Question 1

Which of the following answers is not a task that can be delegated
A)Create,delete,and manage user accounts
B)Reset user passwords and force password change at next logon
C)Read all user information
D)Create,delete,and manage built-in user accounts

Accepted Answer

Creating, deleting, and managing built-in user accounts typically require elevated privileges and are not tasks that should be delegated due to security risks. Built-in accounts have predefined roles and permissions that are critical to the security and proper functioning of the system.

Question 2

Match a term below to the following description
The process for replicating Active Directory objects in which changes to the database can occur on any domain controller and are propagated,or replicated,to all other domain controllers.
A)Multimaster replication
B)Intersite replication
C)Intrasite replication
D)Database replication

Accepted Answer

Multimaster replication is the process where changes to the Active Directory database can occur on any domain controller and are replicated to all other domain controllers. This is different from master/slave replication where only one server has the authority to make changes. Intrasite and intersite replication refer to different methods of replicating AD objects but do not specify whether it is multimaster or not. Database replication is a general term that could refer to any type of replication, not necessarily specific to Active Directory.

Question 3

Which of the following is not a valid directory partition type?
A)Domain directory partition
B)Schema directory partition
C)Extended directory partition
D)Global catalog partition

Accepted Answer

Domain directory partition, Schema directory partition, and Global catalog partition are all valid types of directory partitions in active directory. However, extended directory partition is not a valid type of directory partition.

Question 4

All computers assigned an address in a subnet require a router to communicate with one another.

Accepted Answer

Computers within the same subnet can communicate directly with each other using switches or direct connections without requiring a router, as routers are primarily used for connecting different subnets.

Question 5

A Discretionary access control list (DACL)____.
A)defines the settings for auditing access to an object
B)only applies to users accessing resources from a dialup connection
C)is a list of security principals,with each having a set of permissions that define access to the object
D)can only be edited by the object owner

Accepted Answer

A DACL is a list of security principals, with each having a set of permissions that define access to the object. It is not related to auditing, dialup connections, or being editable only by the object owner.

Question 6

The Lightweight Directory Access Protocol is based on which of the following technologies?
A)X.509
B)X.500
C)X.405
D)X.900

Accepted Answer

The Lightweight Directory Access Protocol, or LDAP, is based on X.500, a standard protocol for directory services. While X.500 is a robust protocol, it is designed for use in large organizations and can be cumbersome for smaller networks. LDAP was developed as a lightweight version of X.500, suitable for use in smaller, more distributed networks.

Question 7

To verify who has been delegated control of an OU,you must ____.
A)use the dsview /delegated command
B)be the owner of the OU
C)view the OU's permissions
D)be on the original domain controller where permission was delegated

Accepted Answer

To verify who has been delegated control of an OU, you need to view the OU's permissions. This will show you which users or groups have been granted access to the OU and what level of control they have been given. The other options are not relevant to verifying delegation of control for an OU.

Question 8

Which directory partition contains all objects in a domain,including users,groups,computers,OUs,and other objects?
A)Global Catalog partition
B)Domain directory partition
C)Application directory partition
D)Configuration partition

Accepted Answer

The domain directory partition is the one that contains all objects in a domain, including users, groups, computers, OUs, and other objects. The global catalog partition contains a subset of attributes for all objects in the forest, while the application directory partition holds application-specific data. The configuration partition holds settings for the entire forest.

Question 9

Explicit permissions never override inherited permissions.

Accepted Answer

Explicit permissions take precedence over inherited permissions. When you directly assign permissions to a file or folder, these permissions override any permissions the file or folder might inherit from its parent folder.

Question 10

Which operations master role is responsible for ensuring that changes made to object names in one domain are updated in references to these objects in other domains?
A)Schema master
B)Infrastructure master
C)Domain naming master
D)RID master

Accepted Answer

The Infrastructure Master role is responsible for updating references from objects in its domain to objects in other domains. This includes ensuring that changes to object names and other attributes are properly reflected across domains.

Question 11

Which of the following statements about operations master roles is correct?
A)By default,the Infrastructure master is chosen randomly per domain
B)There can be multiple schema masters per domain
C)The RID Master is responsible for providing backward compatibility with NT domain controllers
D)There is only one domain naming master per forest,which must be available whenever domains are added,deleted,or renamed.

Accepted Answer

The statement "There is only one domain naming master per forest,which must be available whenever domains are added,deleted,or renamed" is correct. The other statements are incorrect. The Infrastructure master is not chosen randomly per domain, there can only be one schema master per forest, and the RID Master is responsible for managing the pool of relative identifiers (RIDs) for the domain.

Question 12

What directory partition contains information needed to define Active Directory objects and object attributes for all domains in the forest?
A)Schema directory partition
B)Global Catalog partition
C)Application directory partition
D)Configuration partition

Accepted Answer

The Schema directory partition contains the information needed to define the Active Directory objects and object attributes for all domains in the forest. It defines what types of objects can be created, what attributes each object can have, and how these attributes are used by the system.

Question 13

A schema can be changed by an administrator or an application to best suit an organization's needs.

Accepted Answer

A schema is not fixed and can be modified by an administrator or an application to meet the specific needs of an organization.

Question 14

A dedicated forest root domain contains only the forestwide administrative accounts and domain controllers needed to run the forestwide operations master roles.No additional OUs or server roles are installed.

Accepted Answer

This statement is correct, a dedicated forest root domain is designed to contain only the necessary forestwide administrative accounts and domain controllers needed to run the forestwide operation master roles, without any additional OUs or server roles installed. Its purpose is to provide a secure and centralized location for managing the entire forest, while avoiding potential issues that may arise when additional objects or roles are added to the domain.

Question 15

The user "TestUserA" has been added to an objects DACL and assigned the Allow Full control permission.However,"TestUserA" has inherited the Deny Full Control permission for the object from its parent container.What is "TestUserA"'s effective permissions?
A)TestUserA has Full Control permissions
B)TestUserA has no permissions due to Deny Full Control
C)TestUserA is given default permissions for the object because Full Control and Deny Full Control cancel each other out
D)This can't be done because conflicting permissions are not allowed in an object's DACL

Accepted Answer

TestUserA has Full Control permissions because Allow Full control permission takes precedence over Deny Full Control permission.

Question 16

Inherited permissions can't be changed or removed without ____.
A)using the "Inherited Permissions Modify" tool
B)having to recreate the object entirely
C)knowing the object's password
D)disabling permission inheritance first

Accepted Answer

In order to change or remove inherited permissions, the permission inheritance needs to be disabled first. Once that is done, the permissions can be modified or removed as needed. There is no need to use a specific tool or know the object's password, and recreating the object entirely would be an unnecessary and time-consuming solution.

Question 17

The group "TestGroup" has been added to an objects DACL and assigned the Allow Full control permission."TestUserA" is a member of "TestGroup",which has been assigned Deny Write permission for the object.What is "TestUserA"'s effective permissions?
A)TestUserA has no permissions to the object because he has been denied write access.
B)TestUserA can do anything that Full Control would allow him to do,except write to the object.
C)TestUserA is part of TestGroup,therefore TestUserA has Full Control permissions regardless of the Deny Write permission.
D)This can't happen because conflicting permissions are not allowed in an object's DACL.

Accepted Answer

In Windows access control, when a user belongs to a group that has been granted permissions, those group permissions apply to the user. However, explicit deny permissions take precedence over allow permissions. In this case, "TestUserA" inherits the Full Control permission from "TestGroup" but is explicitly denied Write permission. This means "TestUserA" retains all permissions granted by Full Control except the ability to write to the object, as deny permissions override allow permissions when they are in conflict.

Question 18

Which operations master role is responsible for providing backwards compatibility with Windows NT servers configured as Windows NT backup domain controllers or member servers?
A)PDC emulator master
B)RID master
C)Domain naming master
D)Schema master

Accepted Answer

The PDC emulator master is responsible for providing backwards compatibility with Windows NT servers configured as Windows NT backup domain controllers or member servers. It emulates the behavior of a Windows NT 4.0 PDC, which includes maintaining the SAM database and processing account lockout policies. This allows legacy Windows NT clients to seamlessly interact with the Active Directory domain.

Question 19

A site link is needed to connect two or more sites for replication purposes.

Accepted Answer

Sites need a link to connect for data replication. This link can be a physical connection, such as through a cable, or a virtual connection, such as through a VPN or the internet. Without a link, the sites cannot communicate and share data.

Question 20

Which of the following is not a valid operations master role?
A)Schema master
B)Infrastructure master
C)User management master
D)RID master

Accepted Answer

The User management master is not a valid operations master role in Active Directory. The three main types of operations master roles are Schema master, Infrastructure master, and RID master. The Schema master is responsible for maintaining the schema of the Active Directory forest. The Infrastructure master is responsible for updating the group-to-user references whenever a user in one domain is added to a group in another domain. The RID master is responsible for allocating a pool of unique IDs to each domain controller in a domain for creating objects.

Quiz 4: Active Directory Design and Security Concepts

Which of the following answers is not a task that can be delegated

Match a term below to the following description The process for replicating Active Directory objects in which changes to the database can occur on any domain controller and are propagated,or replicated,to all other domain controllers.

Which of the following is not a valid directory partition type?

All computers assigned an address in a subnet require a router to communicate with one another.

A Discretionary access control list (DACL) ____.

The Lightweight Directory Access Protocol is based on which of the following technologies?

To verify who has been delegated control of an OU,you must ____.

Which directory partition contains all objects in a domain,including users,groups,computers,OUs,and other objects?

Explicit permissions never override inherited permissions.

Which operations master role is responsible for ensuring that changes made to object names in one domain are updated in references to these objects in other domains?

Which of the following statements about operations master roles is correct?

What directory partition contains information needed to define Active Directory objects and object attributes for all domains in the forest?

A schema can be changed by an administrator or an application to best suit an organization's needs.

A dedicated forest root domain contains only the forestwide administrative accounts and domain controllers needed to run the forestwide operations master roles.No additional OUs or server roles are installed.

The user "TestUserA" has been added to an objects DACL and assigned the Allow Full control permission.However,"TestUserA" has inherited the Deny Full Control permission for the object from its parent container.What is "TestUserA"'s effective permissions?

Inherited permissions can't be changed or removed without ____.

The group "TestGroup" has been added to an objects DACL and assigned the Allow Full control permission."TestUserA" is a member of "TestGroup",which has been assigned Deny Write permission for the object.What is "TestUserA"'s effective permissions?

Which operations master role is responsible for providing backwards compatibility with Windows NT servers configured as Windows NT backup domain controllers or member servers?

A site link is needed to connect two or more sites for replication purposes.

Which of the following is not a valid operations master role?