Test On Windows Server 2008 Active Directory! Trivia Question Quiz

1. Your network contains a server that has the Active Directory Lightweight Directory Services (AD LDS) role installed. You need to perform an automated installation of an AD LDS instance. Which tool should you use?

Dism.exe

Servermanagercmd.exe

Adaminstall.exe

Ocsetup.exe

Adaminstall.exe is the correct tool to use for performing an automated installation of an AD LDS instance. AD LDS (Active Directory Lightweight Directory Services) is a Windows Server feature that provides directory services for applications. Adaminstall.exe is a command-line tool that is used to install AD LDS instances. It allows for the automated installation and configuration of AD LDS, making it the appropriate tool for this task.

Explanation

Adaminstall.exe is the correct tool to use for performing an automated installation of an AD LDS instance. AD LDS (Active Directory Lightweight Directory Services) is a Windows Server feature that provides directory services for applications. Adaminstall.exe is a command-line tool that is used to install AD LDS instances. It allows for the automated installation and configuration of AD LDS, making it the appropriate tool for this task.

2. Your network contains an Active Directory domain named contoso.com. A partner company has an Active Directory domain named nwtraders.com. The networks for contoso.com and nwtraders.com connect to each other by using a WAN link. You need to ensure that users in contoso.com can access resources in nwtraders.com and resources on the Internet. What should you do first?

Modify the Trusted Root Certification Authorities store.

Modify the Intermediate Certification Authorities store.

Create conditional forwarders.

Add a root hint to the DNS server.

Creating conditional forwarders is the first step to ensure that users in contoso.com can access resources in nwtraders.com and resources on the Internet. Conditional forwarders allow the DNS server in contoso.com to forward queries for specific domains to the DNS server in nwtraders.com, allowing users to access resources in that domain. This is necessary because the two domains are connected by a WAN link, and without conditional forwarders, the DNS server in contoso.com would not know how to resolve queries for resources in nwtraders.com or on the Internet. Modifying the Trusted Root Certification Authorities or Intermediate Certification Authorities stores, or adding a root hint to the DNS server, are not relevant to the task of enabling access to resources in nwtraders.com and the Internet.

Explanation

Creating conditional forwarders is the first step to ensure that users in contoso.com can access resources in nwtraders.com and resources on the Internet. Conditional forwarders allow the DNS server in contoso.com to forward queries for specific domains to the DNS server in nwtraders.com, allowing users to access resources in that domain. This is necessary because the two domains are connected by a WAN link, and without conditional forwarders, the DNS server in contoso.com would not know how to resolve queries for resources in nwtraders.com or on the Internet. Modifying the Trusted Root Certification Authorities or Intermediate Certification Authorities stores, or adding a root hint to the DNS server, are not relevant to the task of enabling access to resources in nwtraders.com and the Internet.

3. You have a DNS zone that is stored in a custom application partition. You need to add a domain controller to the replication scope of the custom application partition. Which tool should you use?

DNScmd

DNS Manager

Server Manager

Dsmod

To add a domain controller to the replication scope of a custom application partition, the tool that should be used is DNScmd. DNScmd is a command-line tool that allows administrators to manage and configure DNS servers. It provides various options and commands to perform tasks related to DNS management, including adding domain controllers to replication scopes. DNS Manager is a graphical tool for managing DNS servers, but it does not have the specific functionality to modify replication scopes. Server Manager is used for managing server roles and features, and Dsmod is a command-line tool used for modifying Active Directory objects, not DNS replication scopes.

Explanation

To add a domain controller to the replication scope of a custom application partition, the tool that should be used is DNScmd. DNScmd is a command-line tool that allows administrators to manage and configure DNS servers. It provides various options and commands to perform tasks related to DNS management, including adding domain controllers to replication scopes. DNS Manager is a graphical tool for managing DNS servers, but it does not have the specific functionality to modify replication scopes. Server Manager is used for managing server roles and features, and Dsmod is a command-line tool used for modifying Active Directory objects, not DNS replication scopes.

4. Your network contains an Active Directory-integrated DNS zone named contoso.com. You discover that the zone includes DNS records for computers that were removed from the network. You need to ensure that the DNS records are deleted automatically from the zone. What should you do?

From DNS Manager, set the aging properties.

Create a scheduled task that runs dnslint.exe /v /d contoso.com.

From DNS Manager, modify the refresh interval of the start of authority (SOA) record.

Create a scheduled task that runs ipconfig.exe /flushdns.

To automatically delete DNS records for computers that have been removed from the network, you should set the aging properties in DNS Manager. By configuring the aging properties, you can specify a time period after which DNS records will be considered stale and automatically deleted from the zone. This ensures that the DNS zone remains up to date and only contains active and valid records.

Explanation

To automatically delete DNS records for computers that have been removed from the network, you should set the aging properties in DNS Manager. By configuring the aging properties, you can specify a time period after which DNS records will be considered stale and automatically deleted from the zone. This ensures that the DNS zone remains up to date and only contains active and valid records.

5. Your network contains an Active Directory forest. The forest contains 10 domains. All domain controllers are configured as global catalog servers. You remove the global catalog role from a domain controller named DC5. You need to reclaim the hard disk space used by the global catalog on DC5. What should you do?

From Active Directory Sites and Services, run the Knowledge Consistency Checker (KCC).

From Active Directory Sites and Services, modify the general properties of DC5.

From Ntdsutil, use the Semantic database analysis option.

From Ntdsutil, use the Files option.

By using the "Files" option in Ntdsutil, you can reclaim the hard disk space used by the global catalog on DC5. Ntdsutil is a command-line tool that allows you to manage Active Directory databases and related components. The "Files" option in Ntdsutil provides various options for managing the files associated with Active Directory, including the ability to remove or move the global catalog files. Therefore, selecting this option will allow you to reclaim the hard disk space used by the global catalog on DC5.

Explanation

By using the "Files" option in Ntdsutil, you can reclaim the hard disk space used by the global catalog on DC5. Ntdsutil is a command-line tool that allows you to manage Active Directory databases and related components. The "Files" option in Ntdsutil provides various options for managing the files associated with Active Directory, including the ability to remove or move the global catalog files. Therefore, selecting this option will allow you to reclaim the hard disk space used by the global catalog on DC5.

6. Your network contains an Active Directory forest. The forest contains multiple domains. You need to ensure that users in the human resources department can search for employees by using the employee number attribute. What should you do?

From Active Directory Sites and Services, modify the properties of each global catalog server.

From the Active Directory Schema snap-in, modify the properties of the user object class.

From Active Directory Sites and Services, modify the NTDS Settings objectof each global catalogserver.

From the Active Directory Schema snap-in, modify the properties of the employeeNumber attribute.

To ensure that users in the human resources department can search for employees by using the employee number attribute, you need to modify the properties of the employeeNumber attribute in the Active Directory Schema snap-in. This will allow the attribute to be searchable and accessible for the users in the human resources department. Modifying the properties of the global catalog server or the user object class in Active Directory Sites and Services will not directly enable the search functionality for the employee number attribute.

Explanation

To ensure that users in the human resources department can search for employees by using the employee number attribute, you need to modify the properties of the employeeNumber attribute in the Active Directory Schema snap-in. This will allow the attribute to be searchable and accessible for the users in the human resources department. Modifying the properties of the global catalog server or the user object class in Active Directory Sites and Services will not directly enable the search functionality for the employee number attribute.

7. Your network contains an Active Directory domain named contoso.com. Contoso.com contains a writable domain controller named DC1 and a read-only domain controller (RODC) named DC2. All domain controllers run Windows Server 2008 R2. You need to install a new writable domain controller named DC3 in a remote site. The solution must minimize the amount of replication traffic that occurs during the installation of Active Directory Domain Services (AD DS) on DC3. What should you do first?

Run dcpromo.exe /createdcaccount on DC3.

Run ntdsutil.exe on DC2.

Run dcpromo.exe /adv on DC3.

Run ntdsutil.exe on DC1.

Running "dcpromo.exe /adv" on DC3 will allow us to install AD DS on DC3 using the advanced mode. This mode allows us to specify additional options during the installation process, including the ability to specify the replication source. By specifying DC1 as the replication source, we can minimize the replication traffic by only replicating the changes from DC1 to DC3, instead of replicating all the data from DC2 to DC3.

Explanation

Running "dcpromo.exe /adv" on DC3 will allow us to install AD DS on DC3 using the advanced mode. This mode allows us to specify additional options during the installation process, including the ability to specify the replication source. By specifying DC1 as the replication source, we can minimize the replication traffic by only replicating the changes from DC1 to DC3, instead of replicating all the data from DC2 to DC3.

8. Your network contains a single Active Directory domain. The domain contains an enterprise certification authority (CA). You need to ensure that the encryption keys for e-mail certificates can be recovered from the CA database. You modify the e-mail certificate template to support key archival. What should you do next?

Issue the key recovery agent certificate template.

Run certutil.exe -recoverkey.

Run certreq.exe-policy.

Modify the location of the Authority Information Access (AIA) distribution point.

In order to ensure that the encryption keys for e-mail certificates can be recovered from the CA database, you need to issue the key recovery agent certificate template. This template will allow designated individuals or entities to recover the encryption keys when needed. This step is necessary before running any other commands or modifying any other settings related to key recovery.

Explanation

In order to ensure that the encryption keys for e-mail certificates can be recovered from the CA database, you need to issue the key recovery agent certificate template. This template will allow designated individuals or entities to recover the encryption keys when needed. This step is necessary before running any other commands or modifying any other settings related to key recovery.

9. Your network contains a server named Server1 that runs Windows Server 2008 R2 Standard. Server1 has the Active Directory Certificate Services (AD CS) role installed. You configure a certificate template named Template1 for autoenrollment. You discover that certificates are not being issued to any client computers. The event logs on the client computers do not contain any autoenrollment errors. You need to ensure that all of the client computers automatically receive certificates based on Template1. What should you do?

Modify the Default Domain Policy Group Policy object (GPO).

Modify the Default Domain Controllers Policy Group Policy object (GPO).

Upgrade Server1 to Windows Server 2008 R2 Enterprise.

Restart Certificate Services on Server1.

By modifying the Default Domain Policy Group Policy object (GPO), you can configure the autoenrollment settings for client computers. This GPO is applied to all computers in the domain by default, so modifying it will ensure that all client computers automatically receive certificates based on Template1. Modifying the Default Domain Controllers Policy GPO or upgrading Server1 to Windows Server 2008 R2 Enterprise will not address the issue. Restarting Certificate Services on Server1 may not resolve the problem as there are no autoenrollment errors in the event logs on the client computers.

Explanation

By modifying the Default Domain Policy Group Policy object (GPO), you can configure the autoenrollment settings for client computers. This GPO is applied to all computers in the domain by default, so modifying it will ensure that all client computers automatically receive certificates based on Template1. Modifying the Default Domain Controllers Policy GPO or upgrading Server1 to Windows Server 2008 R2 Enterprise will not address the issue. Restarting Certificate Services on Server1 may not resolve the problem as there are no autoenrollment errors in the event logs on the client computers.

10. A corporate network includes an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers. You add multiple DNS records to the zone. You need to ensure that the new records are available on all DNS servers as soon as possible. Which tool should you use?

Ldp

Repadmin

Ntdsutil

Nslookup

Active Directory Sites And Services console

Active Directory Domains And Trusts console

Dnslint

Dnscmd

Dnscmd should be used to ensure that the new DNS records are available on all DNS servers as soon as possible. Dnscmd is a command-line tool that allows administrators to manage and troubleshoot DNS servers. It can be used to add, delete, or modify DNS records on a DNS server, as well as to force DNS replication to ensure that changes are propagated to all DNS servers in the network. By using Dnscmd, the administrator can ensure that the new records are quickly available on all DNS servers in the corporate network.

Explanation

Dnscmd should be used to ensure that the new DNS records are available on all DNS servers as soon as possible. Dnscmd is a command-line tool that allows administrators to manage and troubleshoot DNS servers. It can be used to add, delete, or modify DNS records on a DNS server, as well as to force DNS replication to ensure that changes are propagated to all DNS servers in the network. By using Dnscmd, the administrator can ensure that the new records are quickly available on all DNS servers in the corporate network.