Question 1.
You are an enterprise administrator for ITCertKeys. The company has a head office in San Diego and a branch office in New York. The corporate network of ITCertKeys consists of an Active Directory forest having two domains, ITCertKeys.com and Branch. ITCertKeys.com for the head office and the branch office respectively. All the servers on the corporate network run Windows Server 2008 and both the offices hold their respective domain controllers on their physical office locations. 

The two domain controllers at ITCertKeys.com are called ITCertKeysServer1 and ITCertKeysServer2 and the two domain controllers at Branch. ITCertKeys.com are called ITCertKeysServer3 and ITCertKeysServer4. All domain controllers host Active Directory-integrated DNS zones for their respective domains. As an enterprise administrator of the company, you have been assigned the task to ensure that users from each office can resolve computer names for both domains from a local DNS server. 

Which of the following options would you choose to accomplish this task?

A. Add the ITCertKeys.com and the Branch. ITCertKeys.com DNS zones to the ForestDNSZones 
    partition.
B. Create a stub DNS zone for ITCertKeys.com on ITCertKeysServer3 and a stub DNS zone for 
    Branch. ITCertKeys.com on ITCertKeysServer1.
C. Create a standard primary DNS zone named ITCertKeys.com on ITCertKeysServer3 and a 
    standard primary DNS zone named Branch. ITCertKeys.com on ITCertKeysServer1.
D. Configure conditional forwarders on ITCertKeysServer1 to point to ITCertKeysServer3 
    conditional forwarders on ITCertKeysServer3 to point to ITCertKeysServer1.
E. None of the above.

Answer: A

Explanation:
To ensure that users from each office can resolve computer names for both domains from a local DNS server, you need to add the ITCertKeys.com and the Branch. ITCertKeys.com DNS zones to the ForestDNSZones partition because the ForestDNSZones directory partition can be replicated among all domain controllers (DCs) located in both the domains ITCertKeys.com and Branch. ITCertKeys.com in the forest of the company. This is because all the domain controllers have the DNS service installed. Once the DNS Zones data is replicated the users from each office can resolve computer names for both domains from their local DNS server

A stub zone cannot be used because it is used to resolve names between separate DNS namespaces a Standard Primary DNS zone cannot be used because the DNS Server in this type of zone contains the only writable copy of the DNS zone database files. There can be only one Standard Primary DNS Server for a particular zone. A conditional forwarder cannot be used because it handles name resolution only for a specific domain. 

Reference: 
What causes the error I receive in the event log when I attempt to replicate the ForestDNSZones directory partition? http://windowsitpro.com/article/articleid/43165/q-what-causes-the-error-i-receive-in-the-event-log-when-iattem

Reference: 
Understanding stub zones
http://207.46.196.114/windowsserver/en/library/648f2efd-0ad4-4788-80c8 75f8491f660e1033.mspx?mfr=true

Reference: 
DNS Conditional Forwarding in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Conditional_Forwarding_in_Windows_Server_200

Question 2.
You are an enterprise administrator for ITCertKeys. The company has a head and a three branch offices. Each office has a Windows Server 2008 server running with a DNS role installed on it. All the branch offices consist of Windows 2000 Professional client computers installed on their networks. As an enterprise administrator of the company, you have been assigned the task to deploy Active Directory Domain Services (AD DS) on the corporate network of the company. You also need to plan the implementation of a name resolution solution for the deployment of AD DS that supports secure dynamic updates and minimize the response times for users connecting to resources anywhere on the network. 

Which of the following options would you include in your plan to accomplish this task?

A. Implement GlobalNames zone (GNZ) for the forest.
B. Implement a single Active Directory-integrated (ADI) DNS zone.
C. Create a stub zone on the DNS server in each branch office.
D. Create a standard primary zone in the head office and the secondary zones in branch offices.
E. None of the above.

Answer: B

Explanation:
To deploy Active Directory Domain Services (AD DS) on the corporate network of the company with given requirements, you need to implement a single Active Directory-integrated (ADI) DNS zone. Active Directory integrated (ADI) primary DNS zone enables built-in recovery, scalability, and performance. An ADI zone is a writeable copy of a forward lookup zone that is hosted on a domain controller. It can therefore reduce the response times for users connecting to resources anywhere on the network and because it uses directory-integrated storage it also simplifies dynamic updates for DNS clients that are running Windows 2000. None of the other options can be used to meet the desired objectives.

Reference: 
From the Windows 2000 Resource Kit
http://windowsitpro.com/article/articleid/76616/jsi-tip-5312-when-you-change-your-dns-active-directoryintegra

Reference: 
ACTIVE DIRECTORY ADMINISTRATION TIPS
http://searchwinit.techtarget.com/tip/0,289483,sid1_gci1115858,00.html

Question 3.
You are an enterprise administrator for ITCertKeys. The company has a head office and a branch office located at different physical locations. The corporate network of the company consists of a single Active Directory domain. Both the offices of the company run Windows Server 2008 servers and have 2,000 client computers configured as DHCP clients without having DHCP relay supported on the network routers. As an enterprise administrator of the company, you have been assigned the task to configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails.

Which of the following options would you choose to accomplish this task?

A. Install two DHCP servers, one in the head office and the other in branch office and make sure 
    that both the DHCP servers have two scopes.
B. Install a DHCP instance on a two node failover cluster in each office, the head office and the 
    branch office.
C. In the head office, install a DHCP server and in the branch office, install a DHCP Relay Agent.
D. In the head office, install a DHCP instance on a two node failover cluster and in the branch 
    office, install a DHCP Relay Agent.
E. None of the above.

Answer: B

Explanation:
To configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails, you need to install a DHCP instance on a two node failover cluster in each office, the head office and the branch office. The two node failover cluster in each office will ensure that the DHCP server is always available even if one of the DHCP servers fails. Because DHCP relay is not supported on the network, both the offices need to have a separate DHCP failover clustering solution.

Having two scopes of DHCP servers will not help because DHCP relay is not supported on the network. Installing a DHCP server and DHCP Relay Agent in the branch office and installing a DHCP instance on a two node failover cluster and in the branch office and a DHCP Relay Agent will not help because this solution would increase the traffic between the offices in case any one of the DHCP server fails.

Reference: 
Step-by-Step Guide for Configuring Two-Node File Server Failover Cluster in Windows Server 2008 http://209.85.175.104/search?q=cache:9u-snEWIUtgJ:download.microsoft.com/download/b/1/0/b106fc39-936c- 

Reference: 
DHCP Relay Agent Overview
http://www.tech-faq.com/dhcp-relay-agent.shtml

Question 4.
You are an enterprise administrator for ITCertKeys. The corporate network of the company consists of a single Active Directory forest that contains 25 domains. All the DNS servers on the corporate network run Windows Server 2008. The users on the corporate network use NetBIOS name to connect to the network applications in all the domains. Currently the network is configured with IPv4 addressing. As an enterprise administrator of the company, you have been assigned the task to migrate the network to an IPv6-enabled only network without affecting any client computer. 

Which of the following options would you choose to accomplish this task?

A. Configure GlobalNames zones on the DNS servers running Windows Server 2008.
B. Add all domain zones to the ForestDNSZones partition on the DNS servers running Windows 
    Server 2008.
C. Create a new running Windows Server 2008 server and configure WINS server on it.
D. Create a new running Windows Server 2003 server and configure WINS server on it.
E. None of the above.

Answer: A

Explanation:
To migrate the network from IPv4-enabled to an IPv6-enabled only network without affecting any client computer, you need to configure GlobalNames zones on the DNS servers running Windows Server 2008. To help customers migrate to DNS for all name resolution, the DNS Server role in Windows Server 2008 supports a special GlobalNames Zone (also known as GNZ) feature. The client and server name resolution depends on DNS. A DNS Client is able to resolve single-label names by appending an appropriate list of suffixes to the name. The correct DNS suffix depends on the domain membership of the client but can also be manually configured in the advanced TCP/IP properties for the computer. The problem occurs managing a suffix search list when there are many domains. For environments that require both many domains and single-label name resolution of corporate server resources, GNZ provides a more scalable solution. GNZ is designed to enable the resolution of the single-label, static, global names for servers using DNS. WINS cannot be used because it does not support IPv6 protocols and both are entering legacy mode for Windows Server 2008. ForestDNSZones partition cannot help to migrate a IPv4-enabled network to an IPv6-enabled only network

Reference: 
Understanding GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/windows-DNS-globalnames-zone.htm

Reference: 
Using GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/using-globalnames-zone-window-server-2008.htm

Question 5.
You are an enterprise administrator for ITCertKeys. The company has a head office and two branch offices. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain called ITCertKeys.com. The DNS Service is installed on the member servers of the ITCertKeys.com domain and all the domain controllers and DNS servers for the ITCertKeys.com domain are located in the head office.

As an enterprise administrator of the company, you have been assigned the task to deploy two new Active Directory domains named branch1. ITCertKeys.com and branch2. ITCertKeys.com in the branch offices. To accomplish this task, you installed a DNS server in each branch office. 

Which of the following actions would you perform next to prepare the environment for the installation of the new domains? (Select three. Each selected option will form a part of the answer.)

A. Configure a delegation subdomain DNS record on the main office DNS server for each new 
    domain.
B. Create a new standard primary zone on each branch office DNS server for the new domains.
C. Create a new stub zone on each branch office DNS server for the new domains
D. Configure forwarders on the main office DNS servers to point to the branch office servers.
E. Configure conditional forwarders on the main office DNS servers to point to the branch office 
    DNS servers.
F. Configure zone transfer for the ITCertKeys.com zone to the branch office DNS servers.

Answer: A, B, F

Explanation:
To deploy two new Active Directory domains in the branch offices, you need to first configure a delegation subdomain DNS record on the main office DNS server for each new domain then create a new standard primary zone on each branch office DNS server for the new domains and then configure zone transfer for the ITCertKeys.com zone to the branch office DNS servers after installing DNS server in each branch office. In DNS, a subdomain is a portion of a domain that you've delegated to another DNS zone. A subdomain is configured when you need to create domains in existing domain. A company might use subdomains for its various divisions. Because, to migrate your DNS zone data for the ITCertKeys.com zone to the branch office DNS servers, you will need to have a functioning standard primary server, you will need to create a new standard primary zone on each branch office DNS server for the new domains.

Reference: 
Delegate subdomains in DNS in Windows 2000 Server
http://articles.techrepublic.com.com/5100-10878_11-5846057.html

Reference: 
Step-By-Step: How to migrate DNS information to Windows Server 2003
http://www.lockergnome.com/it/2005/01/14/step-by-step-how-to-migrate-dns-information-to-windows-server-20

Reference: 
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html

Question 6.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Active Directory forest that is made up of a single root domain and 15 child domains. The Administrators of the child domains need to frequently modify the records for authoritative DNS servers for the child domain DNS zones. The administrators take a long time in modifying these records. As an enterprise administrator of the company, you have been assigned the task to implement a solution that would minimize the effort required to maintain name resolution on the network. 

Which of the following options would you choose to accomplish this task?

A. Create stub zones for the root domain zone on the child domain DNS servers.
B. Configure conditional forwarders for the parent domain on the child domain DNS servers.
C. Create stub zones for the child domain zones on the root domain DNS servers.
D. Configure delegation subdomain records for the child domains on the root domain DNS 
    servers.
E. None of the above.

Answer: C

Explanation:
To implement a solution that would minimize the effort required to maintain name resolution on the network, you need to create stub zones for the child domain zones on the root domain DNS servers. Stub zones can help reduce the amount of DNS traffic on your network by streamlining name resolution and zone replication. The Stub zone should be configured for the child domain zones on the root domain DNS servers and not vice versa because a stub zone is like a secondary zone that obtains its resource records from other name servers (one or more master name servers).

Reference: 
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html

Question 7.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. On one of the Windows Server 2008 member servers, ITCertKeysServer1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, ITCertKeysServer2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured. Some client computers that do not have the latest Microsoft updates installed connect to the local area network (LAN) from client computers that are joined to a workgroup. Besides all network switches used for client connections are unmanaged.

As an enterprise administrator of the company, you have been assigned the task to implement a Network Access Protection (NAP) solution to protect the network. You need to ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain. 

Which of the following NAP enforcement method should you use to accomplish this task?

A. 802.1x
B. DHCP
C. IPsec
D. VPN
E. None of the above.

Answer: C

Explanation:
To ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain, you need to use IPSec NAP enforcement method. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec.

Reference: 
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx

Reference: 
Network Access Protection (NAP) Deployment Planning / Choosing Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.aspx

Question 8.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista, Windows XP Professional, and Windows 2000 Professional. On one of the Windows Server 2008 member servers, ITCertKeysServer1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, ITCertKeysServer2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured. 

The NAP is configured by using IPsec, DHCP, and 802.1x enforcement methods. Currently the computers that are not joined to the domain can easily connect to the domain and access network resources. As a network administrator, you want to stop this security lapse and want to ensure that only computers that are joined to the domain can access network resources on the domain. 

Which of the following options would you choose to accomplish this task?

A. Configure all DHCP scopes on ITCertKeysServer1 to enable NAP.
B. Configure all network switches to require 802.1x authentication.
C. Create a GPO, link it to the domain. Enable a secure server IPsec policy on all member 
    servers in the domain in the GPO.
D. Create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec 
    communications on all client computers in the domain in the GPO.
E. None of the above.

Answer: C

Explanation:
To ensure that only computers that are joined to the domain can access network resources on the domain, you need to create a GPO, link it to the domain and enable a secure server IPsec policy on all member servers in the domain in the GPO. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec. Configuring DHCP scope cannot stop unmanaged computers that are not joined to the domain from accessing the network. NAP is not required in this scenario because you just want the member computers to access network resources. Therefore, you need not create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec communications on all client computers in the domain in the GPO.

Reference: 
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx

Question 9.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. The network contains three Windows Server 2008 servers configured as follows:
1. ITCertKeysServer1 - Configured with Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services.
1. ITCertKeysServer2 - Configured with Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA), and Microsoft System Center Configuration Manager (SCCM) 2007 services
1. ITCertKeysServer3 - Configured with File Services and Microsoft Windows SharePoint Services (WSS). As an enterprise administrator of the company, you have been assigned the task to configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources.

Besides, you need to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only ITCertKeysServer1 and ITCertKeysServer2 initially.
.

Which of the following NAP enforcement method should you use to accomplish this task?

A. 802.1x
B. DHCP
C. IPsec communications
D. VPN
E. None of the above.

Answer: A

Explanation:
To configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources and to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only ITCertKeysServer1 and ITCertKeysServer2 initially, you need to use 802.1x NAP enforcement method because this method enforces health policies when a client computer attempts to access a network using EAP through an 802.1X wireless connection or an authenticating switch connection. 

Reference: 
Network Access Protection (NAP) Deployment Planning / Choosing Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.asp

Question 10.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Active Directory domain. All the servers in the domain run Windows Server 2008 and all the client computers run Windows Vista with Service Pack 1.
The network contains three Windows Server 2008 servers configured as follows:
1. ITCertKeysServer1- Configured with Network Policy and Access Services (NPAS).
2. ITCertKeysServer2 - Configured with Microsoft Windows SharePoint Services (WSS).
3. ITCertKeysServer3 - Configured with File Services.
The company has many remote users (domain members) that need to access the domain resources from their remote locations. Some of the remote users informed you that they can access ITCertKeysServer2 by using the URL https://portal. ITCertKeys.com from their remote locations through Internet but the firewall used at their remote location site prevents all other outbound connections. As an enterprise administrator of the company, you have been assigned the task to plan a solution that would allow the remote users to access files on ITCertKeysServer3 through a VPN connection

Which of the following types of connections should you enable on ITCertKeysServer1?

A. Configure IPsec tunnel mode connection
B. Configure a L2TP VPN connection
C. Configure a PPTP VPN connection
D. Configure Secure Socket Tunneling Protocol (SSTP) connection
E. None of the above.

Answer: D

Explanation:
To plan a solution that would allow the remote users using firewall on their remote locations to access files on ITCertKeysServer3 through a VPN connection, you need to configure Secure Socket Tunneling Protocol (SSTP) connection. Before Windows Server 2008, all kinds of VPN connections such as PPTP L2TP, and IPSec had problems with firewalls, NATs, and Web proxies. To prevent problems, firewalls must be configured to allow connections. If your VPN client computer is behind a NAT, both the VPN client and the VPN server must support IPsec NAT-Traversal (NAT-T). Besides, VPN server can't be located behind a NAT, and that L2TP/IPsec traffic can't flow through a Web proxy. With the advent of SSTP in Windows Server 2008 all the VPN connectivity problems such as firewalls, NATs, and Web proxies are solved. The SSTP connection allows the use of HTTP over secure sockets layer (SSL). SSTP uses an HTTP-over-SSL session between VPN clients and servers to exchange encapsulated IPv4 or IPv6 packets. 

Reference: 
The Cable Guy: The Secure Socket Tunneling Protocol / The New VPN Solution
http://technet.microsoft.com/en-us/magazine/cc162322.aspx

	Web www.certsbraindumps.com