Microsoft MCSE: 70-293 Practice Test- 2

RAS/VPN service is required if your resource server will be accepting inbound dial-in connections from remote clients. Router Service is required on your resource server only if the server is bound to communicate between two distinct subnets. File Server Service is required if your resource server is going to be configured as a File Server. For your resource server to be a Web Server, you only require the IIS service running on it.

OSPF (Open Shortest Path First) is a routing protocol that is scalable and does not use hop counts as one of its metrics.

When assigning an IP address to the router interface, you must ensure that the IP address is a unique and static IP address and that the subnet mask matches with the subnet mask of the subnet to which the interface is connected. If anyone of these requirements is unfulfilled, the hosts in that subnet will not be able to communicate with the router interface or treat it as their default gateway.

Adprep / forestprep is used to upgrade a forest, and Adprep / domainprep is used to prepare the domain for upgrade

During a CA migration it is important to maintain the same CSP as the old one.

A dedicated WAN link between the DCs for the purpose of replication is not a practical solution at all. Configuring either S1DC2 or S2DC2 as a preferred Bridgehead server will not achieve the desired replication as stated in the question statement.
Since you are required to configure replication between S1DC1 and S2DC1 only, You must configure S1DC1 and S2DC1 as Preferred Bridgehead Servers.

Upgrading the root domain to Windows Server 2003 domain and the DFS also to the Windows Server 2003 based DFS is a good solution as the DFS in Windows Server 2003 can dynamically select sites when resources keep getting relocated. This helps the DFS environment to be efficient and reliable and keep users to be transparent to these relocations.

Choice A is the correct answer.

Choices C and D are incorrect because, Client (Respond only) and Server (Request Security) are IPSec policies used by client computers to respond to the security demanded by servers. They are not security templates.

Choice A is correct because Hisecws.inf is the template that will be used for deploying on a group of client/workstation computers to maintain security configuration, common to that group.

Choice C is the correct answer.

Windows-based VPN clients should use Layer 2 Tunneling Protocol (L2TP) with IPSec (L2TP/IPSec) to make IPSec-secured, end-to-end connections through VPN tunnels.

Choices A and B are incorrect because they are not as best suited as choice C.

Choice D is incorrect because IPSec is not a tunneling protocol.

Page file related consistencies occur whenever the RAM on the server is insufficient to handle the load of application being used on that server. This can be overcome by upgrading the Ram to the required amount of memory in terms of MB or GB.

The Site 3 and the new site have either duplicate IP address range or a portion of the contiguous range is overlapping between the two networks which could be causing the �duplicate IP address� error message to be generated on the two sites.

IAS (Internet Authentication Service) Server can be used as a RADIUS server in a Windows Server 2003 network as the IAS uses RADIUS technology and is capable of being a RADIUS Server.

The data required for the said analysis must be captured and stored under the name dns.log as per recommendation.

Since the Web server is a secure one, you must unblock port 443 as well since that accepts communication on the SSL.

The most preliminary way of recovering a server is to use the LKGC. Next would be the Safe mode restart, and then the Recovery console mode which is more complex than the other two methods.

Authorizing a DHCP server is usually done at the root level. Since you are the administrator for the existing network, you will have to authorize the DHCP server. The administrator of the new site will not have the required authority over the network to authorize the DHCP server.

Since transactions will be carried out every second of the uptime of the DHCP server, it is not advisable to compact a live database. It is always preferable to back up the database, compact the backed up version of the database and restore it. Restarting the server or refreshing the database in the mentioned fashion will not achieve any desired results.

It is the Global Catalog (GC) server that contains the information of Universal Group Membership. Users who need forest wide access to resources are a part of the Universal Group. If for some reason this membership information is unavailable then such a user will be denied access

NLB and Clustering are the most effective methods of implementing server availability. DFS cannot be considered as Server availability rather a Data availability Service. EFS is a security for data and not a availability service.

On both the networks you will need to create an exception one way between the Database server and the Web Server respectively. This will ensure a possible two-way communication between the Web server and the database server. Recreating policies all over again is uncalled for. Moving either server to the other network can result in security issues.

The default time for caching links is 30 minutes. Since the replication between the DFS root and link is so extensive, even setting the values to default may not help. The priority replication here is DCs and then the DNS servers. Hence the replication between the DFS root and its replica must be much higher than default values and must be configured after careful analysis of the situation with exact data on hand.

The user who is responsible for authorizing certificates must be a part of the Certificate Manager group.

It is neither possible to create a NAT mapping nor a domain configuration as stated in choices A and D. All you need to do here is to deploy a certificate to the domain members that allows access to the Web servers and ensure that certificate will be assigned the �auto-enroll� permission for the user.

Neither TCP nor UDP can help against network based attacks. When considering security for networks against network based attacks, you need to employ applications that are specifically built for that purpose. For ex: If you need protection for email, then that security will have to be built into the application through the SSL (Secure Socket Layer).

To be able to auto-enrol as well as renew the certificates nearing expiry, the user will need read, enrol and auto-enrol permissions.

Choices A and D are the correct answers.

Choices A and D are correct because creating an OU named �Policy test� and creating a child container, one each for the desktop, server, and domain controller, will reduce administrative efforts, a number of multiple links, and solve the issue of placing servers for testing too.

Choices B and C are incorrect because as opposed to choices A and B, they do not help to minimize links, which is a criterion in the objectives.

The OS itself will pop-up messages to users when they near the disk limit if you enable the warning limit option.
By checking the option �deny disk usage exceeding the limit�, you have ensured that no user will be using more than 200 MB of disk space.

Considering that the scenario describes a network that needs the routing network of maximum 12 hop counts and is a linear network, it is sufficient to use RIPv1 as the routing protocol. RIPv2 and OSPF are a little too sophisticated and inappropriate for the given scenario. EIGRP is not supported by Windows Server 2003 network

A DFS can be termed as a platform for resource management. It provides uniform naming convention for accessing of resources and is nothing but a listing or mapping of resources or collection of resources. It does not relate to server clusters in any way.

Choice C is the correct answer.

Choice C is correct because IPSec can be used for internal security by combining host-based permit and block packet filters with the ability to enforce trusted access for network connections.

Through host-based IPSec packet filtering, you can permit or block specific types of unicast IP traffic based on source and destination address combinations, specific protocols, and specific ports.

Through the enforcement of trusted access, you can ensure that only trusted computers that have specific IP addresses or those that are within specific IP address ranges can access an internal corporate network server.

In addition, you can use IPSec to audit which computers are connecting to the server and when.

Choice A is incorrect because Kerberos is not a considered option in this scenario.

Choice B is incorrect because the question statement does not specify a project-based security as a requirement at all.

Depending on the level of security desired by the network, you may place the RAS server on the edge of the internal network or use perimeter filtering for the internal network and place the RAS server on the perimeter network. Perimeter networks are used as a barrier in between the internal network and the public network. A strict filtering process is usually employed on all packets passing through the perimeter network.

For any server to be administered remotely, you require the registry to be accessible. For this reason you need to enable the remote registry service as well as the Server service which is a pre-requisite for this scenario.

Data can be secured only if the two ends are trusted by IPSec and not otherwise. Hence IPSec is capable of Data integrity, confidentiality, data authentication and anti-replay of data between trusted sources.

Choices C and D are the correct answers.

Adding the enterprise CA to the Cert Publishers group in ad2.contoso.com is essential for the certificates of users in ad2.contoso.com to be published in the Active Directory.

Choice A is incorrect because if there is a problem with configuration, none of the user certificates would get published, whereas the certificates of users in ad1.contoso.com are being published in the Active Directory.

Choice B is incorrect because there is no mention of problems relating to WAN links in the question statement.

Choice E is incorrect because trust between the two domains cannot be an issue, as a 2-way implicit trust will exist between the child domains and their parents, which is transitive in nature.

Choices A and B are the correct answers.

Choices A and B are correct because the permissions required for certificate renewal request are read and enroll.

Auto enroll will be required along with read and enroll for automatic enrollment of certificates.

Choice D is incorrect because there is no such permission as renew.

To ensure the users are accessing resources as per their roles only, you must assign local permission as well as share permission to the users on those resources. The most strict permissions will be effective to users who are logged on to the network and are accessing those resource over the network.

To ensure each user, does not use up more than 100 MB of disk space on the resource server, you must assign disk quota

Choices A and D are the correct answers.

The basic infrastructure requirements for Autoenrollment to work are

-- Windows Server 2003 Schema
-- Group policy updates

Choices B and C are incorrect because group policies and scripts are only used for the implementation of security and do not conform to the requirement of the same. The Schema for Autoenrollment will have to be that of the Windows Server 2003.

As per Microsofts recommendation, the following will be the minimum requirement for setting up server clustering:
1. At least two servers
2. At least 2 PCI NICs per server - one should be dedicated for cluster communication
3. Local Storage.

The private keys will ensure communication with old clients will be smooth even after upgrade. The database log may help in tracking previous transactions. The database itself will contain all the pending and successful queries

IPSec can be used in this scenario, for the following:
� Site-o-Site VPN using L2TP/IPSec
� VPN for dial-in users with relevant IPSec policies in place.

To secure the internal network, it is better to add an additional tier to the network by using IAS service for authenticating remote clients.

Security for the said network by securing end-to-end communication for all hosts will not only compromise the efficiency of the network to a great extent, but it is also not required by the scenario.

Choices A, C, and E are the correct answers.

Choices A, C, and E are correct because what is required is to run the �certutil �setreg� command with the �certlog-verbose� level. This will log errors into the �Event viewer� in much more detail.

Choice B is incorrect because the �network monitor� cannot help in this situation.

Choice D is incorrect because the �certlog �warning� mode is the default level that was decided as insufficient, as described in the question statement.

When establishing cluster service on servers that physically separated over a long distance using WAN links, it is always advisable to use a secondary connection to allow a backup path for the cluster information interchange between the two servers. The NIC cards used in the cluster servers as per recommendation should be PCI cards minus the fault tolerance capability, as the FT can hamper the recovery process.