Question 1

Chad is the administrator of a Windows Server 2003 computer named Globe1. Globe1 is an FTP server located in Globe's internal network. Administrators report an increased amount of FTP traffic to Globe1. Chad needs to configure Globe1 to achieve these goals: Identify the MAC address of a computer using FTP transfers from Globe1, find out the FTP commands executed, and ensure that operation of Globe1 isn't disrupted. What should Chad do?
A)Configure a performance alert to write an event to the application event log whenever the number of established FTP connections exceeds 1.
B)Use a Network Monitor filter to capture IP traffic from any computer to Globe1.
C)Run the arp command on Globe1 to identify the source of the FTP requests.
D)Run the finger command on Globe1 to identify the source of the FTP requests.

Accepted Answer

Chad should use a Network Monitor filter to capture IP traffic from any computer to Globe1.
Key Takeaway: Network Monitor provides a method for detecting and isolating network issues. It allows you to capture data, identify its source, and analyze the content of the message. Since Network Monitor captures data by frames, every packet includes the source and destination address, the header information, and the actual data. Hence Chad can achieve all three objectives.

Question 2

Chad's company has offices in Florida, New Jersey, and Maryland. Each office is configured as a separate IP subnet. DNS is the only name resolution method used on the network. Chad needs to implement a software update infrastructure on the network. He installs Software SUS on a computer named S5 in the Florida office with all default settings. He has no plans to install additional SUS servers. What should Chad do to ensure that client computers can successfully connect to the SUS server?
A)Configure the Internet browser home page on all client computers to point to http://windowsupdate. microsoft.com.
B)In the SUS Administrator, configure the Server Name property to be the server's FQDN.
C)Open IIS Manager and enable HTTP over SSL.
D)Enable communication over port 13S between all client computers and the SUS server.

Accepted Answer

Chad should configure the Server Name property to be the server's FQDN in the SUS Administrator.
Key Takeaway: Microsoft SUS is a free patch management tool to help administrators deploy security patches more easily. SUS dynamically notifies computers when critical updates are available. These updates are automatically distributed to the desktops and servers. It allows the administrator to test and approve updates from the public Windows Update site before deployment. Deployment can be scheduled by the administrator.

Question 3

Chad configures several GPOs to enforce the use of IPSec for certain types of communication between specified computers. A server named Globe5 runs the Telnet service. A GPO is supposed to ensure that all Telnet connections to Globe5 are encrypted by using IPSec. However, when Chad monitors network traffic, he notices that Telnet connections are not being encrypted. Which tool/interface should Chad use to view all of the IPSec settings that are applied to Globe5 by GPOs?
A)The IP Security Policy Management console
B)The Resultant Set of Policy console
C)netdiag
D)MBSA

Accepted Answer

Chad should use the Resultant Set of Policy console to view all of the IPSec settings that are applied to Globe5 by GPOs.
Key Takeaway: The Resultant Set of Policy, or RSoP, console determines which IPSec policies are assigned but are not being applied to IPSec clients. It provides a machine-specific overview of the Policy state for the defined machine. It is a term for the resulting (effective) group policies that are applied to a computer and user.

Question 4

You are the network administrator for the network that consists of a single Active Directory forest with 14 domains. All servers run Windows Server 2003. Only the DNS servers in the abc.com domain have access to the Internet to resolve Internet DNS names. What should you do to configure each DNS server so that unresolved queries are resolved by DNS servers in the abc.com domain?
A)Replace the root hints with the addresses of the DNS servers in the abc.com domain.
B)Create a stub zone named abc.com that contains a copy of the IIHT.com zone.
C)Configure the default forwarding entry to forward data to DNS servers in the abc.com domain.
D)Configure a conditional forwarding entry for abc.com that forwards data to DNS servers in the abc.com domain.

Accepted Answer

You should configure the default forwarding entry to forward data to DNS servers in the abc.com domain so that unresolved queries are resolved.
Key Takeaway: A forwarder is a DNS server on a network used to forward DNS queries for external DNS names to DNS servers outside of that network. A DNS server on a network is a forwarder when other DNS servers in the network forward the queries they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution for names outside of your network, such as names on the Internet, and you can improve the efficiency of name resolution for the computers in your network.

Question 5

You are an administrator of an Active Directory domain named xyz.com. You configure a server named Server 2 as xyz.com's DHCP server. All client computers are configured as DHCP clients. Users report that they cannot connect to network resources. You investigate and discover that the client computers are not receiving their TCP/IP configurations from Server 2. What should you do to fix this issue?
A)Run the net stop dhcpserver command.
B)Authorize Server 2 using the DHCP console.
C)Run the net start dhcpserver command.
D)Restart the DHCP service using the DHCP console.

Accepted Answer

To fix this problem, you must authorize Server 2 using the DHCP console.
Key Takeaway: The authorization process for DHCP server computers depends on the installed role of the server on your network. To authorize a DHCP server in Active Directory, open DHCP and click DHCP in the console tree. On the Action menu, click Manage authorized servers. The Manage Authorized Servers dialog box appears. Click Authorize. When prompted, type the name or IP address of the DHCP server to be authorized and then click OK.

Question 6

You network that has 20 Windows Server 2003 computers. All client computers receive their TCP/IP settings from a DHCP server named Server 1. The network is experiencing rapid growth in the past few months. Users report that the network is going slow. When you run Network Monitor, you notice a significant increase in broadcast traffic on the network. Which of the following should you do to increase network performance?
A)Change option 046 to 0x1, B-node.
B)Remove option 044 from the DHCP Server Options.
C)Change option 046 to 0x2, P-node.
D)Create a new scope for the network.

Accepted Answer

To improve network performance, change option 046 to 0x2, P-node.
Key Takeaway: RFC defines four node types for NetBIOS or WINS resolutions: Broadcast node (b-node), point-to-point node (p-node), mixed nodes (m-node), and hybrid node (h-node). A station can be configured as any of these node types, but b-node and h-node types are the most common. Each node type uses a different process for resolving NetBIOS names.

Question 7

Your network has a server named RRAS1 that runs the Routing and Remote Access service. Users connect to RRAS1 by using VPNs through the Internet. RRAS1 is configured to support VPN connections by using both PPTP and L2TP. You enable all portable computers to use L2TP to connect to RRAS1.
However, some users also access RRAS1 using their home computers, which must be enabled for L2TP. Which of the following should you do to view the users who are connecting to the server by using PPTP?
A)Configure auditing in the local security policy on RRAS1 to log all logon events.
B)Configure an audit policy on the Domain Controllers organizational unit (OU). Audit all successful logons to the network.
C)Use the Routing and Remote Access console to review the remote access clients list.
D)Use the Routing and Remote Access console to review the properties for each active PPTP port.

Accepted Answer

To view the users who are connecting to the server by using PPTP, use the Routing and Remote Access console to review the properties for each active PPTP port.
Key Takeaway: IP Security provides the encryption for L2TP tunnels. L2TP requires the use of digital certificates. User authentication can be performed via the same PPP authentication mechanisms as PPTP, but L2TP also provides computer authentication. L2TP has several advantages over PPTP. PPTP gives you data confidentiality, but L2TP goes further and also provides data integrity, authentication of origin, and replay protection.

Question 8

A user reports that her computer cannot connect to a remote VPN server. You suspect that her client computer did not receive a recent hotfix. What should you do to verify which hotfixes are installed on her computer?
A)Run the update.exe command from a command prompt.
B)View the History-synch.xml file.
C)View the History-approve.xml file.
D)Run the wmic qfe command from a command prompt.

Accepted Answer

To verify which hotfixes are installed, you should run the wmic qfe command from a command prompt.
Key Takeaway: WMIC extends WMI for operation from several command-line interfaces and through batch scripts. It provides valuable information about hotfixes and security patches.

Question 9

Which of the following is the default value of the refresh interval for a DNS record?
A)7 days
B)3 days
C)10 days
D)24 hours

Accepted Answer

The default value of the refresh interval for a DNS record is 7 days.
Key Takeaway: All dynamically registered resource records are tagged with a timestamp to track the age of the record. This is called Aging. Scavenging is the process of deleting outdated resource records on which time stamps have been placed. The refresh interval is the time after the no-refresh interval during which timestamp refreshes are accepted and resource records are not scavenged. After the no-refresh and refresh intervals expire, records can be scavenged from the zone.

Question 10

Which of the following is an instance when zones do NOT need to be delegated?
A)You need to delegate management of a DNS domain to a branch or department within your organization.
B)You need to distribute the load of maintaining one large DNS database among multiple name servers to improve name resolution performance and fault tolerance.
C)You need hosts and host names to be structured according to branch or departmental affiliation within your organization.
D)You want forwarding to take precedence over delegation.

Accepted Answer

You need not delegate zones when you want forwarding to take precedence over delegation.
Key Takeaway: Delegations take precedence over forwarding, hence it is not recommended to delegate the zones if a zone set to forward all queries that it cannot answer. For a delegation to occur, the parent zone must contain both an A resource record and an NS resource record pointing to the authoritative server of the newly delegated domain. This is necessary to transfer authority to the new name servers and to provide referrals to clients performing iterative queries.

Question 11

Which term refers to an administrative grouping of scopes that is used to support multiple logical subnets on a single network segment when using DHCP?
A)Multiscope
B)Logiscope
C)Superscope
D)DHCP scope

Accepted Answer

Superscope refers to an administrative grouping of scopes that is used to support multiple logical subnets on a single network segment when using DHCP.
Key Takeaway: A superscope allows a DHCP server to provide leases from more than one scope to clients on a single physical network. A requirement before creating a superscope is that you must use DHCP Manager to define all scopes to be included in the superscope. Scopes that are added to a superscope are called member scopes.
Superscopes can be used to resolve DHCP service issues. It can be used when the available address pool for a currently active scope is nearly depleted or when the clients need to be migrated to a new scope.

Question 12

Which of the following is the location where the default DHCP database manual backup is stored?
A)\WINDOWS\System32\Dhcp \Backup
B)\WINDOWS\System32\Backup
C)\WINDOWS\System32\ manualDhcp\Backup
D)\WINDOWS\System32\ Dhcpdatabase\Backup

Accepted Answer

The default DHCP database manual backup is stored at \WINDOWS\System32\Dhcp\Backup.
Key Takeaway: To perform a manual backup of the DHCP database right-click the DHCP server icon in the DHCP console, and then select Backup. To restore the DHCP database, right-click the DHCP server icon in the DHCP console and then select Restore. You can change the database backup folder by selecting a different local folder during a manual backup or by changing the backup folder location in the DHCP server properties dialog box.

Question 13

What is the maximum number of simultaneous VPN connections that Windows Server 2003 can handle?
A)1000
B)500
C)256
D)2024

Accepted Answer

Windows Server 2003 can handle a maximum of 1000 simultaneous VPN connections.
Key Takeaway: Windows Server 2003 supports two types of VPNs: PPTP and L2TP/IPSec. In case you do not specify a VPN remote access server role during the Routing And Remote Access Server Setup Wizard, Windows Server 2003 includes only five ports for each VPN type. These ports appear in the Routing And Remote Access console when you select the Ports node.
To manually configure more ports for a VPN type, open the Ports Properties dialog box, select a port type, and click the Configure button. Enter an appropriate value into Maximum Ports field. You can configure a maximum of 1000 ports for PPTP connections and another 1000 ports for L2TP connections.

Question 14

The Performance Logs And Alerts service is set up to send a message to C4 to notify an operator when the network use on C3 is too high. However, C4 does not receive the message sent from C3. Which of the following should you do to enable messages to be sent by C3 and received by C4?
A)Start the Alerter service on both C3 and C4.
B)Start the Alerter service on C3 and start the Messenger service on C4.
C)Start the Alerter service on C4 and start the Messenger service on C3.
D)Start the Messenger service on both C3 and C4.

Accepted Answer

To enable messages to be sent by C3 and received by C4, start the Alerter service on C3 and start the Messenger service on C4.
Key Takeaway: The Alerter service is a tool used to receive a network pop-up message and/or to run a program when one of the counters exceeds a preset threshold while using Performance Monitor. The Messenger service is a Windows service that transmits net send messages and messages that are sent through the Alerter service between client computers and servers.

Question 15

David is a network administrator in an organization. The organization has leased the Class C address of 200.16.16.0. He subnets using a 255.255.255.224 subnet mask using 2 Cisco routers. How many IP addresses are available to be allocated to computers?
A)29
B)62
C)30
D)20

Accepted Answer

29 IP addresses are available for computers. Key Takeaway: A subnet mask of 255.255.255.224 gives five host address bits. The maximum number of host addresses is 2⁵ - 2 = 30. Since one address is needed for the router interface, there are 29 IP addresses available for computers, including servers and hosts.

Question 16

You DHCP server works fine except that events 1014 and 1016 appear regularly on the System event log. Which of the following tools/utilities should you use to diagnose these events?
A)Netsh
B)Jetpack
C)Netdiag
D)Microsoft Network Monitor

Accepted Answer

You should use the Jetpack utility to diagnose these events.
Key Takeaway: These errors are related to the DHCP database. Event ID of 1014 means Out of database page buffers, and event ID 1016 means there are too many columns in an index. The Jetpack utility can indicate the source of the errors. To use the Jetpack utility on a DHCP database, start Cluster Administrator.
In Cluster Administrator, right-click DHCP service resource and click Take Offline. When the DHCP resource is offline, at a command prompt, change the working folder to the System32\Dhcp folder on the shared drive. At a command prompt, type: jetpack dhcp.mdb temp.mdb. After the Jetpack utility has run, right-click DHCP service resource in the Cluster Administrator, and then click Bring Online.

Question 17

You administer an Active Directory domain in which all servers are Microsoft Windows Server 2003, and all the clients are Microsoft Windows XP Professional. You have configured DHCP to update DNS only if the DHCP client requests. You find that the clients' A resource records are not updated in DNS when they obtain new DHCP leases. Which of the following is the most likely cause of this problem?
A)DNS is not integrated with the Active Directory.
B)DHCP server is not authorized in Active Directory.
C)The DHCP server's computer account is not a member of the DNSUpdateProxy global security group.
D)Clients are not configured to update their own host A resource records.

Accepted Answer

The DHCP server's computer account is not a member of the DNSUpdateProxy global security group.
Key Takeaway: In this case, the clients cannot perform this task because the DHCP server owns the A records. You should add the DHCP server to the DNSUpdateProxy group. Members of this group can update resource records but do not own them. In addition to adding the server to DNSUpdateProxy group, you should manually delete the clients' host records and then either reboot the clients or use the Ipconfig /registerdns command-line utility on each client.

Question 18

Chad notices that there are frequent failures of Active Directory transactions in the event logs of the domain controllers. These are caused by DNS lookup failures against the Globe.com zone. Chad discovers that the data in one of the DNS zones on DC3 is out of date. What should Chad do to find out why the DNS data on DC3 is out of date?
A)Use Event Viewer to examine the DNS Server log for zone transfer errors.
B)Enable debug logging and examine the log file for transfer packets.
C)Use System Monitor to monitor the DNS\Zone Transfer Failure counter.
D)Use the Replmon utility to look for Active Directory replication errors.

Accepted Answer

Chad should Use the Replmon utility to look for Active Directory replication errors to find out why the DNS data on DC3 is out of date.
Key Takeaway: Replmon is a GUI tool that enables administrators to view the low-level status of Active Directory replication, force synchronization between domain controllers, view the topology in a graphical format, and monitor the status and performance of domain controller replication. This tool can be used to see when a replication partner fails, view the properties of directory replication partners, find all direct and transitive replication partners on the network, and display replication topology.

Question 19

When performing performance baselining on Server 1, you notice that a large number of concurrently connected users at any given moment. This is causing performance problems on Server 1. You want to run Network Monitor on this server and capture all packets sent to Server 1.
But packet headers need to be captured in order to reduce the size of the captured data. If a large number of packets are captured, the packets must be retained on the server. Captured packets must not overwrite previously captured packets. Which of the following should you do to configure Network Monitor?
A)Configure the Network Monitor display filters.
B)Configure the Network Monitor capture filters.
C)Decrease the Network Monitor buffer size setting.
D)Increase the Network Monitor buffer size setting.

Accepted Answer

You should increase the Network Monitor buffer size setting.
Key Takeaway: The default buffer size setting is 1 MB. You should reconfigure the buffer size from the Capture Buffer Settings dialog box to increase the Network Monitor buffer size setting from the default of 1 MB. This would result in the buffer being less likely to be full. Hence data will not be overwritten. The frame size setting should be decreased from its default setting of 65,472 bytes so that additional frames can be stored prior to the buffer becoming full.

Question 20

Two of the servers on your network contain highly confidential documents. The company's written security policy states that all network connections with these servers must be encrypted by using an IPSec policy. You place these servers in an organizational unit named SecuServ.
You configure a Group Policy object that requires encryption for all connections and assigns the GPO to the SecuServ OU. What should you do to verify that users are connecting to the two servers using encrypted connections?
A)Use the IP Security Monitor console.
B)Run the net view command.
C)Run the gpresult command.
D)Use the IPSec Policy Management console.

Accepted Answer

To verify that users are connecting to the two servers using encrypted connections, you should Use the IP Security Monitor console.
Key Takeaway: IP Security Monitor can be used to monitor IPSec only on computers running Windows XP or a Windows Server 2003 operating system. To add a computer to the IP Security Monitor console, you should create a console containing IP Security Monitor. In the console tree, right-click IP Security Monitor and then click Add Computer.

Quiz 1: Windows 70-291

A user reports that her computer cannot connect to a remote VPN server. You suspect that her client computer did not receive a recent hotfix. What should you do to verify which hotfixes are installed on her computer?

Which of the following is the default value of the refresh interval for a DNS record?

Which of the following is an instance when zones do NOT need to be delegated?

Which term refers to an administrative grouping of scopes that is used to support multiple logical subnets on a single network segment when using DHCP?

Which of the following is the location where the default DHCP database manual backup is stored?

What is the maximum number of simultaneous VPN connections that Windows Server 2003 can handle?

The Performance Logs And Alerts service is set up to send a message to C4 to notify an operator when the network use on C3 is too high. However, C4 does not receive the message sent from C3. Which of the following should you do to enable messages to be sent by C3 and received by C4?

David is a network administrator in an organization. The organization has leased the Class C address of 200.16.16.0. He subnets using a 255.255.255.224 subnet mask using 2 Cisco routers. How many IP addresses are available to be allocated to computers?

You DHCP server works fine except that events 1014 and 1016 appear regularly on the System event log. Which of the following tools/utilities should you use to diagnose these events?