Title: FINAL EXAMINATION
Course: RITA MC - ITNW 1354

Q: Windows Deployment Services (WDS) is a software platform and technology that allows you to perform which function?
- automated staging setup for bootable images
- automated network-based installations based on network-based boot and installation media
- downloadable installations based on staged image files
- automated configuration and installation via ISO images and an FTP service
A: automated network-based installations based on network-based boot and installation media
Feedback: This is the definition of Windows Deployment Services: a software platform and technology that allows you to perform automated network-based installations based on network-based boot and installation media.

Q: Which two role services does the WDS Role include?
- Active Directory and Systems Management Server
- Deployment Server and Active Directory
- Transport Server and Systems Management Server
- Transport Server and Deployment Server
A: Transport Server and Deployment Server
Feedback: Transport Server and Deployment Server are the defined role components of WDS.

Q: What role does preboot execution environment (PXE) play in WDS?
- It’s used to boot to a WDS Server to install a preinstallation environment.
- It’s used to install WDS services onto a domain controller.
- PXE is enabled only in an interdomain trust environment.
- It’s a prerequisite for installing WDS services onto a deployment server system.
A: It’s used to boot to a WDS Server to install a preinstallation environment.
Feedback: To communicate with a WDS server without an operating system, the client computer must support preboot execution environment (PXE). The PXE technology boots computers using the network interface without a data storage device, such as a hard drive or an installed operating system. When PXE is used with WDS, the client computer downloads a boot image that loads Windows Preinstallation Environment (Windows PE).

Q: Which one of the following is absolutely required for using WDS?
- NTFS partition for storing images
- PXE boot setup
- Unattend files with PXE boot
- IPv6, DHCPv6, and multiple boot images
A: NTFS partition for storing images
Feedback: The WDS server has an NTFS file system partition to store images.

Q: Which of the following describes the WDS discover.wim image file?
- It installs a standard Windows Server 2012 R2 image to the client computer.
- It contains the file resources for all the images in an image group.
- It loads Windows PE 4.0 on the client computer.
- It’s used to create a bootable ISO file for WDS deployment.
A: It’s used to create a bootable ISO file for WDS deployment.
Feedback: Part of the procedure of creating a bootable ISO image is to copy the discover.wim file from its source to its staging location and rename it to boot.wim.

Q: Windows Updates, especially the Automatic Updates feature of Windows Updates, are for what kind of environments?
- small
- large
- enterprise
- Internet service provider
A: small
Feedback: For small environments, you can configure your system to run Automatic Updates to ensure that critical, security, and compatibility updates are made available for installation automatically without significantly affecting your regular use of the Internet.

Q: You can configure Windows Server Update Service (WSUS) in one of two modes: Autonomous or Replica. Autonomous provides one type of management and Replica provides another. What are the two management types?
- Upstream and Approval
- Distributed and Upstream
- Distributed and Central
- Central and Downstream
A: Distributed and Central
Feedback: You can configure WSUS in one of two modes. Autonomous mode offers distributed management, and Replica mode offers central management.

Q: What is the default port number for WSUS synchronization?
- 8510
- 8530
- 8550
- 8830
A: 8530
Feedback: If you want to synchronize with another WSUS server, select the Synchronize from another Windows Server Update Services server option. Then specify the name of the server and the port (the default port is 8530).

Q: Which of the following tasks does the Event Viewer MMC snap-in allow you to perform?
- Save useful event filters as custom views that can be reused.
- Alter or edit events, such as change the date or time.
- Create custom events from the Event Template.
- Resolve events directly from the Event Console.
A: Save useful event filters as custom views that can be reused.
Feedback: Event Viewer enables you to perform the following tasks: View events from multiple event logs, save useful event filters as custom views that can be reused, schedule a task to run in response to an event, and create and manage event subscriptions.

Q: The Event Viewer is essentially what kind of tool?
- registry cleanup
- conflict resolver
- log viewer
- Performance Monitor
A: log viewer
Feedback: One of the most useful troubleshooting tools is the Event Viewer, which is essentially a log viewer.

Q: The Reliability Monitor provides a range of numbers to help you evaluate the reliability of a computer. What is the name of this range of numbers?
- Reliability Index
- Stability Index
- Event Index
- Evaluation Index
A: Stability Index
Feedback: The Reliability Monitor provides a stability index that ranges from 1 (the least stable) to 10 (the most stable). You can use the index to help evaluate the reliability of your computer.

Q: What are DFS Namespace shared folders referred to in relation to the virtual folders?
- targets
- folder spaces
- redirects
- links
A: targets
Feedback: The actual shared folders are referred to as the targets of the virtual folders in the namespace.

Q: What is the primary difference between domain-based namespace and stand-alone namespace?
- the names given to namespaces
- where the namespaces are stored
- the number of servers participating in the namespace
- the requirement for at least one Windows Server 2008 system
A: where the namespaces are stored
Feedback: With domain-based namespaces, the configuration is stored in Active Directory, which means that you dont have to rely on a single server to provide the namespace information to your clients.

Q: What is the primary disadvantage of DFS Replication?
- additional network bandwidth required
- additional CPU power required
- additional memory required
- additional storage space required
A: additional storage space required
Feedback: The primary disadvantage of using DFS Replication is that you need to have sufficient storage space available on each server that hosts the server. You also need extra space so that DFS Replication can process the replication.

Q: Which replication topology is more efficient than the default replication topology and allows you to set bandwidth, timing, and directionality to your configuration?
- meshless
- collective mesh
- hub/spoke
- token ring
A: hub/spoke
Feedback: Rather than use a full mesh topology, you can use a hub/spoke topology, in which one server is used to replicate to the other members, thus limiting the replication traffic to specific pairs of members.

Q: What effect does using quotas in File Server Resource Manager have?
- It limits the number of files allocated to a user.
- It limits the number of access licenses allotted to a server.
- It limits the number of drive mappings to a shared resource.
- It limits the number of gigabytes allocated to a volume or folder.
A: It limits the number of gigabytes allocated to a volume or folder.
Feedback: By using FSRM to create a quota, you limit the amount of disk space allocated to a volume or folder.

Q: Placing a quota limit on a folder applies that limit to what part of the folder?
- the folder and any files it contains
- the folder itself but no files
- the entire folder and its subtree
- only the files within the folder
A: the entire folder and its subtree
Feedback: By using FSRM to create a quota, you limit the amount of disk space allocated to a volume or folder. The quota limit applies to the entire folders subtree.

Q: What technology did Microsoft develop to combat the storage of storage-using and potentially illegal files on corporate servers?
- Windows Firewall
- Quotas
- Windows Defender
- File Screening
A: File Screening
Feedback: Often on a corporate network, users try to save files such as movies, music, and games on the corporate server. Unfortunately, although much of this can cause legal problems associated with copyright, it also takes up disk space that can be used for something else, costs money to provide the storage space, and makes the backup sets larger. As a result, Microsoft developed file screening that allows you to control the type of files that users can save and send notifications when users try to save a blocked file.

Q: What FSRM feature can you use to show the state of file server volumes, quotas, and disallowed files?
- Storage Reports
- Storage Exceptions
- Storage Quotas
- Storage Assessments
A: Storage Reports
Feedback: To help you manage storage, you can use FSRM to generate storage reports that show the state of file server volumes and anyone who exceeds the quota or uses files that arent allowed.

Q: Encryption is the process of converting data into what kind of format?
- compiled
- unreadable
- hidden
- non-functional
A: unreadable
Feedback: Encryption is the process of converting data into a format that cannot be read by another user.

Q: An encrypted file can be converted back to its original format by a process known as what?
- encryption
- digitization
- decryption
- encapsulation
A: decryption
Feedback: Decryption is the process of converting data from encrypted format back to its original format.

Q: Public-key cryptography uses how many keys?
- one
- two
- two pair
- 256
A: two
Feedback: Asymmetric key, also known as public-key cryptography, uses two mathematically related keys.

Q: You can encrypt individual files, but Microsoft recommends encrypting at what level?
- file system
- drive
- file group
- folder
A: folder
Feedback: Microsoft recommends that you encrypt at the folder level.

Q: Why is choosing what to audit, instead of auditing everything that a user does, a good idea?
- High levels of auditing can affect system performance.
- Auditing sets up an air of suspicion for users.
- Extensive audit trails often lead to too much troubleshooting.
- Auditing requires a high level of expertise to set up and maintain.
A: High levels of auditing can affect system performance.
Feedback: High levels of auditing can affect the performance of the computer you audit.

Q: Before Windows 2008 R2, only nine basic audit settings existed. Windows Server 2012 introduces a total of how many audit subsettings?
- 23
- 53
- 56
- 64
A: 56
Feedback: Starting with Windows Server 2008 R2, Windows introduced advanced audit policy settings, which enable you to have more control over what events get recorded by using multiple subsettings instead of the traditional nine basic audit settings. Windows Server 2008 R2 introduced 53 subsettings; Windows Server 2012 and Windows Server 2012 R2 has 56 subsettings.

Q: The powerful auditpol.exe command-line utility is widely used in automated scripting solutions. Select the correct action for the auditpol.exe /get /category:* command.
- Delete the per-user audit policy for all users, reset or disable the system audit policy for all subcategories, and then set the audit policies settings to disable.
- Remove the per-user audit policy for a single user’s account.
- Remove the per-user audit policy for all users.
- Show an authoritative report on what audit settings are being applied.
A: Show an authoritative report on what audit settings are being applied.
Feedback: If you want to get an authoritative report on what audit settings are being applied, use the following command: auditpol.exe /get /category:*.

Q: The powerful auditpol.exe command-line utility is widely used in automated scripting solutions. Select the correct action for the auditpol.exe /clear command.
- Delete the per-user audit policy for all users, reset or disable the system audit policy for all subcategories, and then set the audit policies settings to disable.
- Remove the per-user audit policy for a single user’s account.
- Remove the per-user audit policy for all users.
- Show an authoritative report on what audit settings are being applied.
A: Delete the per-user audit policy for all users, reset or disable the system audit policy for all subcategories, and then set the audit policies settings to disable.
Feedback: To delete the per-user audit policy for all users, reset or disable the system audit policy for all subcategories, and then set the audit policies settings to disable, execute the following command: auditpol.exe /clear.

Q: Which TCP/UDP port does the DNS service use to communicate?
- 25
- 53
- 80
- 443
A: 53
Feedback: A DNS resolver is a service that uses the DNS protocol to query for information about DNS servers using UDP and TCP port 53.

Q: Which one of the following is an example of an FQDN?
- SERVER1
- 192.168.1.50
- sales.microsoft.com
- C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
A: sales.microsoft.com
Feedback: The URL computer1.sales.microsoft.com represents an FQDN: the computer1 host is located in the sales domain, which is located in the Microsoft second-level domain, which is located in the .com top-level domain. Both sales.microsoft.com and computer1.sales.microsoft.com are examples of FQDNs.

Q: What is one of the primary advantages to using Active Directory to store DNS information?
- fault tolerance
- zero configuration
- low maintenance
- reverse zone lookups
A: fault tolerance
Feedback: Microsoft recommends using Active Directory to store DNS and for good reason. One benefit is fault tolerance: Because each server is an authoritative read-write copy of DNS, you have the DNS information stored on multiple servers. You also can update the DNS records from any DNS server.

Q: What is one advantage of subdomains?
- They allow you to use fewer IP addresses per domain.
- They offer more efficient network segmentation with inherent VLAN capability.
- They provide better overall network performance for large networks.
- They allow you to break up larger domains into smaller, more manageable ones.
A: They allow you to break up larger domains into smaller, more manageable ones.
Feedback: Subdomains allow you to break up larger domains into smaller, more manageable domains. For example, on contoso.com, you can create a sales subdomain and a support subdomain. When done, you will have the parent domain contoso.com and two subdomains: sales.contoso.com and support.contoso.com.

Q: A stub zone is a zone copy that contains only what type of records?
- host entries
- subdomain entries
- necessary resource entries
- query record entries
A: necessary resource entries
Feedback: A stub zone is a copy of a zone that contains only necessary resource records-Start of Authority (SOA), Name Server (NS), and Address/Host (A) record-in the master zone and acts as a pointer to the authoritative name server.

Q: A Start of Authority record specifies what kind of information about a zone?
- a list of hosts or A names
- a list of canonical (CNAME) records
- the zone serial number
- a reverse lookup record
A: the zone serial number
Feedback: A Start of Authority (SOA) record specifies authoritative information about a DNS zone, including the primary name server, the e-mail of the domain administrator, the domain serial number, and the expiration and reload timers of the zone.

Q: Before creating PTR records, what DNS objects must you create?
- reverse lookup zones
- CNAME records
- SOA records
- NS records
A: reverse lookup zones
Feedback: If the reverse lookup zone does not exist to store the PTR record, a warning is issued that the associated pointer (PTR) record cannot be created.

Q: Which DNS record contains the serial number for the zone?
- NS record
- A record
- PTR record
- SOA record
A: SOA record
Feedback: A Start of Authority (SOA) record specifies authoritative information about a DNS zone, including the primary name server, the e-mail of the domain administrator, the domain serial number, and the expiration and reload timers of the zone.

Q: Which of the following is an example of an SRV record?
- DNS server
- AD server
- mail server
- web server
A: AD server
Feedback: A Service Location (SRV) record maps a DNS domain name to a specified list of host computers that offer a specific type of service, such as Active Directory domain controllers.

Q: DNS servers contain several different types of resource records with which you need to become familiar. Select the correct definition for Canonical Name (CNAME) records.
- identifies an alias for a host name
- identifies a DNS server that is authoritative for a zone
- maps a domain/host name to an IP address
- resolves host names from IP addresses
A: identifies an alias for a host name
Feedback: The Canonical Name (CNAME) resource record is an alias for a host name. It is used to hide the implementation details of your network from the clients that connect to it, particularly if you need to make changes in the future.

Q: What does issuing the nslookup command with no parameters do on your system?
- It returns an error: Missing parameter.
- It places you into nslookup’s interactive mode.
- It returns you to a prompt with no result.
- It displays your DNS query cache.
A: It places you into nslookup’s interactive mode.
Feedback: If you type nslookup without any parameters, you start nslookup.exe in interactive mode. For a list of available commands, use the help or ?. To exit nslookup interactive mode, use the quit command.

Q: Which DNS record contains the serial number for the zone?
- NS record
- A record
- PTR record
- SOA record
A: SOA record
Feedback: A Start of Authority (SOA) record specifies authoritative information about a DNS zone, including the primary name server, the e-mail of the domain administrator, the domain serial number, and the expiration and reload timers of the zone.

Q: You can use the dnscmd command to create zones. What other tasks can you perform with it?
- delete resource records
- start/stop the DNS service
- perform name service queries
- install DNS services
A: delete resource records
Feedback: You can use the dnscmd command to manage resource records. For more information about the command, run dnscmd.exe /? to see the available options. You also can perform a search for dnscmd from the technet.microsoft.com website.

Q: If an A record maps a host name to an IP address, what does an AAAA record do?
- maps multiple hosts to a single IP address
- maps multiple services to a single IP address
- maps a host name to a single IPv6 address
- provides round-robin DNS services to multiple hosts
A: maps a host name to a single IPv6 address
Feedback: The A record maps a domain/host name to an IPv4 address; the AAAA record maps a domain/host name to an IPv6 address.

Q: Why are phone lines and ISDN not used today for remote access services (RAS)?
- They’re too expensive.
- They’re not secure enough.
- They create dedicated access.
- They no longer supply acceptable bandwidth.
A: They no longer supply acceptable bandwidth.
Feedback: By todays networking standards and bandwidth requirements, the phone and ISDN system do not have the bandwidth needed. Therefore, this method typically is not used today.

Q: When would you want to use a split tunnel for users?
- if your users work only from the office
- if your users might compromise security by browsing to insecure sites
- if your users have laptop computers and work from home or office
- if your users often need remote assistance
A: if your users have laptop computers and work from home or office
Feedback: If you want to route your Internet browsing through your home Internet connection rather than go through the corporate network, you can disable the Use Default Gateway on Remote Network option. By disabling this option, you are using a split tunnel.

Q: Why use a VPN for client-to-server connections over the Internet?
- VPN traffic is protected by a firewall.
- VPN traffic is encrypted.
- VPN traffic goes undetected on the Internet.
- VPN traffic is proxy-proof.
A: VPN traffic is encrypted.
Feedback: VPNs link two computers or network devices through a wide-area network (WAN) such as the Internet. Because the Internet is public and considered insecure, the data sent between the two computers or devices is encapsulated and encrypted.

Q: How is data verified when transferred through the Internet?
- by cryptographic checksum
- by RAS callback options
- by correct firewall settings
- by using PPTP for VPN connections
A: by cryptographic checksum
Feedback: Data integrity verifies that the data sent over the VPN connection has not been modified in transit. This is usually done with a cryptographic checksum based on an encryption key known only to the sender and receiver.

Q: RRAS has multiple options from which you can select one or more services to provide your users. Select the correct description for the Secure connection between two private networks option.
- sets up the server to provide NAT services to clients on the private network that need to access the Internet
- sets up a demand-dial or persistent connection between two private networks
- sets up the server to support incoming VPN connections and to provide NAT services
- sets up the server to accept incoming remote access connections (dial-up or VPN)
A: sets up a demand-dial or persistent connection between two private networks
Feedback: The Secure connection between two private networks option sets up a demand-dial or persistent connection between two private networks.

Q: DirectAccess was introduced with which workstation/server pair?
- Windows XP/Windows Server 2003
- Windows Vista/Windows Server 2008
- Windows 7/Windows Server 2008 R2
- Windows 8/Windows Server 2012
A: Windows 7/Windows Server 2008 R2
Feedback: DirectAccess, a new feature introduced with Windows 7 and Windows Server 2008 R2, provides seamless intranet connectivity to DirectAccess client computers when they are connected to the Internet.

Q: What utility do you use to configure DirectAccess?
- DNS Console
- Active Directory Console
- Remote Access Management Console
- DirectAccess Console
A: Remote Access Management Console
Feedback: To configure DirectAccess itself, you use the Remote Access Management console, which enables you to configure DirectAccess using a visual step-by-step wizard or wizards.

Q: Windows Server 2012 varies from the Windows Server 2008 R2 implementation in that it does not require which one of the following?
- SQL Server
- two consecutive public IP addresses
- Hyper-V and a single virtual machine
- a dedicated Internet connection
A: two consecutive public IP addresses
Feedback: Implementation of DirectAccess in Windows Server 2012 and Windows Server 2012 R2 does not require two consecutive static, public IPv4 addresses as was required with Windows Server 2008 R2. However, to achieve two-factor authentication with a smart card or Operational Data Provider (ODP) deployment, the DirectAccess server still needs two public IP addresses.

Q: The Run the Remote Access Setup Wizard breaks the installation into four separate installations that give you a great deal of control over settings and configurations. Identify the correct description for the installation of Remote Access Servers.
- Configure the network connections based on one or two network cards and which adapters are internal and which adapters are external. You can also specify the use of smartcards and specify the certificate authority (CA) to use for DirectAccess to provide secure communications.
- Specify which clients within your organization can use DirectAccess. You specify the computer groups that you want to include and whether you want to include Windows 7 clients.
- Configure how the clients access the core infrastructure services such as Active Directory domain controllers and DNS servers. You also specify an internal web server that can provide location services for infrastructure components to your DirectAccess clients.
- Configure your end-to-end authentication and security for the DirectAccess components. It also provides secure connections to individual servers.
A: Configure the network connections based on one or two network cards and which adapters are internal and which adapters are external. You can also specify the use of smartcards and specify the certificate authority (CA) to use for DirectAccess to provide secure communications.
Feedback: The installation of Remote Access Server configures the network connections based on one or two network cards and which adapters are internal and which adapters are external. You can also specify the use of smartcards and specify the certificate authority (CA) to use for DirectAccess to provide secure communications.

Q: What kind of RADIUS server is placed between the RADIUS server and RADIUS clients?
- a RADIUS client server
- a RADIUS engine server
- a RADIUS proxy server
- a RADIUS relay server
A: a RADIUS proxy server
Feedback: A multiple RADIUS server infrastructure option is to place a RADIUS proxy between the RADIUS server and the RADIUS clients. A RADIUS proxy forwards authentication and accounting messages to other RADIUS servers.

Q: What is a RADIUS server known as in Microsoft parlance?
- Network Access Server
- Network Policy Server
- Network Authentication Server
- Network Remote Access Server
A: Network Policy Server
Feedback: Microsofts RADIUS server is Network Policy Server (NPS). By installing and configuring RADIUS, you can create and enforce wide network access policies for client health, connection request authentication, and connection request authorization.

Q: When an access client contacts a VPN server or wireless access point, a connection request is sent to what system?
- the NPS server
- the 802.1X switch
- an authorization relay
- an access client
A: the NPS server
Feedback: When an access client accesses a virtual private network (VPN) server or wireless access point, a connection request is sent to the NPS server.

Q: To configure RADIUS service load balancing, you must have more than one kind of what system per remote RADIUS server group?
- proxy server
- RADIUS server
- relay server
- domain controller
A: RADIUS server
Feedback: To configure load balancing, you must have more than one RADIUS server per remote RADIUS server group.

Q: Which authentication method encompasses the widest range of clients (Microsoft and non-Microsoft) but has only a moderate level of security?
- PAP
- CHAP
- MS-CHAPv2
- smart card
A: CHAP
Feedback: If you have some non-Microsoft clients, you may need to enable Challenge-Handshake Authentication Protocol (CHAP).

Q: An NPS policy is a set of permissions or restrictions that determine what three aspects of network connectivity?
- who, what, and where
- who, when, and how
- who, when, and where
- who, how, and how long
A: who, when, and how
Feedback: A Network Policy Server (NPS) policy is a set of permissions or restrictions that are used by remote access authenticating servers that determine who, when, and how a client can connect to a network.

Q: Which variable can be set to authorize or deny a remote connection?
- group membership
- bandwidth limitations
- corporate status
- job role
A: group membership
Feedback: With the remote access policies, connections can be authorized or denied based on group membership.

Q: Where is the default connection policy set to process all authentication requests?
- on the domain controller
- at the RADIUS proxy server
- locally
- in a separate database
A: locally
Feedback: The default connection request policy uses NPS as a RADIUS server and processes all authentication requests locally. If you do not want the NPS server to act as a RADIUS server and process connection requests locally, you can delete the default connection request policy.

Q: What is the last setting in the Routing and Remote Access IP settings?
- the number of assigned IP addresses
- which DHCP server will supply the requests
- which NPS server to connect to
- how IP addresses are assigned
A: how IP addresses are assigned
Feedback: The last setting in the Routing and Remote Access is IP settings, which specify how IP addresses are assigned.

Q: Network Access Protection (NAP) is Microsoft’s software for controlling network access of computers based on what?
- a computer’s IP address and VLAN
- a computer’s overall health
- a computer’s Windows version
- a computer’s network functionality (role)
A: a computer’s overall health
Feedback: Network Access Protection (NAP) is Microsofts software for controlling network access for computers based on the health of the host, such as if it has the newest security patches and a current anti-virus/anti-malware software package.

Q: DHCP enforcement is not available for what kind of clients?
- mobile
- remote dial-up
- noncompliant
- IPv6
A: IPv6
Feedback: DHCP enforcement is not possible for IPv6 clients.

Q: What type of Active Directory domain controller is recommended to minimize security risks for remediation servers?
- Windows Server 2012
- Windows Server 2008 R2
- read-only
- updated and compliant
A: read-only
Feedback: Remediation servers typically include Active Directory domain controllers. Read-only domain controllers are recommended to minimize security risks.

Q: Health policies are in pairs. What are the members of the pair? Select two.
- NAP-compliant
- NAP-remedial
- NAP-noncompliant
- NAP-quarantined
A: NAP-compliant; NAP-noncompliant
Feedback: Typically, the health policies are in pairs, one for NAP-compliant and the other for NAP-noncompliant.

Q: What happens to a computer that isn’t running Windows Firewall?
- The computer is isolated.
- The computer is powered off.
- A server message is sent to the computer.
- An event is logged.
A: The computer is isolated.
Feedback: If the client computer does not run firewall software or runs a firewall noncompliant with Windows Security Center, the client computer is restricted to a remediation network until firewall software is installed and running.

Q: What is the default authentication protocol for non-domain computers?
- NTLM
- PAP
- CHAP
- Kerberos
A: NTLM
Feedback: Although Kerberos is the default authentication protocol for todays domain computers, NTLM is the default authentication protocol for Windows NT, standalone computers that are not part of a domain, and situations in which you authenticate to a server using an IP address.

Q: What does the acronym NTLM stand for?
- NT Link Messenger
- NT Link Manager
- NT LAN Manager
- NT LAN Messenger
A: NT LAN Manager
Feedback: NT LAN Manager (NTLM) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.

Q: What type of protocol is Kerberos?
- a secure network authentication protocol
- a simple Microsoft-only protocol
- a uni-directional authentication protocol
- a certificate-based authentication protocol
A: a secure network authentication protocol
Feedback: Kerberos is a computer network authentication protocol that allows hosts to prove their identity securely over a non-secure network.

Q: Kerberos security and authentication are based on what type of technology?
- secure transmission
- secret key
- challenge-response
- legacy code
A: secret key
Feedback: With Kerberos, security and authentication are based on secret-key technology. Every host on the network has its own secret key.

Q: Which tool can you use to add SPNs to an account?
- Notepad
- LDAP
- Microsoft Word
- ADSI Edit
A: ADSI Edit
Feedback: You can use ADSI Edit to add SPNs to an account.

Q: Which Kerberos setting defines how long a service or user ticket can be renewed?
- maximum lifetime for service ticket
- maximum lifetime for user ticket
- maximum lifetime for user ticket renewal
- maximum tolerance for computer clock synchronization
A: maximum lifetime for user ticket renewal
Feedback: The setting for maximum lifetime for user ticket renewal defines how long a service or user ticket can be renewed. By default, it can be renewed up to 7 days.

Q: The domain controllers are the computers that store and run the _______________.
- user database
- services database
- Managed Service Accounts database
- Active Directory database
A: Active Directory database
Feedback: The domain controllers are the servers that store and run the Active Directory database.

Q: How many PDC Emulators are required, if needed, in a domain?
- one
- two
- three
- four
A: one
Feedback: A domain requires just one Primary Domain Controller Emulator.

Q: Which Active Directory object is defined as a specialized domain controller that performs certain tasks so that multi-master domain controllers can operate and synchronize properly?
- Schema Master
- Forest
- RODC
- Operations Master
A: Operations Master
Feedback: Operations Masters are specialized domain controllers that perform certain tasks so that multi-master domain controllers can operate and synchronize properly.

Q: What function does the CSVDE tool perform?
- It decrypts and encrypts Active Directory information.
- It exports/imports Active Directory information.
- It exports/imports data from Event Viewer.
- It extracts Event Viewer information into CSV files.
A: It exports/imports Active Directory information.
Feedback: The CSVDE command-line tool exports or imports Active Directory Domain Services (AD DS) objects to or from a comma-delimited text file (also known as a comma-separated value text file or .csv file).

Q: What is a GUID?
- a unique identifier for a snapshot
- a special file permission
- an Active Directory object ID
- a group-user ID in Active Directory
A: a unique identifier for a snapshot
Feedback: A globally unique identifier (GUID) is what’s returned by the create snapshot command or displayed with the list all command.

Q: In interactive mode, what aspect of AD can you check with the ntdsutil integrity command?
- low-level database corruption
- fragmentation levels
- accuracy of entries
- completeness of entries
A: low-level database corruption
Feedback: You can also use the ntdsutil command to look for errors in Active Directory. The integrity command is used to detect low-level (binary level) database corruption, which reads every byte of the data file to ensure that the correct headers exist in the database itself and that all the tables are functioning and are consistent.

Q: What is the proper procedure for removing a domain controller from Active Directory?
- Shut down the domain controller and manually remove it from AD.
- Use dcdemo to demote the domain controller.
- Uninstall Active Directory Domain Services.
- Enter the DSRM and delete Active Directory.
A: Uninstall Active Directory Domain Services.
Feedback: To retire a domain controller, the proper method to demote a domain controller is to remove AD DS. However, if the demotion fails or the server itself fails where you cannot recover the system, you need to clean up the metadata, which means you must manually remove the domain controller from Active Directory.

Q: What are examples of password policies? Select all that apply.
- history
- length
- complexity
- age
A: history; length; complexity; age
Feedback: The first folder under Account Policies is for password policies. Password policies include enforced password history, maximum password age, minimum password age, minimum password length, and complexity requirements.

Q: Why primarily are account lockout policies put into place?
- privacy
- security
- policy
- regulations
A: security
Feedback: With enough time, a hacker can crack any password. To help prevent password cracking, you can limit how many times a hacker can guess a password before the account is locked.

Q: Which of the following passwords is considered complex?
- M!croS0ft
- candybar01
- bobj
- fred@local
A: M!croS0ft
Feedback: A complex password does not contain your name or username, contains at least six characters, and contains characters from three of the following four groups: uppercase letters [AZ], lowercase letters [az], numerals [09], and special, non-alphanumeric characters, such as !@#)(*^%.

Q: What character length for a password generally accepted as minimum?
- four
- six
- eight
- fourteen
A: eight
Feedback: The generally accepted minimum password length is eight characters.

Q: Which feature affects all users in the domain, including domain controllers?
- Global Group Policy
- Default Domain Policy
- Default Group Policy
- Default Global Domain Policy
A: Default Domain Policy
Feedback: The Default Domain Policy is linked to the domain and affects all users and computers in the domain, including domain controllers.

Q: What is the default timeout value for GPOs to process on system startup?
- 60 seconds
- 120 seconds
- 300 seconds
- 600 seconds
A: 600 seconds
Feedback: Computer configuration settings are applied synchronously (one by one) during computer startup before the user sees the Logon dialog box. If any startup scripts are configured through GPOs, they are processed synchronously and have a default timeout of 600 seconds (10 minutes) to complete.

Q: Where would using Replace mode GPOs be appropriate?
- in a classroom
- in a developer environment
- in a group of system administrator users
- in a graphic design department
A: in a classroom
Feedback: The Replace mode is useful in a situation such as a kiosk, classroom, or public library, where users should receive a standard configuration.

Q: What component extends the Windows Driver Model to provide an interface to the operating system to provide information and notification on hardware, software, operating systems, and services?
- Windows Management Instrumentation (WMI)
- WMI filtering
- security group filtering
- inheritance
A: Windows Management Instrumentation (WMI)
Feedback: Windows Management Instrumentation (WMI) is a component that extends the Windows Driver Model to provide an interface to the operating system to provide information and notification on hardware, software, operating systems, and services.

Q: Which of the following operating systems can have its security settings managed by using security templates? Select all that apply.
- Windows XP
- Windows Vista
- Windows 7
- Windows 8
A: Windows 7; Windows 8
Feedback: Each computer running Windows 7 and 8 and any computer running Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2 maintains a collection of security settings that can be managed by using the local GPO.

Q: Which two of the following methods can you use to deploy security templates?
- using Active Directory GPOs
- using the Security Configuration and Analysis snap-in
- copying a text file to each managed computer’s admin$ share
- using a logon script
A: using Active Directory GPOs; using the Security Configuration and Analysis snap-in
Feedback: You can deploy security templates using Active Directory group policy objects and the Security Configuration and Analysis snap-in.

Q: What is an ADMX file?
- an ADM file translator
- the ADM format for newer operating systems
- a template buffer
- the protocol that deploys ADM files across networks
A: the ADM format for newer operating systems
Feedback: Although Windows XP and Windows Server 2003/Windows Server 2003 R2 use ADM files, Windows Vista, Windows 7, Windows 8, Windows Server 2008/Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 users use ADMX files.

Q: What language are ADMX files based on?
- HTML
- XML
- SGML
- Java
A: XML
Feedback: Windows Vista and Windows Server 2008 introduced ADMX files, which are based on eXtensible Markup Language (XML).

Q: Unlike ADM files, ADMX files are not stored where?
- in the Central Store
- on the domain controller
- in the SYSVOL folder
- in individual GPOs
A: in individual GPOs
Feedback: Unlike ADM files, ADMX files are not stored in individual GPOs. The Group Policy Management Editor automatically reads and displays settings from the local ADMX file store.

Q: Which node allows you to configure settings such as Name Resolution Policy, Security Settings, and Policy-Based QoS nodes?
- Software Settings
- Windows Settings
- Computer Configuration
- User Configuration
A: Windows Settings
Feedback: The Windows Settings node allows you to configure Windows settings, including Name Resolution Policy, Scripts (Startup/Shutdown), Security Settings, and Policy-Based QoS (Quality of Service) nodes.

Q: Which domain users are automatically granted permissions to perform Group Policy Management tasks?
- local administrators
- power users
- domain administrators
- domain users
A: domain administrators
Feedback: In Active Directory, domain administrators are automatically granted permissions for performing Group Policy Management tasks.

Q: If you don’t want a GPO to apply, which group policy permission do you apply to a user or group?
- Disallow Read
- Disallow Write
- Disallow Modify
- Disallow Apply
A: Disallow Apply
Feedback: If you dont want a GPO to apply, you can assign the Disallow Apply group policy permission to a user or group.

Q: What is a collection of files stored in the SYSVOL (%SystemRoot%\SYSVOL\<Domain>\Policies\<GPOGUID>) of each domain controller?
- Group Policy Container (GPC)
- Group Policy Template (GPT)
- migration table
- delegation
A: Group Policy Template (GPT)
Feedback: The GPT is a collection of files stored in the SYSVOL (%SystemRoot%\SYSVOL\Domain\Policies\GPOGUID) of each domain controller.

Q: What is a file that maps references to users, groups, computers, and UNC paths in the source GPO to new values in the destination GPO?
- Group Policy Container (GPC)
- Group Policy Template (GPT)
- migration table
- delegation
A: migration table
Feedback: A migration table is a file that maps references to users, groups, computers, and UNC paths in the source GPO to new values in the destination GPO.

Q: Which utility do you use to create GPO preferences?
- Group Policy Management Editor
- Group Policy Preference Editor
- Group Policy Editor
- Group Policy Wizard
A: Group Policy Management Editor
Feedback: The first step in any Group Policy Preferences (GPP) setup is to open the Group Policy Management Editor for the Group Policy Object (GPO) you want to configure.

Q: To copy, replace, update, or delete files, you can use wildcard characters. Which wildcard characters can you use? Select all that apply.
- ?
- X
- $
- *
A: ?; *
Feedback: To copy, replace, update, or delete files, you can use the wildcard * and ? characters.

Q: To support GPPs on older Windows versions (Server and Workstation), you have to install what component from Microsoft?
- GPP Registry Tweaks
- GPP Service Pack 1
- A special GPP hotfix
- GPP Client-Side Extensions
A: GPP Client-Side Extensions
Feedback: By default, GPP are supported by client computers running Windows Vista SP2, Windows 7 or higher, or Windows Server 2008 or higher. To support Windows XP SP3, Windows Vista SP1, or Windows Server 2003 client computers, you must install GPP Client-Side Extensions from Microsoft Downloads or Windows Updates.

Q: GPP can be configured on domain controllers running which version of Windows Server? Select all that apply.
- 2003
- 2008
- 2008 R2
- 2012
A: 2008; 2008 R2; 2012
Feedback: GPP can be configured on domain controllers running Windows Server 2008 or higher.

Q: What is the key difference between preferences and policy settings?
- deployment
- enforcement
- staging
- refresh interval
A: enforcement
Feedback: The key difference between preferences and policy settings is enforcement.