Question 1

Fine-grained password policies can be implemented if the domain functional level is set to at least ____.
A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Accepted Answer

Fine-grained password policies were introduced in Windows Server 2008, allowing for more detailed and specific password and account lockout policies within the same domain.

Question 2

SID filtering should be disabled by an automated process.

Accepted Answer

SID filtering is a security feature used in Active Directory trust relationships to prevent attackers from accessing resources in a trusting domain by using forged SIDs. Disabling SID filtering should be done cautiously and manually, not by an automated process, to ensure security is not inadvertently compromised.

Question 3

The ____ for Active Directory defines the objects that can be created in Active Directory.
A) schema
B) directory
C) database
D) template

Accepted Answer

The schema for Active Directory contains definitions for all the objects that can be created in the directory. It provides a blueprint for the types of objects that can exist in Active Directory, including user accounts, computer accounts, group objects, and more. The schema also defines the attributes that can be associated with each object type.

Question 4

A ____ is a group of well-connected computers or well-connected subnets.
A) domain
B) site
C) forest
D) trust

Accepted Answer

A group of well-connected computers or subnets is commonly referred to as a "site" in the context of network infrastructure. A domain is a logical grouping of computers and devices that share a common security policy and name space. A forest is a collection of domains that share a common schema and global catalog, and a trust is a relationship established between domains to allow for authentication and resource sharing.

Question 5

For most applications, a single-domain, single-forest design will work.

Accepted Answer

This is true for most small to medium-sized organizations. However, larger organizations with complex business needs may require a multi-domain or multi-forest design.

Question 6

A ____ trust is granted between several domains without creating explicit trust relationships between the different domains.
A) non-transitive
B) one-way
C) transitive
D) foreign

Accepted Answer

A transitive trust allows a trust relationship to be extended beyond two domains to include other trusted domains in the network. This means that if Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A automatically trusts Domain C without needing a direct trust relationship. This is essential for simplifying trust management in complex networks with multiple domains.

Question 7

____ is an Active Directory preparation tool that can modify the schema by adding objects and properties needed to support Windows Server 2008 domain controllers.
A) ADSIEdit
B) ADPrep
C) DCPromo
D) GPUpdate

Accepted Answer

ADPrep is specifically designed to modify the Active Directory schema to support newer domain controllers. ADSIEdit is a general-purpose tool for managing Active Directory, DCPromo is used to promote or demote a domain controller, and GPUpdate is used to update group policies on client computers.

Question 8

If you want users or groups to be able to access a resource using SID history, you must enable SID filtering.

Accepted Answer

SID history is used to maintain access to resources when migrating accounts between domains, and it does not require SID filtering to be enabled. SID filtering is actually a security feature used to prevent malicious users from elevating their privileges by exploiting trust relationships between domains.

Question 9

A domain functional level or forest functional level can be raised and then undone (or lowered) as necessary.

Accepted Answer

Once a domain or forest functional level is raised, it cannot be lowered. This change is irreversible without restoring from a backup or rebuilding the domain or forest.

Question 10

Forest trusts are possible once the forest functional level has been raised to ____.
A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Accepted Answer

Forest trusts were introduced in Windows Server 2003, so the forest functional level must be raised to at least Windows Server 2003 for forest trusts to be possible. Choices A and B are older versions that do not support forest trusts, and while Windows Server 2008 also supports forest trusts, it is not the minimum requirement.

Question 11

The ____ authentication option allows Windows to automatically authenticate any users in another forest to access resources in the local forest.
A) domain-wide
B) tree-wide
C) schema-wide
D) forest-wide

Accepted Answer

Forest-wide authentication option allows Windows to automatically authenticate any users in another forest to access resources in the local forest. The domain-wide, tree-wide, and schema-wide options are not related to cross-forest authentication.

Question 12

Fine-grained password and account ____ policies are a significant addition to Windows Server 2008.
A) lockout
B) length
C) timeout
D) login

Accepted Answer

Fine-grained password and account lockout policies allow administrators to define different password and account lockout policies for different sets of users within the same domain, which was a significant addition in Windows Server 2008.

Question 13

When selective authentication is implemented on a forest trust, you need to grant the ____ permission on each server or computer where access is granted.
A) Allowed to Authenticate
B) Replace Token
C) Run as Service
D) Act as Part of the Operating System

Accepted Answer

When selective authentication is implemented on a forest trust, the "Allowed to Authenticate" permission needs to be granted on each server or computer where access is granted. This permission is required to allow users or groups from the trusted forest to authenticate on the local domain. Granting the "Replace Token," "Run as Service," or "Act as Part of the Operating System" permissions are unrelated and not required for selective authentication.

Question 14

An Active Directory domain is hosted on a server called a ____.
A) member server
B) domain master
C) domain controller
D) role master

Accepted Answer

A domain controller is a server that hosts a copy of the Active Directory database and authenticates users and computers within the domain.

Question 15

A ____ trust creates an explicit trust relationship between two domains and is not transferred to any other domains.
A) non-transitive
B) transitive
C) one-way
D) foreign

Accepted Answer

A non-transitive trust means that the trust is limited to only the two domains explicitly involved in the trust and is not extended to any other domains. This ensures that the trust relationship is not inadvertently propagated to other domains.

Question 16

The ____ authentication option can be used to prevent users in another forest from automatically being authenticated.
A) restricted
B) selective
C) filtered
D) one-way

Accepted Answer

Selective authentication allows an administrator to restrict access to only those users in a trusted forest who have been given explicit permissions to access resources in the trusting forest, preventing automatic authentication of all users from the other forest.

Question 17

Trusts within a forest are ____ trusts.
A) one-way
B) foreign
C) non-transitive
D) transitive

Accepted Answer

Trusts within a forest are transitive trusts, meaning that if one trust is trusted by another trust, then any domain or user account authenticated by the trusted domain or trust can access resources in the trusting domain or trust.

Question 18

When you see the forest functional level is Windows Server 2008, you also know that every domain and domain controller in the forest must be running at least ____.
A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Accepted Answer

When the forest functional level is set to Windows Server 2008, it means that all domain controllers within the forest must be running Windows Server 2008 or a later version. This ensures compatibility with the features and functionalities specific to that forest functional level.

Question 19

In a ____, users in each domain can be granted access to resources in both domains.
A) one-way trust
B) two-way trust
C) foreign trust
D) restricted trust

Accepted Answer

In a two-way trust, users in both domains can be granted access to resources in both domains. This allows resources and authentication to flow in both directions, making it easier to manage access to shared resources.

Question 20

It's possible to create alternative UPN suffixes and assign these to users in the domain.

Accepted Answer

It is possible to create alternative User Principal Name (UPN) suffixes and assign them to users in the domain. This can be useful in scenarios where users need to log in using a domain name that is different from the default domain name. For example, users might need to log in using an email address instead of their username, or they might need to log in using a shorter, easier-to-remember domain name. By creating alternative UPN suffixes, administrators can give users more flexibility in how they log in to their domain.

Quiz 1: Designing Active Directory Domain Services

Fine-grained password policies can be implemented if the domain functional level is set to at least ____.

SID filtering should be disabled by an automated process.

The ____ for Active Directory defines the objects that can be created in Active Directory.

A ____ is a group of well-connected computers or well-connected subnets.

For most applications, a single-domain, single-forest design will work.

A ____ trust is granted between several domains without creating explicit trust relationships between the different domains.

____ is an Active Directory preparation tool that can modify the schema by adding objects and properties needed to support Windows Server 2008 domain controllers.

If you want users or groups to be able to access a resource using SID history, you must enable SID filtering.

A domain functional level or forest functional level can be raised and then undone (or lowered) as necessary.

Forest trusts are possible once the forest functional level has been raised to ____.

The ____ authentication option allows Windows to automatically authenticate any users in another forest to access resources in the local forest.

Fine-grained password and account ____ policies are a significant addition to Windows Server 2008.

When selective authentication is implemented on a forest trust, you need to grant the ____ permission on each server or computer where access is granted.

An Active Directory domain is hosted on a server called a ____.

A ____ trust creates an explicit trust relationship between two domains and is not transferred to any other domains.

The ____ authentication option can be used to prevent users in another forest from automatically being authenticated.

Trusts within a forest are ____ trusts.

When you see the forest functional level is Windows Server 2008, you also know that every domain and domain controller in the forest must be running at least ____.

In a ____, users in each domain can be granted access to resources in both domains.

It's possible to create alternative UPN suffixes and assign these to users in the domain.