|
Question 1.
Which one of the following characteristics is true regarding the use of hubs and switches?
A. Hubs can have their ports be configured with VLANs
B. Using hubs is costly with regard to bandwidth availability.
C. Switches can not forward broadcasts.
D. Switches are more efficient than hubs in processing frames.
E. Switches increase the number of collision domains in the network.
Answer: E
Explanation:
Switches increases the number of collisions domains in the network. Switches that are configured with VLANs will reduce the size of the collision domains by increasing the number of collision domains in a network, but making them smaller than that of one big, flat network.
Incorrect Answers:
A. Switches are capable of VLAN configurations, but hubs are not.
B. Hubs are generally the least costly method possible to connect multiple devices together in a network.
C. Switches forward broadcasts and multicasts, by default, to all ports within the same VLAN. Only routers block all broadcast traffic by default.
D. Switches and hubs can be equally efficient in processing frames, in theory. In practice, switches are generally more efficient as they usually have more CPU and memory allocated to them, and are generally much more expensive than a simple hub.
Question 2.
When comparing and contrasting the similarities and differences between bridges and switches, which of the following are valid statements? Choose all the valid answer choices)
A. Bridges are faster than switches because they have fewer ports.
B. A switch is a multiport bridge,
C. Bridges and switches learn MAC addresses by examining the source MAC address of each
frame received.
D. A bridge will forward a broadcast but a switch will not.
E. Bridges and switches increase the size of a collision domain.
F. None of the above statements are true.
Answer: B, C
Explanation:
Both bridges and switches build the bridge table by listening to incoming frames and examining the source MAC address in the frame. Switches are multiport bridges that allow you to create multiple broadcast domains. Each broadcast domain is like a distinct virtual bridge within a switch.
Incorrect Answers:
A. Switches are generally faster than bridges. Bridges also do not necessarily have fewer ports than switches.
D. Both bridges and switches will forward broadcast and multicast traffic, assuming that the traffic remains in the same VLAN.
E. The use of VLANs in a switch can decrease the size of the collision domain, by creating additional, smaller collision domains.
Question 3.
Which of the following correctly describe the various functions and virtues of a router? (Select all valid answer choices)
A. Packet switching
B. Collision prevention on a LAN segment.
C. Packet filtering
D. Broadcast domain enlargement
E. Broadcast forwarding
F. Internetwork communication
G. None of the above
Answer: A, C, F
Explanation:
The main function of a router is to connect different, separated networks together. In doing so, switching packets from one network to another is a primary function, along with providing for communication between networks. As an additional feature, routers are capable of providing filtering on a network address and application port level, so choice C is also correct.
Incorrect Answers:
B. Routers can indeed be used to segment a network separate a collision domain, since routers do not forward LAN broadcasts and multicasts to other interfaces. However, routers alone can not prevent all collisions from occurring on any given LAN segment.
D. Routers actually segment LANs into smaller broadcast domains.
E. Routers do not forward broadcast and multicast traffic out the additional interfaces by default. Unless bridging or IP helpers are configured on the router, LAN broadcasts are blocked at the router level.
Question 4.
The LAN needs are expanding at the ITCertKeys corporate office, which is quickly growing. You are instructed to enlarge the area covered by a single LAN segment on the ITCertKeys network.
Which of the following are layer 1 devices that you can use? (Choose all that apply.)
A. A switch
B. A router
C. A network adapter card
D. A hub
E. A repeater
Answer: D, E
Explanation:
A hub simply repeats the electrical signal and makes no attempt to interpret the electrical signal (layer 1) as a LAN frame (Layer 2). So, a hub actually performs OSI layer 1 functions, repeating an electrical signal, whereas a switch performs OSI layer 2 functions, actually interpreting Ethernet header information, particularly addresses, to make forwarding decisions. Hubs can be used to increase the number of stations that can be supported on a LAN. Because the repeater does not interpret what the bits mean, but does examine and generate electrical signals, a repeater is considered to operate at Layer 1. Repeaters can be used to physically extend the LAN to greater distances.
Question 5.
Cisco is the leader in the router market space. What basic functions do their routers perform in a network? (Choose two)
A. The microsegmentation of broadcast domains
B. Path selection
C. Packet switching
D. Bridging between LAN segments
E. Access layer security
F. VLAN membership assignment
G. Application optimization
Answer: B, C
Explanation:
The primary functions of a router are: Packet Switching and Path Selection. It is the routers job to determine the best method for delivering the data, and switching that data as quickly as possible.
Question 6.
The ITCertKeys network administrator needs to determine what LAN devices to install on the ITCertKeys network.
What are two advantages of using Layer 2 Ethernet switches over hubs? (Choose two)
A. Allowing simultaneous frame transmissions
B. Increasing the size of broadcast domains
C. Increasing the maximum length of UTP cabling between devices
D. Filtering frames based on MAC addresses
E. Decreasing the number of collision domains
Answer: A, D
Explanation:
A: A half duplex connection is where only one device can send or receive at a time. A full duplex connection is where both devices can send and receive at the same time. Thus, if you have a 100Mb half-duplex connection, only sending at 100Mb OR receiving at 100Mb can happen at the same time. If you have a 100Mb full duplex connection, you can effectively get 200Mb out of the link because you could be sending 100Mb and receiving 100Mb at the same time.
D: Switches are capable of filtering frames based on any Layer 2 fields. For example, a switch can be programmed to reject (not forward) all frames sourced from a particular network. Because link layer information often includes a reference to an upper-layer protocol, switches usually can filter on this parameter. Furthermore, filters can be helpful in dealing with unnecessary broadcast and multicast packets.
Question 7.
CDP is being used throughout the ITCertKeys network.
What are two reasons why the ITCertKeys network administrator would use CDP? (Choose two)
A. To determine the status of network services on a remote device
B. To obtain the IP Address of a connected device in order to telnet to the device
C. To verify the type of cable interconnecting two devices
D. To verify Layer 2 connectivity between two devices when Layer 3 fails
E. To obtain VLAN information from directly connected switches
F. To determine the status of the routing protocols between directly connected routers
G. To support automatic network failover during outages
Answer: B, D
Explanation:
Cisco Discovery Protocol (CDP) is a proprietary protocol designed by Cisco to help administrators collect information about both locally attached and remote devices. By using CDP, you can gather hardware and protocol information about neighbor devices, which is useful info for troubleshooting and documenting the network.
You can use:
Show cdp neighbor
Show cdp neighbor details
Commands to gather the information of connected neighbors.
Question 8.
CDP is running between two ITCertKeys devices.
What information is supplied by CDP? (Select three)
A. Device Identifiers
B. Capabilities list
C. Platform
D. Route identifier
E. Neighbor traffic data
Answer: A, B, C
Explanation:
Question 9.
Two ITCertKeys offices are connected as shown below:
Two buildings on the London campus of a the ITCertKeys corporation must be connected to use Ethernet with a bandwidth of at least 100 Mbps. ITCertKeys is concerned about possible problems from voltage potential differences between the two buildings.
Which media type should be used for the connection?
A. Coaxial cable
B. Fiber optic cable
C. UTP cable
D. STP cable
E. None of the above
Answer: B
Explanation:
Current Ethernet technology typically comes via either copper UTP or fiber cables. In this scenario the distance between the buildings is only 55 meters so either copper or fiber could be used, as the distance limitation for 100M UTP Ethernet is 100 meters. However, fiber would be a better fit as it is not prone to errors that could occur due to the voltage potential differences. Because fiber is a dielectric material, it's not susceptible to electrical interference. FO-product vendors also claim that fiber systems make secure communications easier. Interference immunity and lack of emissions are givens in FO systems and in the fiber medium itself.
Question 10.
Refer to the ITCertKeys network shown below:
You work as a network technician at ITCertKeys.com. Please study the exhibit carefully. Based on the information shown above, what is needed to allow host ITCertKeys1 to ping host ITCertKeys2?
A. A crossover cable connecting the switches
B. A backbone switch connecting the switches with either fiber optic or straight-through cables
C. A straight-through cable connecting the switches
D. A CSU/DSU connected to the switches with straight-through cables
E. A router connected to the switches with straight-through cables
Answer: E
Explanation:
Routers are Layers 3 devices used for inter-network communication. In this scenario there are two different networks, so both switches need to connect to a router using straight-through cables. A straight-through cable is used to connect two different devices like, switch to router, host to switch. Since we need to insert a router for communication between the two switches, straight through cables will be used between the switches and the router.
|
Question 1.
You are an enterprise administrator for ITCertKeys. The company has a head office in San Diego and a branch office in New York. The corporate network of ITCertKeys consists of an Active Directory forest having two domains, ITCertKeys.com and Branch. ITCertKeys.com for the head office and the branch office respectively. All the servers on the corporate network run Windows Server 2008 and both the offices hold their respective domain controllers on their physical office locations.
The two domain controllers at ITCertKeys.com are called ITCertKeysServer1 and ITCertKeysServer2 and the two domain controllers at Branch. ITCertKeys.com are called ITCertKeysServer3 and ITCertKeysServer4. All domain controllers host Active Directory-integrated DNS zones for their respective domains. As an enterprise administrator of the company, you have been assigned the task to ensure that users from each office can resolve computer names for both domains from a local DNS server.
Which of the following options would you choose to accomplish this task?
A. Add the ITCertKeys.com and the Branch. ITCertKeys.com DNS zones to the ForestDNSZones
partition.
B. Create a stub DNS zone for ITCertKeys.com on ITCertKeysServer3 and a stub DNS zone for
Branch. ITCertKeys.com on ITCertKeysServer1.
C. Create a standard primary DNS zone named ITCertKeys.com on ITCertKeysServer3 and a
standard primary DNS zone named Branch. ITCertKeys.com on ITCertKeysServer1.
D. Configure conditional forwarders on ITCertKeysServer1 to point to ITCertKeysServer3
conditional forwarders on ITCertKeysServer3 to point to ITCertKeysServer1.
E. None of the above.
Answer: A
Explanation:
To ensure that users from each office can resolve computer names for both domains from a local DNS server, you need to add the ITCertKeys.com and the Branch. ITCertKeys.com DNS zones to the ForestDNSZones partition because the ForestDNSZones directory partition can be replicated among all domain controllers (DCs) located in both the domains ITCertKeys.com and Branch. ITCertKeys.com in the forest of the company. This is because all the domain controllers have the DNS service installed. Once the DNS Zones data is replicated the users from each office can resolve computer names for both domains from their local DNS server
A stub zone cannot be used because it is used to resolve names between separate DNS namespaces a Standard Primary DNS zone cannot be used because the DNS Server in this type of zone contains the only writable copy of the DNS zone database files. There can be only one Standard Primary DNS Server for a particular zone. A conditional forwarder cannot be used because it handles name resolution only for a specific domain.
Reference:
What causes the error I receive in the event log when I attempt to replicate the ForestDNSZones directory partition? http://windowsitpro.com/article/articleid/43165/q-what-causes-the-error-i-receive-in-the-event-log-when-iattem
Reference:
Understanding stub zones
http://207.46.196.114/windowsserver/en/library/648f2efd-0ad4-4788-80c8 75f8491f660e1033.mspx?mfr=true
Reference:
DNS Conditional Forwarding in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Conditional_Forwarding_in_Windows_Server_200
Question 2.
You are an enterprise administrator for ITCertKeys. The company has a head and a three branch offices. Each office has a Windows Server 2008 server running with a DNS role installed on it. All the branch offices consist of Windows 2000 Professional client computers installed on their networks. As an enterprise administrator of the company, you have been assigned the task to deploy Active Directory Domain Services (AD DS) on the corporate network of the company. You also need to plan the implementation of a name resolution solution for the deployment of AD DS that supports secure dynamic updates and minimize the response times for users connecting to resources anywhere on the network.
Which of the following options would you include in your plan to accomplish this task?
A. Implement GlobalNames zone (GNZ) for the forest.
B. Implement a single Active Directory-integrated (ADI) DNS zone.
C. Create a stub zone on the DNS server in each branch office.
D. Create a standard primary zone in the head office and the secondary zones in branch offices.
E. None of the above.
Answer: B
Explanation:
To deploy Active Directory Domain Services (AD DS) on the corporate network of the company with given requirements, you need to implement a single Active Directory-integrated (ADI) DNS zone. Active Directory integrated (ADI) primary DNS zone enables built-in recovery, scalability, and performance. An ADI zone is a writeable copy of a forward lookup zone that is hosted on a domain controller. It can therefore reduce the response times for users connecting to resources anywhere on the network and because it uses directory-integrated storage it also simplifies dynamic updates for DNS clients that are running Windows 2000. None of the other options can be used to meet the desired objectives.
Reference:
From the Windows 2000 Resource Kit
http://windowsitpro.com/article/articleid/76616/jsi-tip-5312-when-you-change-your-dns-active-directoryintegra
Reference:
ACTIVE DIRECTORY ADMINISTRATION TIPS
http://searchwinit.techtarget.com/tip/0,289483,sid1_gci1115858,00.html
Question 3.
You are an enterprise administrator for ITCertKeys. The company has a head office and a branch office located at different physical locations. The corporate network of the company consists of a single Active Directory domain. Both the offices of the company run Windows Server 2008 servers and have 2,000 client computers configured as DHCP clients without having DHCP relay supported on the network routers. As an enterprise administrator of the company, you have been assigned the task to configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails.
Which of the following options would you choose to accomplish this task?
A. Install two DHCP servers, one in the head office and the other in branch office and make sure
that both the DHCP servers have two scopes.
B. Install a DHCP instance on a two node failover cluster in each office, the head office and the
branch office.
C. In the head office, install a DHCP server and in the branch office, install a DHCP Relay Agent.
D. In the head office, install a DHCP instance on a two node failover cluster and in the branch
office, install a DHCP Relay Agent.
E. None of the above.
Answer: B
Explanation:
To configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails, you need to install a DHCP instance on a two node failover cluster in each office, the head office and the branch office. The two node failover cluster in each office will ensure that the DHCP server is always available even if one of the DHCP servers fails. Because DHCP relay is not supported on the network, both the offices need to have a separate DHCP failover clustering solution.
Having two scopes of DHCP servers will not help because DHCP relay is not supported on the network. Installing a DHCP server and DHCP Relay Agent in the branch office and installing a DHCP instance on a two node failover cluster and in the branch office and a DHCP Relay Agent will not help because this solution would increase the traffic between the offices in case any one of the DHCP server fails.
Reference:
Step-by-Step Guide for Configuring Two-Node File Server Failover Cluster in Windows Server 2008 http://209.85.175.104/search?q=cache:9u-snEWIUtgJ:download.microsoft.com/download/b/1/0/b106fc39-936c-
Reference:
DHCP Relay Agent Overview
http://www.tech-faq.com/dhcp-relay-agent.shtml
Question 4.
You are an enterprise administrator for ITCertKeys. The corporate network of the company consists of a single Active Directory forest that contains 25 domains. All the DNS servers on the corporate network run Windows Server 2008. The users on the corporate network use NetBIOS name to connect to the network applications in all the domains. Currently the network is configured with IPv4 addressing. As an enterprise administrator of the company, you have been assigned the task to migrate the network to an IPv6-enabled only network without affecting any client computer.
Which of the following options would you choose to accomplish this task?
A. Configure GlobalNames zones on the DNS servers running Windows Server 2008.
B. Add all domain zones to the ForestDNSZones partition on the DNS servers running Windows
Server 2008.
C. Create a new running Windows Server 2008 server and configure WINS server on it.
D. Create a new running Windows Server 2003 server and configure WINS server on it.
E. None of the above.
Answer: A
Explanation:
To migrate the network from IPv4-enabled to an IPv6-enabled only network without affecting any client computer, you need to configure GlobalNames zones on the DNS servers running Windows Server 2008. To help customers migrate to DNS for all name resolution, the DNS Server role in Windows Server 2008 supports a special GlobalNames Zone (also known as GNZ) feature. The client and server name resolution depends on DNS. A DNS Client is able to resolve single-label names by appending an appropriate list of suffixes to the name. The correct DNS suffix depends on the domain membership of the client but can also be manually configured in the advanced TCP/IP properties for the computer. The problem occurs managing a suffix search list when there are many domains. For environments that require both many domains and single-label name resolution of corporate server resources, GNZ provides a more scalable solution. GNZ is designed to enable the resolution of the single-label, static, global names for servers using DNS. WINS cannot be used because it does not support IPv6 protocols and both are entering legacy mode for Windows Server 2008. ForestDNSZones partition cannot help to migrate a IPv4-enabled network to an IPv6-enabled only network
Reference:
Understanding GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/windows-DNS-globalnames-zone.htm
Reference:
Using GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/using-globalnames-zone-window-server-2008.htm
Question 5.
You are an enterprise administrator for ITCertKeys. The company has a head office and two branch offices. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain called ITCertKeys.com. The DNS Service is installed on the member servers of the ITCertKeys.com domain and all the domain controllers and DNS servers for the ITCertKeys.com domain are located in the head office.
As an enterprise administrator of the company, you have been assigned the task to deploy two new Active Directory domains named branch1. ITCertKeys.com and branch2. ITCertKeys.com in the branch offices. To accomplish this task, you installed a DNS server in each branch office.
Which of the following actions would you perform next to prepare the environment for the installation of the new domains? (Select three. Each selected option will form a part of the answer.)
A. Configure a delegation subdomain DNS record on the main office DNS server for each new
domain.
B. Create a new standard primary zone on each branch office DNS server for the new domains.
C. Create a new stub zone on each branch office DNS server for the new domains
D. Configure forwarders on the main office DNS servers to point to the branch office servers.
E. Configure conditional forwarders on the main office DNS servers to point to the branch office
DNS servers.
F. Configure zone transfer for the ITCertKeys.com zone to the branch office DNS servers.
Answer: A, B, F
Explanation:
To deploy two new Active Directory domains in the branch offices, you need to first configure a delegation subdomain DNS record on the main office DNS server for each new domain then create a new standard primary zone on each branch office DNS server for the new domains and then configure zone transfer for the ITCertKeys.com zone to the branch office DNS servers after installing DNS server in each branch office. In DNS, a subdomain is a portion of a domain that you've delegated to another DNS zone. A subdomain is configured when you need to create domains in existing domain. A company might use subdomains for its various divisions. Because, to migrate your DNS zone data for the ITCertKeys.com zone to the branch office DNS servers, you will need to have a functioning standard primary server, you will need to create a new standard primary zone on each branch office DNS server for the new domains.
Reference:
Delegate subdomains in DNS in Windows 2000 Server
http://articles.techrepublic.com.com/5100-10878_11-5846057.html
Reference:
Step-By-Step: How to migrate DNS information to Windows Server 2003
http://www.lockergnome.com/it/2005/01/14/step-by-step-how-to-migrate-dns-information-to-windows-server-20
Reference:
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html
Question 6.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Active Directory forest that is made up of a single root domain and 15 child domains. The Administrators of the child domains need to frequently modify the records for authoritative DNS servers for the child domain DNS zones. The administrators take a long time in modifying these records. As an enterprise administrator of the company, you have been assigned the task to implement a solution that would minimize the effort required to maintain name resolution on the network.
Which of the following options would you choose to accomplish this task?
A. Create stub zones for the root domain zone on the child domain DNS servers.
B. Configure conditional forwarders for the parent domain on the child domain DNS servers.
C. Create stub zones for the child domain zones on the root domain DNS servers.
D. Configure delegation subdomain records for the child domains on the root domain DNS
servers.
E. None of the above.
Answer: C
Explanation:
To implement a solution that would minimize the effort required to maintain name resolution on the network, you need to create stub zones for the child domain zones on the root domain DNS servers. Stub zones can help reduce the amount of DNS traffic on your network by streamlining name resolution and zone replication. The Stub zone should be configured for the child domain zones on the root domain DNS servers and not vice versa because a stub zone is like a secondary zone that obtains its resource records from other name servers (one or more master name servers).
Reference:
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html
Question 7.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. On one of the Windows Server 2008 member servers, ITCertKeysServer1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, ITCertKeysServer2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured. Some client computers that do not have the latest Microsoft updates installed connect to the local area network (LAN) from client computers that are joined to a workgroup. Besides all network switches used for client connections are unmanaged.
As an enterprise administrator of the company, you have been assigned the task to implement a Network Access Protection (NAP) solution to protect the network. You need to ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain.
Which of the following NAP enforcement method should you use to accomplish this task?
A. 802.1x
B. DHCP
C. IPsec
D. VPN
E. None of the above.
Answer: C
Explanation:
To ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain, you need to use IPSec NAP enforcement method. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec.
Reference:
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx
Reference:
Network Access Protection (NAP) Deployment Planning / Choosing Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.aspx
Question 8.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista, Windows XP Professional, and Windows 2000 Professional. On one of the Windows Server 2008 member servers, ITCertKeysServer1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, ITCertKeysServer2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured.
The NAP is configured by using IPsec, DHCP, and 802.1x enforcement methods. Currently the computers that are not joined to the domain can easily connect to the domain and access network resources. As a network administrator, you want to stop this security lapse and want to ensure that only computers that are joined to the domain can access network resources on the domain.
Which of the following options would you choose to accomplish this task?
A. Configure all DHCP scopes on ITCertKeysServer1 to enable NAP.
B. Configure all network switches to require 802.1x authentication.
C. Create a GPO, link it to the domain. Enable a secure server IPsec policy on all member
servers in the domain in the GPO.
D. Create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec
communications on all client computers in the domain in the GPO.
E. None of the above.
Answer: C
Explanation:
To ensure that only computers that are joined to the domain can access network resources on the domain, you need to create a GPO, link it to the domain and enable a secure server IPsec policy on all member servers in the domain in the GPO. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec. Configuring DHCP scope cannot stop unmanaged computers that are not joined to the domain from accessing the network. NAP is not required in this scenario because you just want the member computers to access network resources. Therefore, you need not create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec communications on all client computers in the domain in the GPO.
Reference:
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx
Question 9.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. The network contains three Windows Server 2008 servers configured as follows:
1. ITCertKeysServer1 - Configured with Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services.
1. ITCertKeysServer2 - Configured with Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA), and Microsoft System Center Configuration Manager (SCCM) 2007 services
1. ITCertKeysServer3 - Configured with File Services and Microsoft Windows SharePoint Services (WSS). As an enterprise administrator of the company, you have been assigned the task to configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources.
Besides, you need to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only ITCertKeysServer1 and ITCertKeysServer2 initially.
.
Which of the following NAP enforcement method should you use to accomplish this task?
A. 802.1x
B. DHCP
C. IPsec communications
D. VPN
E. None of the above.
Answer: A
Explanation:
To configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources and to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only ITCertKeysServer1 and ITCertKeysServer2 initially, you need to use 802.1x NAP enforcement method because this method enforces health policies when a client computer attempts to access a network using EAP through an 802.1X wireless connection or an authenticating switch connection.
Reference:
Network Access Protection (NAP) Deployment Planning / Choosing Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.asp
Question 10.
You are an enterprise administrator for ITCertKeys. The corporate network of ITCertKeys consists of a single Active Directory domain. All the servers in the domain run Windows Server 2008 and all the client computers run Windows Vista with Service Pack 1.
The network contains three Windows Server 2008 servers configured as follows:
1. ITCertKeysServer1- Configured with Network Policy and Access Services (NPAS).
2. ITCertKeysServer2 - Configured with Microsoft Windows SharePoint Services (WSS).
3. ITCertKeysServer3 - Configured with File Services.
The company has many remote users (domain members) that need to access the domain resources from their remote locations. Some of the remote users informed you that they can access ITCertKeysServer2 by using the URL https://portal. ITCertKeys.com from their remote locations through Internet but the firewall used at their remote location site prevents all other outbound connections. As an enterprise administrator of the company, you have been assigned the task to plan a solution that would allow the remote users to access files on ITCertKeysServer3 through a VPN connection
Which of the following types of connections should you enable on ITCertKeysServer1?
A. Configure IPsec tunnel mode connection
B. Configure a L2TP VPN connection
C. Configure a PPTP VPN connection
D. Configure Secure Socket Tunneling Protocol (SSTP) connection
E. None of the above.
Answer: D
Explanation:
To plan a solution that would allow the remote users using firewall on their remote locations to access files on ITCertKeysServer3 through a VPN connection, you need to configure Secure Socket Tunneling Protocol (SSTP) connection. Before Windows Server 2008, all kinds of VPN connections such as PPTP L2TP, and IPSec had problems with firewalls, NATs, and Web proxies. To prevent problems, firewalls must be configured to allow connections. If your VPN client computer is behind a NAT, both the VPN client and the VPN server must support IPsec NAT-Traversal (NAT-T). Besides, VPN server can't be located behind a NAT, and that L2TP/IPsec traffic can't flow through a Web proxy. With the advent of SSTP in Windows Server 2008 all the VPN connectivity problems such as firewalls, NATs, and Web proxies are solved. The SSTP connection allows the use of HTTP over secure sockets layer (SSL). SSTP uses an HTTP-over-SSL session between VPN clients and servers to exchange encapsulated IPv4 or IPv6 packets.
Reference:
The Cable Guy: The Secure Socket Tunneling Protocol / The New VPN Solution
http://technet.microsoft.com/en-us/magazine/cc162322.aspx
Copyright © 2004 CertsBraindumps.com Inc. All rights reserved.