Exam 70-297: Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure Practice Questions

1. A company has six offices across the country, and each office has
administrators who look after system maintenance and backups. The major IT
decisions, such as domain panning, purchases, and security policies, are made at
the head office. What kind of administrative model is the company following?

A. Centralized
B. Decentralized
C. Hybrid
D. Outsourced

Answer B is correct. When there is local administrative staff at remote
locations but major IT decisions are taken at the head office, a decentralized
model is in use.

2. A company has four different offices located in four
cities in California and nearby states. Each office is independently managed by
the local IT staff. What type of geographical model is in place?

A.
Local
B. National
C. Regional
D. International

Answer C is correct. When a company is located in several nearby states, it uses a regional geographical model.

3. You have started the analysis of the current network
infrastructure of a company and are in the process of preparing analysis
documentation. The company has 16 offices located across the country. Which of
the following would be the most important factor when analyzing the network
performance of the interoffice connectivity?

A. Number of subnets in each
office
B. Number of users in each office
C. Speed of LAN connections
D. Speed of WAN links
Answer D is correct. When a company is spread
across the country, different vendors may be involved in providing WAN
connectivity. The type and speed of the WAN links is an important factor when
analyzing the interoffice connectivity.

4. You need a Windows-based tool
that can be used to monitor the network performance of each critical server
individually. You do not have time or budget to purchase any other software
application for this purpose. Which of the built-in tools is best suited for
analyzing network traffic to and from each server?

A. Performance Console
B. Network Monitor
C. Task Manager
D. System Monitor

Answer B is
correct. The built-in Network Monitor can be used to analyze traffic to and from
a single Windows 2000 or Windows Server 2003 server. If you need to monitor the
entire network from a single server, you will need the full version of Network
Monitor included with Microsoft Systems Management Server.

5. When analyzing
the IP addressing scheme used on the current network infrastructure, which of
the following is the least important consideration?

A. IP address range in
each subnet
B. Subnet mask for each subnet
C. Names of DNS servers for
each subnet
D. Default gateway in each subnet

Answer C is correct. When
you are analyzing the IP-addressing scheme, the names of servers providing
network services, such as DNS and WINS, are not as important as determining how
IP address space has been divided to accommodate IP subnets.

6. You are
analyzing the current Windows Server 2003 network for an organization. The
organization has two Unix servers in one of the network segments. The
development department uses these servers for testing software applications. The
servers are placed in their own separate domain. What type of trust relationship
might exist between the Windows domain and the Unix domain?

A. Realm trust
B. External trust
C. Forest trust
D. Shortcut trust

Answer A is
correct. A realm trust is created between Windows Server 2003 Active Directory
domain and a non-Microsoft domain that uses Kerberos 5 as security protocol.

7. You are the systems administrator for your company, which deals with
development of software products. The company is expanding and wants to open new
offices in London, England, and Singapore. The company will initially be
exporting its products from the head office in the United States. Local staff
will independently handle the new domains once they are implemented. The local
country managers will make decisions about account and password policies. You
have been asked to analyze the design requirements of the Active Directory
domains for the new offices, which will be connected to the head office. Which
of the following is your best option for designing new domains?

A. Create a
new forest for each of the new locations.
B. Add the new domains to the
existing domain tree.
C. Create new domains as subdomains of the head
office.
D. Create new sites for the domain at the head office.

Answer B
is correct. It is best to create new domains in the existing domain tree. Since
there is no need for a new separate forest, the existing domain structure can be
expanded by adding new domains to the domain tree. You should try to keep the
Active Directory structure to a single forest as much as possible.

8. You
have been asked to design an Active Directory structure for a fast-growing
company that is planning to open six offices across the country. You were
talking to the IT manager, who indicated that he wants each office to have its
own Security policies. He was not sure whether it calls for a different domain
or a different forest for each location. Which of the following is a good reason
to create a new forest? Choose two answers.

A. When you have different
security policies
B. When local administrators are available
C. When you
need an isolated unit within the company
D. When each business unit needs
independent control of resources
E. When two companies have merged but each
wants to retain autonomy over its networks

Answers C and E are correct. As
much as possible, you should keep the forest structure to a single forest. A new
forest should be created only when some unit of the company needs isolation from
the rest of the company. A different forest may also be a good choice when two
companies have merged and each wants to retain autonomy over its IT
infrastructure.

9. Which of the following is not an advantage of keeping the
Active Directory network to a single domain?

A. A single domain is scalable
and manageable
B. Centralized administration is possible
C.
Organizational units can be used to delegate administration
D. Business
units can be isolated according to their security needs

Answer D is correct.
If you need to isolate business units for reasons of security requirements or
granting autonomy over their respective resources, it is better to create
separate domains for each business unit.

10. You have been asked to upgrade
an existing Windows 2000 Active Directory domain to a Windows Server 2003
domain. Which of the following utilities should be run before the upgrade
process can actually start? Select two answers.

A. adprep /forestprep
B.
adprep /domainprep
C. adprep /dnsprep
D. adprep /gcprep
E. adprep
/schemaprep

Answers A and B are correct. The Active Directory Preparation
Tool adprep.exe should be run on Windows 2000 domain controllers to prepare them
for Windows Server 2003 Active Directory. The adprep /forestprep command adds
new features to the forest schema. The adprep /domainprep adds domain-specific
features to the Windows 2000 domain.

11. You have finalized the design of
the Active Directory domain structure for a company and are now in the process
of designing the OU structure. The IT manager wants you to create a separate OU
for each location of the company, but the resources at each location should be
grouped according to the departments of the company. Which of the following OU
models should you choose?

A. Location-based
B. Function-based
C.
Organization-based
D. Location-, then organization-based

Answer D is
correct. The IT manager is asking you to follow the "location, then
organization" model for creating OUs. The top-level OUs should be based on
locations of the company. Beneath each location-based OU, you should create OUs
for each department of the company.

12. Which of the following is the main
purpose of creating Organizational Units?

A. Delegation of control
B. To
grant resource access permissions
C. To create Active Directory sites
D.
To localize network traffic

Answer A is correct. The main reason for
creating Organizational Units is to delegate control of these units to local
administrators. Remember that an OU is the smallest administrative unit for
which you can delegate control. Other reasons for creating OUs are limiting
visibility of objects in the Active Directory and implementing Group Policies
effectively.

13. The network you are analyzing contains Window NT 4.0 and
Windows 2000 domain controllers. You want to install Windows Server 2003 domain
controllers and create two new domains. The existing domain controllers will
remain in the network. Which of the following domain functional levels can you
have?

A. Windows 2000 Mixed
B. Windows 2000 Native
C. Windows Server
2003 Interim
D. Windows Server 2003

Answer A is correct. The Windows
2000 Mixed domain functional level allows a Windows Server 2003 domain
controller to interact with Windows 2000 and Windows NT 4.0 domain controllers.

14. Which of the following operations master roles is required for creating
and deleting domains from a forest?

A. PDC emulator
B. Schema master
C. Domain naming master
D. Relative ID master
E. Infrastructure
master

Answer C is correct. The domain controller holding the role of domain
naming master must be online when domains are added or removed from a forest.

15. You are designing a solution for cross-forest resource access for a
Windows Server 2003-based Active Directory network. The network consists of
three forests, and trust relationships have already been created. Which of the
following logon options should be used by users to log on to trusted forests?

A. Universal principal name
B. Username and password
C. Username and
domain name
D. Domain name and password

Answer A is correct. Users need
UPN names to log on to domains in trusted forests. The UPN name of a user
contains the user account name and the domain name. It looks like an email
addressfor example, myname@mydomain is a UPN name.

16. You want to design
Universal groups to allow users from one domain to access resources in another
trusted domain. When you ask one of the administrators to create a Universal
group for testing, he reports that this option is not available on any of the
six domain controllers in the network. What could be the reason?

A. The
administrator does not have rights to create Universal groups.
B. The domain
functional level is not Windows Server 2003 or Windows 2000 Native.
C. The
forest functional level is not Windows Server 2003.
D. Universal groups are
available only in forests that are not in domains.

Answer B is correct.
Universal groups are available only if the domain functional level is either
Windows Server 2003 or Windows 2000 Native. Windows 2000 Mixed or Windows Server
2003 Interim levels do not support Universal groups.

17. You have created a
diagram showing different servers that will host Internet services for your
organization. Two firewalls will separate these servers from the internal
network and the Internet. How should you assign IP addresses to these servers?

A. Through APIPA addressing
B. By placing a DHCP server in the perimeter
network
C. By using alternate IP address configuration
D. By manually
configuring IP addresses

Answer D is correct. All critical servers that host
Internet services, such as a web server, DNS server, mail server, etc., should
be configured with static (manual) IP addresses. This is because these servers
usually need registered IP addresses.

18. A Windows Server 2003 computer is
designated as a file server in the Active Directory domain. This server is
located in the FileServ OU. The FileServ OU is part of the NY domain located at
a New York site. Group policies are linked to the domain, site, and NY OU. The
file server itself has a GPO linked to it. Identify the correct processing order
of GPOs.

A. Local, domain, site, and OU
B. Domain, site, local, and OU
C. Local, site, domain, and OU
D. OU, site, domain, and local

Answer
C is correct. Local GPO is processed first, followed by site, domain, and
Organizational Unit GPOs. The GPO linked to the site overrides the conflicting
settings in the local GPO. Similarly, the GPO linked to the domain overrides
conflicting settings at the site level. Domain settings are overridden by
settings in the GPO linked to the OU.

19. What happens if an OU is linked to
multiple GPOs from several sources?

A. Only the first GPO is processed.
B. The administrator can choose which GPO should be processed.
C. The
GPO with maximum settings is processed.
D. All GPOs are processed starting
from the lowest GPO in the list.

Answer D is correct. When multiple GPOs are
linked to the OU, all GPOs are processed, starting from the lowest GPO. However,
the administrator can change the processing order of the GPOs.

20. According
to Microsoft recommendations, which of the following groups should be used to
assign resource access permissions?

A. Domain Local
B. Global
C.
Universal
D. Any of above

Answer A is correct. Microsoft recommends that
resource access permissions should be assigned to Domain Local groups. Users
should be placed in Global groups, Global groups should be placed in Universal
groups. and Universal groups should be placed in Domain Local groups. This
simplifies administration of resources and helps troubleshoot resource access
problems.

21. One of the departments in your organization wants to design
its own account policies due to security requirements for its development
projects. Which of the following is the best option to accomplish this?

A.
Place the department in a separate OU
B. Place the department in a separate
domain
C. Place the department in a separate site
D. Create a new forest
for the department

Answer B is correct. Account policies are applied at the
domain level and are effective in the entire domain. You cannot have two
different account policies in a single domain. Creating a new forest can also
solve the problem, but there is no reason to do so.

22. Which of the
following networks can use Network Address Translation for Internet
connectivity?

A. A network with 1 subnet, 120 client computers, 2 domain
controllers, a DNS server, a web server, and a mail server
B. A network with
2 subnets, 60 client computers in each subnet, 2 domain controllers, and 2 DNS
servers
C. A network with 3 subnets, 80 client computers in each subnet, 4
domain controllers, a DNS server, and a WINS server
D. A network with 4
subnets, 45 client computers in each subnet, 2 domain controllers, a DNS server,
a web server, and a mail server

Answer A is correct. Network Address
Translation can be used only for small organizations that do not have any
network segments. Web servers, DNS servers, and mail servers can exist behind
NAT servers and still be visible from the Internet using registered IP
addresses.

23. A US-based company has registered a second-level domain name
as catsupplies.com. This domain will be
available for public access on the Internet. The company wants to keep its
internal Active Directory domain structure entirely separate from the external
domain. Which of the following DNS names should you choose for the internal
network of the company?

A. int.catsupplies.com
B. us.catsupplies.com
C. catsupplies.net
D. internal.catsupplies.com

Answer C is correct. All other
names are subdomains of the registered domain name. If you want to keep internal
and external namespaces separate, the only option from the given choices is
catsupplies.net.

24. A junior administrator assigned with the task of
managing account policies is trying to figure out where the Account and Password
Policies are stored on the domain controller. Can you tell her where these
policy settings are configured?

A. Default domain controllers policy
B.
Default forest policy
C. Default domain policy
D. Default site policy

Answer C is correct. Password and account policies for the domain are
located in the default domain policy GPO. These policies are applied to all
objects in the domain and cannot be overridden by other policies.

25. You
are designing a plan for controlling replication of the Active Directory
database between two domain controllers located in separate locations connected
by WAN links. What do you need to create? Select two answers.

A. Sites
B. Site links
C. IP subnets
D. Subnet links
E. Bridgehead
servers

Answers A and B are correct. You need to configure sites and site
links for controlling replication between domain controllers at remote locations
connected by WAN links. You can configure replication to occur when other
network traffic is low.

26. What needs to be configured if you disable site
link transitivity between remote sites?

A. Site link costs
B. Bridgehead
servers
C. Site link bridges
D. Preferred Bridgehead servers

Answer
B is correct. Site link transitivity is enabled by default. If you disable site
link transitivity for a replication protocol, you will need to configure site
link bridges between sites. Site link transitivity should be disabled in rare
circumstances.

27. Which of the following should be considered a good reason
to place a Global Catalog server in a site? Select all correct answers.

A.
When there are less than 100 users at a site
B. When there are more than 100
users at a site
C. When some applications need to query the Global Catalog
D. When the sites are connected by slow WAN links
E. When there are a
number of domain controllers at a site

Answers B, C, D, and E are correct. A
site needs a Global Catalog server if any of these is correct. Besides this, the
number of Global Catalog servers should be half the number of domain controllers
at a site. This calculation is important for sites that have multiple domain
controllers and a large number of users at a single, large site.

28. Your IT
manager wants you to choose a server from the existing server hardware to
install the Windows Server 2003 operating system. You need to calculate the
processor requirements for a site with nearly 900 users. Which of the following
processor configurations can be used?

A. One 850 MHz Processor and 512 MB
RAM
B. One 850 MHz Processor and 1 GB RAM
C. Dual 850 MHz processor and
1 GB RAM
D. Quad 850 MHz processor and 2 GB RAM

Answer C is correct.
Microsoft recommends that for 500 to 999 users, you should use a dual processor
server with a minimum of 850 MHz speed and at least 1 GB RAM.

29. What is
the best place to install domain controllers within a site?

A. At a place
where a large number of users are working
B. At a place that is physically
secure
C. At a place that is easily accessible by all users
D. At a
place that is difficult to reach

Answer B is correct. Domain controllers and
other servers that provide critical network services should be placed in
physically secure locations. Physical security is one of the main reasons behind
creating server rooms or Network Operations Centers (NOCs).

30. You are
designing the DNS structure for a company. The company needs maximum protection
for its DNS zone data so that it is difficult for hackers and attackers to get
information about names and IP address used inside the company. Which of the
following types of DNS zones should you suggest?

A. Active
Directory-integrated zones
B. Standard primary zones
C. Standard
secondary zones
D. Stub zones

Answer A is correct. Active
Directory-Integrated zones offer maximum possible security for DNS zone data.
The zone data is stored in the Active Directory on domain controllers and
replicated in encrypted form along with other Active Directory information.

31. You have decided to analyze the current performance levels of the
existing DNS servers in the network. Which of the following performance counters
should you monitor? Select all correct answers.

A. Total queries received
per second
B. Total responses sent per second
C. Average queries
received per second
D. Average responses sent per second
Answers A, B,
C, and D are all correct. The Performance console includes the given counters
for the DNS object. You should create a performance log and analyze the logs to
see whether any of the existing DNS servers are experiencing performance
bottlenecks.

32. You are designing an Active Directory infrastructure for a
medium-sized organization that wants to have an Internet presence. You are
currently working on the IP address allocation plan. How should you define
scopes on DHCP servers for allocating IP addresses to file servers, print
servers, and printers so that they get the same address every time they are
started?

A. By assigning static IP addresses
B. By DHCP scope
reservations
C. By DHCP scope options
D. By using alternate addresses

Answer B is correct. The servers and other equipment configured to get IP
addresses from the DHCP server should have address reservations on the DHCP
server so that they always get the same IP address.

33. You are designing an
Active Directory infrastructure for a small organization that has nearly 120
computers in a single network segment. You are currently working on the IP
address allocation plan. How can you ensure that the clients will continue to
communicate on the network and use the Internet even if the DHCP server is not
available?

A. By using DHCP server options
B. By using address
reservations
C. By using Automatic Private IP Addressing
D. By using
alternate addressing

Answer D is correct. Alternate IP addressing is used
when the clients are configured to use a DHCP server for IP address assignment
and it is not available. The client will use the IP address configured as the
alternate address. The alternate addresses are usually in the same subnet range
that has been configured in the DHCP scope.

34. Which of the following
should you specify in your guidelines for naming computer accounts for servers?
Select two answers.

A. The name should identify the server and its purpose.
B. The name should identify the parent domain and OU of the server.
C.
The name should identify the administrator of the server.
D. The name should
identify the location of the server.
E. The name should identify the domain
controller where the account exists.

Answers A and D are correct. The
account names for servers should identify their location and purpose. For
example, a print server located in a San Francisco office can be named as
SFPrint1 (which stands for San Francisco Print server 1).

35. While
designing a remote access solution for a large company, you are planning to use
the Internet as the medium. Your plan includes installing VPN servers so that
long-distance telephone charges can be saved for remote users. The IT manager
has asked you about some advantages of VPN over dial-up? Which of the following
is not an advantage of using VPN?

A. Support for large number of users
B. Additional processing overheads
C. Internet is used as the medium
D. Scalability is better than dial-up

Answer B is correct. Remote access
using VPN adds additional processing overheads for servers because the server
has to perform encryption and decryption of data packets sent and received from
the Internet. If you are planning to use older hardware as VPN servers, you
should carefully determine the processing needs for the VPN server.

36. You
are designing a DNS infrastructure for a company that already has a mix of
Windows and Unix DNS servers in place. The company wants to retain all the
existing DNS servers, including the Unix DNS servers. Security of zone data is
the main concern for the company. Which of the following DNS servers will
support secure dynamic updates for DNS zones?

A. Windows Server 2003
B.
Windows 2000
C. Windows NT 4.0
D. UNIX BIND 9.1.0
E. UNIX BIND 8.2

Answers A and B are correct. Only Windows Server 2003 and Windows 2000 DSN
implementations support secure dynamic updates. Secure dynamic updates are
supported in the Active Directory-integrated zone that is available only in
Windows Server 2003 and Windows 2000.

37. Several users in the network have
reported in the last hour that when they try to connect to the database server,
they get connected to an unknown web site on the Internet. What kind of DNS
attack has been launched against your DNS servers?

A. Footprinting
B. IP
Spoofing
C. Denial of service
D. Man in the Middle

Answer D is
correct. The Man-in-the-Middle attack happens when an attacker is able to
redirect DNS queries to another DNS server that is under the attacker's control.
The attacker launches this type of attack by modifying some of the resource
records in the zone database. The zone is actually "polluted" with invalid
resource records.

38. You want to design a remote access solution for a
large company that will be using several remote access servers. You want to
centralize authentication of remote users. How can you draft the plan?

A.
Use one of the domain controllers to authenticate remote clients
B. Use a
RADIUS server for authentication
C. Designate one of the remote access
servers as authentication server
D. Configure one of the domain controllers
as RADIUS client

Answer B is correct. Authentication of remote access
clients can be centralized using a RADIUS server. Remote access policies can be
configured on a RADIUS server for all remote access servers. Remote access
servers are configured as RADIUS clients.

39. People who want to connect to
the remote access server are using a variety of Windows operating systems. While
you have denied access to users who still have Windows 95 and Windows for
Workgroups, the company policy states that unless there is a security risk,
users should be allowed to connect. You want to finalize MS-CHAP2 as the
authentication protocol. Which of the following operating systems will not
support this protocol? Select three answers.

A. Windows XP
B. Windows
2000 Professional
C. Windows NT 4.0 SP 4
D. Windows 98
E. Windows NT
3.51
F. Windows 95

Answers D, E, and F are correct. Windows 95, Windows
NT 3.51, and Windows 98 do not support MS-CHAP2 authentication protocol.

40.
You have been tasked to design a remote access solution for a company that deals
with highly confidential data. You plan to use the most secure authentication
protocol for authentication of remote clients. Which of the following is the
most secure of all authentication protocols available with Windows Server 2003?

A. EAP
B. MS-CHAPv1
C. MS-CHAPv2
D. CHAP
E. PAP

Answer A
is correct. The Extensible Authentication Protocol (EAP) is the most secure of
all authentication protocols available with Windows Server 2003. One of the
requirements of this protocol is that the remote access server must be a member
of an Active Directory domain.