Question 1

Your colleague has set the default TTL value for your company's primary DNS zone to 15 minutes. Which of the following is most likely to occur as a result of this change?
A)Resource records cached on the primary DNS server will expire after 15 minutes.
B)Secondary servers will initiate a zone transfer every 15 minutes.
C)DNS hosts will re-register their records once every 15 minutes.
D)DNS clients will have to query the server more frequently to resolve names for which the server is authoritative.

Accepted Answer

When the default TTL value is changed to 15 minutes, DNS clients have to query the server more frequently to resolve names for which the server is authoritative.
Key Takeaway: When a caching nameserver queries the authoritative nameserver for a resource record, it caches that record for the time specified by the TTL, or Time To Live. The unit used to specify a TTL is seconds. The default value is 86400 seconds, which is equal to 24 hours.
This value means that if a DNS record was changed, DNS servers around the world could still be showing the old value from their cache for up to 24 hours after the change. Reducing this TTL value can cause heavier loads on an authoritative nameserver, because the cache is refreshed once every 15 minutes.

Question 2

Which of the following commands is used at the Nslookup prompt to view all the contents of the zone abc.com?
A)ls -t abc.com
B)ls -d abc.com
C)ls -a abc.com
D)ls -any abc.com

Accepted Answer

The ls -d abc.com command at the Nslookup prompt is used to view all the contents of the zone abc.com.
Key Takeaway: Nslookup is a command-line tool used to test and troubleshoot DNS servers. Nslookup can be run in two modes, interactive and noninteractive. Noninteractive mode is useful when only a single piece of data needs to be returned. Type nslookup at the command prompt to start Nslookup in the interactive mode. Once you are in the interactive mode, you can use the ls -d command to view all contents of a zone.

Question 3

An application named Inventory.exe is installed on all Windows XP client computers in the domain with the startup type of the service set to Automatic. In the Default Domain Policy Group Policy object the security administrator has configured a software restriction policy that is applied to all computers in the domain.
The policy contains a hash rule for the Inventory.exe application, and the hash rule is configured with a security level of Unrestricted. What should you do to ensure that Inventory.exe cannot be started by a worm, while still allowing the application to run as a service?
A)In the computer settings section of the Default Domain Policy GPO, configure a software restriction policy that contains a zone rule for the Internet zone. Configure the zone rule with a security level of Disallowed.
B)In the user settings section of the Default Domain Policy GPO, configure a software restriction policy that contains a zone rule for the Internet zone. Configure the zone rule with a security level of Disallowed.
C)In the computer settings section of the Default Domain Policy GPO, modify the existing software restriction policy hash rule for the Inventory.exe application so that the hash rule has a security level of Disallowed.
D)Configure a software restriction policy that contains a hash rule for the Inventory.exe application in the user settings section of the Default Domain Policy GPO. Configure the hash rule with a security level of Disallowed.

Accepted Answer

Configure a software restriction policy that contains a hash rule for the Inventory.exe application in the user settings section of the Default Domain Policy GPO, and configure the hash rule with a security level of Disallowed to ensure that Inventory.exe cannot be started by a worm.
Key Takeaway: A hash rule is a series of bytes with a fixed length that uniquely identifies a software program or file. A hash is obtained by applying a one-way mathematical function to an arbitrary amount of data. If the input data is changed, the hash also changes. If you create a hash rule for a software program, software restriction policies calculate a hash of the program.
When a user tries to open a software program, a hash of the program is compared to existing hash rules for software restriction policies. The hash of a software program is always the same, regardless of where the program is located on the computer. However, if any changes are made to the software program, its hash also changes, and it no longer matches the hash in the hash rule for software restriction policies.

Question 4

You configure a server named S4 as the DNS server for the domain. After using the new ISP, users report that they cannot access Internet Web sites using their fully qualified domain names. You manually configure a test computer to use the DNS server address of the new ISP.
The test computer can successfully access Internet Web sites using their FQDNs. What should you do to ensure that network users can access Internet Web sites by using their FQDNs while ensuring that user access to internal resources is not disrupted?
A)Configure S4 to use the default root hints.
B)Create a root zone on S4.
C)Configure a forwarder on S4 to the new ISP's DNS server.
D)Configure all computers on your network to use the new ISP's DNS server.

Accepted Answer

You should configure S4 to use the default root hints to ensure that network users can access Internet Web sites by using their FQDNs while ensuring that user access to internal resources is not disrupted.
Key Takeaway: Root hints are DNS data stored in a DNS server. A DNS server contains a list of preliminary resource records or root hints that can be used by the DNS service to locate other DNS servers that are authoritative for the root of the DNS domain namespace tree.
Root hints are used to prepare servers authoritative for non-root zones so that they can learn and discover authoritative servers that manage domains located at a higher level or in other subtrees of the DNS domain namespace.
These hints are essential for servers authoritative at lower levels of the namespace when locating and finding servers under these conditions. The root hints are stored in the file CACHE.DNS, located in the systemrootSystem32Dns folder.

Question 5

A server named Server 1 functions as a DHCP and DNS server. All client computers are configured to use Server 1 for name resolution, and all DNS zones on Server 1 are enabled for DNS dynamic updates. A server named Server 25 contains antivirus server software.
It must be able to contact client computers using fully qualified domain names to propagate virus definition updates. You need to ensure that Server 25 can resolve FQDNs for all client computers on the network. Which of the following options should you modify on Server 1?
A)Dynamically update DNS A and PTR records only if requested by the DHCP clients check box.
B)Always dynamically update DNS A and PTR records check box.
C)Dynamically update DNS A and PTR records for DHCP clients that do not request dynamic updates (for example, clients running Windows NT 4.0) check box.
D)Discard A and PTR records when lease is deleted check box.

Accepted Answer

To ensure that Server 25 can resolve FQDNs for all client computers on the network, you should modify the Dynamically update DNS A and PTR records for DHCP clients that do not request dynamic updates (for example, clients running Windows NT 4.0) check box on Server 1.
Key Takeaway: A DHCP server can dynamically update DNS A and PTR records on behalf of legacy clients that are not capable of sending the client FQDN to the server. The server can also be configured to discard client A and PTR records when the client lease is deleted. By default, the DHCP server does not send updates for clients that do not support Client FQDN option.

Question 6

On your network, the Domain Admins group is also a member of the Administrators local group on server S1. Someone makes an unauthorized change to the HKEY _LOCAL_MACHINE\SYSTEM key in the registry on S1, which causes the computer to fail. You fix the problem and plan to log all attempts to access the HKEY_LOCAL_MACHINE \SYSTEM key in the registry on S1. What should you do to enable auditing in the local security policy on S1?
A)Enable auditing in the local security policy on S1.Select the Audit object access (success and failure) option in the audit policy.
B)Enable auditing in the local security policy on S1. Select the Audit system events (success and failure) option in the audit policy.
C)Enable auditing in the local security policy on S1. Select the Audit privilege use (success and failure) option in the audit policy.
D)Configure the SACL on the HKEY _LOCAL_MACHINE\SYSTEM key in the registry. Specify auditing of the Full Control permission for everyone.

Accepted Answer

To enable auditing in the local security policy on S1, you should enable auditing in the local security policy on S1 and select the Audit privilege use (success and failure) option in the audit policy.
Key Takeaway: This Audit setting will audit each event that is related to a user performing a task that is controlled by a user right. The list of user rights pertains to the ones in the Local Security Policy under Security Settings\Local Policies\User Right Assignment. To enable auditing privilege use, open the Group Policy Object Editor. Navigate to the following location: Computer Configuration\Windows Settings\Security Settings\
Local Policies\Audit Policy. In the details pane, double click Audit privilege use. Place a check beside Success and/or Failure and click OK.

Question 7

John wants to analyze the Main Mode IPSec statistics on a member server running Windows Server 2003. The server is accessed frequently by a number of clients. Which of the following should he do to export statistical information for future analysis?
A)Use the IP Security monitor snap-in to export the data to a text file.
B)Type netsh ipsec dynamic show stats type=ike>File- Name.txt at the command line.
C)Type netsh ipsec dynamic show stats type=ike at the command line.
D)Type netsh ipsec dynamic show stats type=ipsec>File- Name.txt at the command line.

Accepted Answer

To export this statistical information for future analysis, John should type netsh ipsec dynamic show stats type=ike>File- Name.txt at the command line.
Key Takeaway: In an IPSec VPN, IKE phase 1 occurs in two modes, main mode and aggressive mode. Main mode has three two-way exchanges between the initiator and the receiver. At the first exchange, the algorithms and hashes used to secure the IKE communications are agreed upon in matching IKE SAs in each peer.
At the second exchange, it uses a Diffie-Hellman exchange to generate shared secret keying material used to generate shared secret keys. In the third exchange, it verifies the other side's identity. The main outcome of main mode is matching IKE SAs between peers to provide a protected pipe for exchanges between the IKE peers.

Question 8

Which of these System Monitor counters can help to detect an insufficient bandwidth problem?
A)Network Interface: Current Bandwidth
B)Network Interface: Output Queue length
C)Network Interface: Packets/sec
D)Network Interface: Bytes Total/sec

Accepted Answer

The Network Interface: Bytes Total/sec counter helps detect an insufficient bandwidth problem.
Key Takeaway: This counter provides the number of bytes sent and received per second by the network interface adapter. A significant drop in performance could indicate a faulty network adapter. If you have more than one network adapter in your server, you can choose to monitor any or all of the adapters at one time.

Question 9

You need to modify the configuration of a service from Safe Mode With Command Prompt to repair a system that will not start normally. Which of the following command-line utilities enables you to do this?
A)Ping.exe
B)Netsh.exe
C)Netdiag.exe
D)Sc.exe

Accepted Answer

Sc.exe utility enables you to modify the configuration of a service from Safe Mode With Command Prompt to repair a system that will not start normally.
Key Takeaway: The Sc.exe utility can be used to configure a specific service, retrieve the current status of a service, and stop and start a service. It can be used to create batch files that automate the startup or shutdown sequence of services.

Question 10

Using System Monitor and Network Monitor, Chad sees that server S1 is exhibiting connectivity problems. Chad notices that S1 has approximately 4 MB of available memory and average CPU utilization is running at 88 percent.
When Chad investigates the Network Monitor capture, he notices that some network packets sent to S1 during the capture have not been captured. What should Chad do to ensure that the impact of monitoring on S1 is reduced and that all packets sent to the computer are captured?
A)Run Network Monitor in the dedicated capture mode.
B)From a command prompt, run the diskperf command.
C)Configure a Network Monitor capture filter.
D)Increase the buffer size in Network Monitor.

Accepted Answer

To ensure that the impact of monitoring on S1 is reduced and that all packets sent to the computer are captured, Chad should Run Network Monitor in the dedicated capture mode.
Key takeaway: While using Network Monitor, frames captured from the network are copied to the capture buffer, a reserved storage area in the memory. When the capture buffer overflows, each new frame replaces the oldest frame in the buffer. The elements that determine how quickly the capture buffer will be filled are Capture buffer size, Frame size, Capture filter, and Volume of network traffic.
In addition to customizing Capture buffer size and Frame size to save Capture Buffer space, you can also put Network Monitor into dedicated Capture mode. This mode does not display or update Capture window statistics, reducing the load on the CPU and thereby reducing the chance that packets will be dropped.

Question 11

Globe is an Internet service provider that hosts Web sites for many companies. Each Globe DNS server hosts multiple DNS zones for customers. Several Globe administrators are allowed to add DNS zones. What should be done to produce a monthly report that will list all the zones that are hosted on each DNS server?
A)Use the dnslint utility to query each DNS server.
B)Use the nslookup utility to query each DNS server.
C)Use the dnscmd utility to query each DNS server.
D)Use the adsiedit utility to query Active Directory for a list of DNS zones.

Accepted Answer

To produce a monthly report that will list all the zones that are hosted on each DNS server, use the dnscmd utility to query each DNS server.
Key Takeaway: Dnscmd displays and changes the properties of DNS servers, zones, and resource records. It manually modifies these properties, creates and deletes zones and resource records, and forces replication events between DNS server physical memory and DNS databases and data files.

Question 12

Chad is the network administrator for a network that consists of a single Active Directory domain named Globe.com. A Windows Server 2003 computer named S1 is the only DNS server in the domain. It hosts no other zones. Users report that connecting to computers within the Globe.com domain is slow. What should Chad do to check if DNS client traffic on S1 is causing this problem?
A)Use System Monitor to create a log of the Network Interface counter Total bytes/sec.
B)Use System Monitor to create a log of the DNS counters Dynamic updates/see and Total queries/sec.
C)Enable debug logging on S1. Configure the log to capture Notification events.
D)Enable debug logging on S1. Configure the log to capture Update events.

Accepted Answer

To check if DNS client traffic on S1 is causing this problem, Chad should use System Monitor to create a log of the DNS counters Dynamic updates/see and Total queries/sec.
Key Takeaway: DNS server performance counters can be used to measure and monitor server activity aspects such as: Number of overall queries and responses processed by a DNS server; UDP or TCP counters, for measuring DNS queries and responses that are processed using these protocols; Dynamic update and secure dynamic update counters; Memory usage counters, for measuring system memory usage and memory allocation patterns; Recursive lookup counters, for measuring queries and responses when the DNS Server service uses recursion to look up and fully resolve DNS names on behalf of requesting clients; WINS lookup counters; and Zone transfer counters.

Question 13

David installs Windows Software Update Services on a computer named S1. The WSUS installation requirements include: Use the least amount of disk space on S1 and testing updates before deployment. David clears the Automatically Approve Updates for Installation checkbox.
Which of the following should David do to complete the installation meeting all the requirements?
A)Remove the Critical Updates option from Updates Classifications.
B)Change the Revisions to Updates setting so that new versions of previously approved updates are not automatically approved.
C)Change the Revisions to Updates setting to automatically approve all updates.
D)Change the Advanced Synchronization Options dialog box so that updates are not stored locally.

Accepted Answer

To complete the installation meeting all the requirements, change the Advanced Synchronization Options dialog box so that updates are not stored locally.
Key Takeaway: Advanced synchronization features include various options to manage bandwidth and store updates. The four options that can be configured using the Advanced synchronization feature are Update storage options, Deferred downloads options, Express installation files options, and Filtering updates options.
In this case, configure the Update storage options to ask clients to connect to the Internet to get updates. In the Advanced Synchronization Options dialog box, under Update Files Do not store updates locally, clients install updates from Microsoft Update option must be clicked.

Question 14

You are a network administrator for a network that consists of a single Active Directory domain. The domain contains 40 Windows Server 2003 computers, 1,000 Windows XP Professional computers, and 2,000 Windows 2000 Professional computers.
Windows Server Update Services is installed on a server named S1. The necessary Group Policy object is configured. If you need to confirm that all computers in the domain have received all approved updates from S1, what should you do?
A)Install and configure Urlscan.exe.
B)At the command prompt, type gpresult /scope COMPUTER.
C)Open the WSUS console. Run the Synchronization Results report.
D)Open the WSUS console. Run the Status of Computers report.

Accepted Answer

To confirm that all computers in the domain have received all approved updates from S1 you should open the WSUS console and run the Status of Computers report.
Key Takeaway: Reports enable you to monitor a WSUS network for updates, client computers, and downstream servers. The three reports that can be generated from the Reports page are Status of Updates, Status of Computers, and Synchronization Results. The Status of Computers report provides both a cumulative and individual update status summary for computers in the computer group and for the update status results you specify. You can get more information by viewing the status displayed in this report.

Question 15

All computers in the London office are configured to use S10 as their preferred DNS server. The Texas branch office has a server named S11 which hosts a primary zone named payroll.Globe.com. The refresh interval of the payroll.Globe.com zone is set to 24 hours. In the Texas office, a firewall filters all incoming network traffic from other offices. A rule on this firewall prevents all computers from the London office network, except S10, from performing DNS lookups against S11.
As a business requirement no delay should occur between the time that a new record is created in the payroll.Globe.com zone and the time that the record can be resolved from any computers in the London office. All computers in the London office must be able to resolve names in the payroll.Globe.com namespace.
Which of the following should be done to configure DNS on S10 to meet the requirements?
A)Setup a stub zone named payroll.Globe.com.
B)Setup conditional forwarding to S11 for the payroll.Globe.com namespace.
C)In the Globe.com zone, set up a delegation to the payroll.Globe.com zone on S11.
D)Setup a secondary zone named payroll.Globe.com that has S11 as master.

Accepted Answer

To configure DNS on S10 to meet the requirements, setup conditional forwarding to S11 for payroll.Globe.com namespace.
Key Takeaway: Conditional forwarding can be used to speed up name resolution in certain scenarios. It handles name resolution only for a specific domain. So, it forwards any requests for hosts in the domain directly to a specific name server that is authoritative for that domain. This speeds up the name resolution process by eliminating the need to go up to root to find this authoritative server.

Question 16

You need to update five high-visibility servers with critical updates by using Windows Server Update Services (WSUS). After approving the updates, what should you do to ensure that the updates are applied within an hour?
A)Type the gpupdate /force command at the command prompt on the WSUS server.
B)Type the wuauclt /detectnow command at the command prompt on each of the five servers.
C)Type the gpupdate /force command at the command prompt on each of the five servers.
D)Type the wuauclt /detectnow command at the command prompt on the WSUS server.

Accepted Answer

To ensure that the updates are applied within an hour; you should type the wuauclt /detectnow command at the command prompt on each of the five servers.
Key takeaway: The wuauclt utility allows you control over some functions of the Windows Update Agent. It is most importantly used to initiate detection right away instead of waiting for detection to start. To start this process, click Start > Run and type cmd. At the command prompt, type wuauclt /detectnow. The wuauclt.exe file is located in the folder C:\Windows\System32.

Question 17

David needs to implement a new software update infrastructure. No security patches, critical updates, or service packs have ever been installed on any of the client computers on the network. He installs Windows Server Update Services on a Windows Server 2003 computer named S5.
He synchronizes and approves all of the current security patches, critical updates, and service packs. He also needs to ensure that all client computers receive all Microsoft security patches, critical updates, and service packs. Which of the following should he do?
A)Install the Automatic Updates client on all client computers.
B)Open the WSUS console. Select the option to automatically approve WSUS updates.
C)Modify the Microsoft Update settings of the Default Domain Controller organizational unit (OU) Group Policy object (GPO) to point client computers to http://S5.
D)Modify the Microsoft Update settings of the Default Domain Policy Group Policy Object (GPO) to point client computers to http://S5.

Accepted Answer

For all the clients to be able to receive all Microsoft security patches, critical updates, and service packs, David should install the Automatic Updates client on all client computers.
Key Takeaway: The Windows Update service provides a single location for all the updates for a Windows computer. By turning on the Automatic Updates feature all high-priority updates including security and reliability updates, drivers, service packs, and feature updates can be updated. Automatic Updates routinely checks for the latest high-priority updates and then downloads and installs them automatically. Although it installs all high-priority updates, it will not download and install Optional updates.

Question 18

Chad installs and configures Windows Server Update Services on a server named S1. All client computer accounts are in the Clients OU. Chad creates a Group Policy object named WSUS. Currently all client computers obtain their Windows security updates from a Microsoft Update. Chad wants to configure all client computers to obtain Windows security updates from S1. What should Chad do to accomplish this task with the least amount of administrative effort?
A)Link the WSUS GPO to the domain. Configure the GPO to point to S1 for automatic updates.
B)Link the WSUS GPO to the Clients OU. Specify Clients as the target computer group in WSUS.
C)Link the WSUS GPO to the domain. Specify Clients as the target computer group in WSUS
D)Link the WSUS GPO to the Clients OU. Configure the GPO to point to S1 for automatic updates.

Accepted Answer

To accomplish this task with the least amount of administrative effort, Chad should link the WSUS GPO to the Clients OU. Configure the GPO to point to S1 for automatic updates.
Key Takeaway: In this case, Chad wants all client computers to obtain their updates from S1, and WSUS is installed on S1. Group Policy Object is a collection of settings that defines the system settings and behavior for a defined group of users. GPO is associated with selected Active Directory containers, such as sites, domains, or organizational units. Hence the WSUS GPO should be created and linked to Clients OU. This GPO must be pointed to S1 for automatic updates.

Question 19

Each sales representative in your company has a portable computer running on Windows XP Professional. You have configured a server named Main 2 with a LAN connection and a dial-up connection to the Internet. All sales representatives are connected to the LAN, but they cannot connect to the Internet. You view the IP configuration on their laptop and see a result as shown in the figure. Which of the following should you do to fix this problem?
A)Install the Connection Manager Administration Kit (CMAK) on Main 2.
B)Install the DHCP service on Main 2. Create a scope for subnet 169 .254.0.0/16.
C)Modify the Internet Explorer properties on the sales representatives' computers to specify 169.254.0.1 as the proxy server.
D)Configure Internet Connection Sharing on Main 2.

Accepted Answer

To fix this problem, you should configure Internet Connection Sharing on Main 2.
Key takeaway: ICS provides networked computers with the ability to share a single connection to the Internet. The capabilities of ICS include, access to multiple users to connect to the Internet through a single connection by using Dial-Up Networking and local networking, transparent network configuration by using DNS and DHCP to resolve Internet names, support for any IP-attached devices and comprehensive protocol support.

Question 20

David installs a new client-server application on S1, which is not a member of the single Active Directory domain. S1 has the static IP address 192.168.4.65. He installs the client software on two Windows XP Professional domain computers. The client software must be able to resolve to S1 using the fully qualified domain name, Globe.com.
S2 is the DNS server and has the IP address 192.168.4.16. When David pings 192.168.4.65, he receives valid replies. When he attempts to run the client software on the two test computers, the software cannot locate S1 and terminates. Which of the following should David do to fix the problem?
A)Enter a host (A) record for S1 on S2. This record displays S1's IP address as 192.168.4.65. In the Computer Name Changes dialog box in System Properties on S1, enter Globe.com as the primary DNS suffix of the computer and restart S1.
B)Type S1.Globe.com 192.168.4.65 #pre in the following line in the Hosts file on each of the two test computers.
C)Create an organizational unit named ApplicationServersOU, and create a computer account named S1 in ApplicationServersOU. Set the Primary DNS Suffix Group Policy setting on an ApplicationServersOU Group Policy Object to Globe.com and restart S1.
D)Run the ipconfig /registerdns command, from the command prompt on S1.

Accepted Answer

To fix the problem, David should enter a host (A) record for S1 on S2. This record displays S1's IP address as 192.168.4.65. In the Computer Name Changes dialog box in System Properties on S1, enter Globe.com as the primary DNS suffix of the computer and restart S1.
Key Takeaway: The Primary DNS suffix specifies the DNS suffix to be appended to the name of a computer when completing its fully qualified domain name. To configure the primary DNS suffix for a computer, right-click My Computer and then select Properties. Click the Computer Name tab. Click Change, and then click More. In DNS Suffix and NetBIOS Computer Name, type your domain name. After applying these changes, restart the computer to initialize it with its new DNS domain name.

Quiz 1: Windows 70-291

Your colleague has set the default TTL value for your company's primary DNS zone to 15 minutes. Which of the following is most likely to occur as a result of this change?

Which of the following commands is used at the Nslookup prompt to view all the contents of the zone abc.com?

John wants to analyze the Main Mode IPSec statistics on a member server running Windows Server 2003. The server is accessed frequently by a number of clients. Which of the following should he do to export statistical information for future analysis?

Which of these System Monitor counters can help to detect an insufficient bandwidth problem?

You need to modify the configuration of a service from Safe Mode With Command Prompt to repair a system that will not start normally. Which of the following command-line utilities enables you to do this?

You need to update five high-visibility servers with critical updates by using Windows Server Update Services (WSUS) . After approving the updates, what should you do to ensure that the updates are applied within an hour?