Question 1

Chad's company has a written company security policy that states all computers in the domain must be examined for available security updates, shared folders, and record file system type on each hard disk. Chad needs to perform this security assessment of every computer and must verify that the requirements of the written security policy are met. What should Chad do?
A)Open the Default Domain Policy and enable the Configure Automatic Updates policy.
B)Open the Default Domain Policy and enable the Audit object access policy, the Audit account management policy, and the Audit system events policy.
C)Install and run mbsacli .exe with the appropriate configuration switches on the server.
D)Install and run HFNetChk.exe with the appropriate configuration switches, on the server.

Accepted Answer

Chad should install and run mbsacli.exe with the appropriate configuration switches on the server.
Key Takeaway: The mbsacli.exe command runs the HFNETCHK utility to scan for hotfix status and other security setting vulnerabilities in the Microsoft operating systems. Reports are saved in the SECURITYSCANS folder of the user profile for the user who is logged in. MBSA requires administrator privileges on both the computer with MSBA installed and the target computers that you scan.

Question 2

Chad decides to move the DHCP service from Server 1 to Server2. After installing DHCP on Server2, Chad creates a new scope in DHCP and activates it. Users report that they cannot log on to the network. Chad notices that the client computers are not receiving an IP address configuration from the DHCP server.
He opens Event Viewer on Server2 and views an event that states "The DHCP service failed to see a directory server for authorization." What should Chad do to fix this issue?
A)Authorize the DHCP service on Server2 in Active Directory.
B)Restart the DHCP service on Server2.
C)Uninstall the DHCP service on Server 1.
D)Install DNS on Server2. Configure a secondary zone on Server2 for the Active Directory domain DNS zone.

Accepted Answer

Chad should Authorize the DHCP service on Server2 in Active Directory.
Key Takeaway: To authorize a DHCP service, open the DHCP console from the Administrative Tools menu. In the Console Tree, right-click DHC, and then click Manage Authorized Servers. In the Manage Authorized Servers dialog box, select Authorize. In the Authorize DHCP Server dialog box, type the name or IP address of the DHCP server to be authorized and then click OK. The computer will list the IP and full computer name and then ask for confirmation. Click OK to continue.

Question 3

John's organization has an IAS configured to accept multiple authentication methods. During a negotiation, the network access servers attempt to negotiate a connection using the most secure protocol first, i.e. EAP first. Which of the following entities attempt to negotiate the EAP authentication mechanism?
A)Remote access client and the IAS server
B)RAS server and the IAS server
C)RAS server and the remote access client
D)RADIUS client and the remote access client

Accepted Answer

The remote access client and the IAS server attempt to negotiate the EAP authentication mechanism.
Key Takeaway: A remote access client requires authentication. Since the authentication methods are configured on the IAS server, the remote access client and the IAS server negotiate the EAP authentication mechanism. EAP typically runs directly over the link layer without requiring IP and includes its own support for in-order delivery and retransmission.

Question 4

A network uses RIP version 2 for IP installed on all Windows Server 2003 servers acting as routers. Multiple routes exist from any subnet to any other subnet. An administrator detects slow resource access between subnets. A network analysis reveals a significant amount of UDP broadcast traffic on port 520. Which of the following should the administrator do to reduce this traffic?
A)Increase the Periodic Announcement Interval setting to 300 seconds on router interfaces.
B)Disable split horizon for RIP v2.
C)Increase the Time Before Routes Expire setting to 1500 seconds.
D)Replace the routers with good-known ones.

Accepted Answer

To reduce traffic, the administrator should Increase the Periodic Announcement Interval setting to 300 seconds on router interfaces.
Key Takeaway: By default, RIP updates the routing tables by broadcasting routing table information every 30 seconds. This affects the network bandwidth significantly. In this case, it is safe to increase this interval to 300 seconds. This would decrease broadcast traffic.

Question 5

An employee is receiving an error message when she tries to open a Web page. The error states "Web page requested is not available." You note that https:// appears in the address bar. You confirm that the site is up and running by accessing it from a computer outside your corporate network. Which of the following should you do to fix this problem?
A)Allow traffic on TCP port 443.
B)Allow traffic on TCP port 53.
C)Configure the default IPSec Client (Respond Only) policy on the client computers.
D)The Web server hosting the Web page is down.

Accepted Answer

To fix this problem, you should allow traffic on TCP port 443.
Key Takeaway: The message "Web page requested is not available" indicates an encryption problem when https:// appears on the address bar. Web page encryption is implemented using the Secure Sockets Layer (SSL) protocol. This protocol uses TCP port 443. Hence you should allow traffic on TCP port 443.

Question 6

Users on your network complain that they cannot access the Internet. You verify that your NAT server is up and that NAT is running properly. You run the ipconfig command on one of the client computers and receive an APIPA address.
You log on to the DHCP server and discover that the DHCP service has stopped. You restart the DHCP service. Users still cannot connect to the Internet. You need to enable the client computers to connect to the Internet quickly. What should you do?
A)Run the netstat command on each client computer.
B)Instruct the users to wait a few minutes for the DHCP server to lease new IP addresses to the client computers.
C)Install a DHCP relay agent on the network.
D)Run the ipconfig /release command and then the ipconfig /renew command on each client computer.

Accepted Answer

You should instruct the users to wait a few minutes for the DHCP server to lease new IP addresses to the client computers.
Key Takeaway: The DHCP service was down hence the users could not receive an IP address and hence the APIPA. Now that the DHCP service is restarted, users must wait for the DHCP clients to attempt to locate the DHCP server again. This usually occurs at an interval of 5 minutes.

Question 7

During a routine maintenance process David notices that his organization's DHCP server is not responding to DHCP lease requests from DHCP clients. He suspects that there may be a problem with the authorization of the DHCP server in Active Directory. He needs to verify that the DHCP server is authorized in Active Directory. What should he do?
A)View the Directory Service log on the DHCP server.
B)View the Application event log on the DHCP server.
C)View the System event log on the DHCP server.
D)View the DHCP audit log on the DHCP server.

Accepted Answer

David should view the DHCP audit log on the DHCP server to verify that the DHCP server is authorized in Active Directory.
Key Takeaway: DHCP audit logging is enabled by default on DHCP severs. David should view the DHCP audit log on the DHCP server and check for events with an event ID in the range 50 through 64. This will help determine if the DHCP server is authorized in Active Directory.

Question 8

The abc.com network consists of a single Active Directory domain. The abc.com network contains a Windows Server 2003 computer named Serv1, which is configured as a DNS server. Serv1 is a primary server for one forward lookup zone and has round robin enabled. What should you do to ensure that support for round robin is disabled?
A)You should access the zone's Properties sheet in the DNS console and click on the Zone Transfers tab.
B)You should access the zone's Properties sheet in the DNS console and click on the Start of Authority (SOA) tab.
C)You should access the Serv1's Properties sheet in the DNS console and click on the Advanced tab.
D)You should access the Serv1's Properties sheet in the DNS console and click on the Interfaces tab.

Accepted Answer

You should access the Serv1's Properties sheet in the DNS console and click on the Advanced tab to ensure that support for round robin is disabled.
Key Takeaway: Round robin is a local balancing mechanism used by DNS servers to share and distribute network resource loads. To disable support for round robin, you should access the Serv1's Properties sheet in the DNS console, click on the Advanced tab, and clear the Enable round robin in the Server options section.

Question 9

On a network, S1 is configured as the primary server, and S2 hosts a secondary DNS zone for the Active Directory domain. David configures S1 to allow zone transfer to S2, and he configures S2 with the default zone transfer settings. When the domain users report that they are unable to access certain hosts by name, David decides to use System monitor on S2. What should he do to make sure S2 is receiving zone transfers from S1?
A)Monitor the AXFR Request Received counter.
B)Monitor the AXFR Success Received counter.
C)Monitor the IXFR Request Received counter.
D)Monitor the IXFR Success Received counter.

Accepted Answer

David should monitor the IXFR Success Received counter to make sure S2 is receiving zone transfers from S1.
Key Takeaway: A secondary DNS zone is a read-only copy of a zone. Its data can be loaded and updated only through zone transfers from a designated master server. DNS servers running a Windows 2000 Server or later use incremental zone transfers, which involves transmitting only the new and changed records.

Question 10

You receive reports from users that DNS name resolution has slowed significantly over the last few weeks. What should you do to verify that the performance problem is due to the DNS server?
A)Monitor the DNS: Dynamic Update Received/sec, the DNS: Total Query Received/sec, and the DNS: Total Response Sent/sec counters using the System Monitor.
B)Monitor for DNS Event ID 2 and 3 using the DNS Event log.
C)Monitor the Network Interface: Bytes Total/sec counter using the System Monitor.
D)Enable debug logging on DNS server, and configure the log to capture Outgoing and Incoming packets.

Accepted Answer

You should monitor the DNS: Dynamic Update Received/sec, the DNS: Total Query Received/sec, and the DNS: Total Response Sent/sec counters using the System Monitor.
Key Takeaway: System Monitor can be used to report statistical information about the DNS server. This will help determine if performance on the DNS server is what it should be. The Dynamic Update Received/sec counter displays the total number of dynamic update requests received by the DNS server. The Total Query Received/sec counter displays the average number of queries received by the DNS server every second. The Total Response Sent/sec counter displays the average number of responses sent by the DNS server every second.

Question 11

The abc.com network contains six Windows Server 2003 Standard Edition computers and 600 client computers running Windows XP Professional. You need to configure security settings related to passwords, account lockout, and Kerberos. This custom security template will be imported into a Group Policy Object (GPO) that is linked to the domain. Which security template node will you use to accomplish this task?
A)The Event Log node
B)The Local Policies node
C)The Account Policies node
D)The Restricted Groups node

Accepted Answer

You should use the Account Policies node to accomplish this task.
Key Takeaway: The Account Policies node of the Security template is used to configure password, account lockout, and Kerberos settings. To copy the account policies settings from the hisecws.inf template into a blank one, navigate to C:Windowssecuritytemplates > hisecws.inf. Right-click the Account Policies node and select Copy. Navigate to the Account Policies node in your new policy, right-click, and select Paste. This will add the account policies from the hisecws.inf template while leaving the other nodes undefined.

Question 12

The abc.com network contains six Windows Server 2003 Standard Edition computers and 600 client computers running Windows XP Professional. You need to configure settings that are related to auditing, user rights, and other security-related options. This custom security template will be imported into a GPO that is linked to the domain.
Which security template node will you use to accomplish this task?
A)The Event Log node
B)The Account Policies node
C)The Restricted Groups node
D)The Local Policies node

Accepted Answer

You should use the Local Policies node to accomplish this task.
Key Takeaway: The Local Policies node of the security template is used to configure auditing, user rights, and other security related options. Local policies deal with who has local access or network access to the computer. It also includes the manner in which events are audited.

Question 13

The written security policy states that all remote users should configure their home computers to reject cookies from all Web sites, except the abc.com Web site. A user starts Internet Explorer and selects Internet Options from the Tools menu. Which of the following tabs should the user select to configure his computer in compliance with the company policy?
A)Security
B)Advanced
C)Content
D)Privacy

Accepted Answer

He should click the Privacy tab to configure his computer in compliance with the company policy.
Key Takeaway: On the Privacy tab, the user should move the slider to set automatic cookie handling. The six available settings range from Accept all Cookies to Block all Cookies. He can also click Advanced and specify custom cookie-handling settings to override the automatic cookie-handling behavior. He should click Edit and specify the URLs of the Web sites whose cookies should always be accepted or blocked.

Question 14

You are working as a network administrator for xyz.com. 25 employees from your company connect to a terminal server named Server 3 to run applications and to gain access to the Internet. These employees report that they receive security messages while browsing Internet Web sites. The employees report that they cannot modify the Internet Explorer security settings on their client computers while connected to Server 3. What should you do to allow these employees to modify the Internet Explorer security settings on their client computers while connected to Server 3?
A)Log on to Server 3 as Administrator and add http:// to the list of trusted sites in Internet Explorer.
B)Uninstall Internet Explorer Enhanced Security Configuration on Server 3.
C)Instruct these employees to change the Internet Explorer privacy settings on their client computers to Low.
D)Instruct these employees to add http:// to the list of trusted sites in Internet Explorer on their client computers.

Accepted Answer

To modify the Internet Explorer security settings on their client computers while connected to Server 3, uninstall Internet Explorer Enhanced Security Configuration on Server 3.
Key Takeaway - Windows Server 2003 has an Internet Explorer Enhanced Security which is an extra layer of protection when surfing the internet using Internet Explorer. These may sometimes prove to be quite annoying to some users. To disable this, open Control Panel and click Add/Remove Programs. Click Add/Remove Windows Components. Uncheck the check mark next to Internet Explorer Enhanced Security Configuration, click Next.

Question 15

Which of the following is one of the operations masters roles in Active Directory?
A)DNS Master
B)Site Master
C)Replication Master
D)PDC Emulator

Accepted Answer

PCD Emulator is one of the operations masters roles in AD.
Key Takeaway: The roles in every forest AD include Schema master and Domain naming master. The roles in every domain in the forest include Relative ID (RID) master, Primary domain controller (PDC) emulator master, and Infrastructure master.

Question 16

Which of the following specifies a feature that is not associated with an Active Directory domain?
A)Hierarchical structure of containers and objects.
B)Dependency on DNS.
C)Member of a forest.
D)Absence of a security boundary.

Accepted Answer

The absence of a security boundary is a feature that is not associated with an Active Directory domain.
Key Takeaway: The functions and benefits of Active Directory are: simplified user and network-resource management, flexible and secure authentication and authorization services, scalability without complexity, centralized resource and security administration, single point of access to resources, and fault tolerance and redundancy.

Question 17

Which of the following protocols is used for directory service in Active Directory?
A)DNS
B)WINS
C)LDAP
D)TCP/IP

Accepted Answer

LDAP provides directory service in Active Directory.
Key Takeaway: One of the key standards that enables Active Directory is the Lightweight Directory Access Protocol, or LDAP. LDAP is used to query and update data within the directory. Active Directory supports both LDAP versions 2 and 3. The two LDAP naming paths include distinguished names and relative distinguished names.

Question 18

What is the domain that is part of an existing tree structure with a forest root containing a contiguous namespace called?
A)Namespace domain
B)Parent domain
C)Forest domain
D)Child domain

Accepted Answer

The domain that is part of an existing tree structure with a forest root containing a contiguous namespace is called Child domain.
Key Takeaway: A child domain, also known as a sub domain, is a domain that is a part of a larger domain name in DNS hierarchy. The DNS hierarchy consists of the root-level domain at the top, underneath which are the top-level domains, followed by second-level domains and finally the sub domains.

Question 19

Which of the following utilities could you use to create an application data partition on the domain controller?
A)NTDSUTIL
B)Active Directory Sites and services
C)Active Directory Users and Computers
D)DNS administrative console

Accepted Answer

NTDSUTIL is the utility used to create an application data partition on the domain controller.
Key Takeaway: NTDSUTIL is a command line utility that has an interactive hierarchy of menus. The command line utilities can easily be run in the startup Directory Service Restore mode, as is required for offline defragmentation. Each menu is identified by a unique command prompt to help the user determine the current location in the hierarchy. You can interactively navigate the menu hierarchy, or all of the commands can be typed on one line.

Question 20

Which of the following is the default domain functional level set when the first Windows server 2003 domain controller is installed?
A)Windows 2000 native mode
B)Standard mode
C)Enterprise mode
D)Windows 2000 mixed mode

Accepted Answer

The default domain functional level set when the first Windows server 2003 domain controller is installed is Windows 2000 mixed mode.

Quiz 1: Windows 70-291

You receive reports from users that DNS name resolution has slowed significantly over the last few weeks. What should you do to verify that the performance problem is due to the DNS server?

Which of the following is one of the operations masters roles in Active Directory?

Which of the following specifies a feature that is not associated with an Active Directory domain?

Which of the following protocols is used for directory service in Active Directory?

What is the domain that is part of an existing tree structure with a forest root containing a contiguous namespace called?

Which of the following utilities could you use to create an application data partition on the domain controller?

Which of the following is the default domain functional level set when the first Windows server 2003 domain controller is installed?