates and licenses for their users, you will need to edit the NTFS permissions of a file. What file must you edit the permissions for?
- MobileDeviceConfiguration.asmx
- WindowsMobileADRMSConfiguration.asmx
- MobileDeviceParticipate.asmx
- MobileDeviceCertification.asmx
A: MobileDeviceCertification.asmx
If right: You will need to grant the user account object of the AD RMS-enabled mobile application and the AD RMS Service Group “Allow Read and Read & Execute” permissions on the MobileDeviceCertification.asmx file located in the C:\Inetpub\wwwroot\_wmcs\Certification folder.
If wrong: You will need to grant the user account object of the AD RMS-enabled mobile application and the AD RMS Service Group “Allow Read and Read & Execute” permissions on the MobileDeviceCertification.asmx file located in the C:\Inetpub\wwwroot\_wmcs\Certification folder.