Deck 1: Designing Active Directory Domain Services

Question 1

Fine-grained password policies can be implemented if the domain functional level is set to at least ____.

A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Answer 1

D

Question 2

SID filtering should be disabled by an automated process.

Answer 2

False

Question 3

The ____ for Active Directory defines the objects that can be created in Active Directory.

A) schema
B) directory
C) database
D) template

Answer 3

A

Question 4

A ____ is a group of well-connected computers or well-connected subnets.

A) domain
B) site
C) forest
D) trust

Question 5

For most applications, a single-domain, single-forest design will work.

Question 6

A ____ trust is granted between several domains without creating explicit trust relationships between the different domains.

A) non-transitive
C) transitive
B) one-way
D) foreign

Question 7

____ is an Active Directory preparation tool that can modify the schema by adding objects and properties needed to support Windows Server 2008 domain controllers.

A) ADSIEdit
B) ADPrep
C) DCPromo
D) GPUpdate

Question 8

If you want users or groups to be able to access a resource using SID history, you must enable SID filtering.

Question 9

A domain functional level or forest functional level can be raised and then undone (or lowered) as necessary.

Question 10

Forest trusts are possible once the forest functional level has been raised to ____.

A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Question 11

The ____ authentication option allows Windows to automatically authenticate any users in another forest to access resources in the local forest.

A) domain-wide
C) schema-wide
B) tree-wide
D) forest-wide

Question 12

Fine-grained password and account ____ policies are a significant addition to Windows Server 2008.

A) lockout
B) length
C) timeout
D) login

Question 13

When selective authentication is implemented on a forest trust, you need to grant the ____ permission on each server or computer where access is granted.

A) Allowed to Authenticate
C) Run as Service
B) Replace Token
D) Act as Part of the Operating System

Question 14

An Active Directory domain is hosted on a server called a ____.

A) member server
B) domain master
C) domain controller
D) role master

Question 15

A ____ trust creates an explicit trust relationship between two domains and is not transferred to any other domains.

A) non-transitive
B) transitive
C) one-way
D) foreign

Question 16

The ____ authentication option can be used to prevent users in another forest from automatically being authenticated.

A) restricted
C) filtered
B) selective
D) one-way

Question 17

Trusts within a forest are ____ trusts.

A) one-way
B) foreign
C) non-transitive
D) transitive

Question 18

When you see the forest functional level is Windows Server 2008, you also know that every domain and domain controller in the forest must be running at least ____.

A) Windows NT
B) Windows Server 2000 Native
C) Windows Server 2003
D) Windows Server 2008

Question 19

In a ____, users in each domain can be granted access to resources in both domains.

A) one-way trust
B) two-way trust
C) foreign trust
D) restricted trust

Question 20

It's possible to create alternative UPN suffixes and assign these to users in the domain.

Question 21

List the domain functional levels that a target domain can be operating in when using ADMT v3.1.

Question 22

A(n) _________________________ is used within a domain to organize objects.

Question 23

____ is used when objects are migrated between domains in separate forests.

A) Interforest migration
C) Interdomain migration
B) Intraforest migration
D) Intradomain migration

Question 24

ADMT v3.1 should be installed and run on a Windows Server 2008 domain controller in the ____________________ domain.

Question 25

Explain the difference between autonomy and isolation.

Question 26

Access to any resource within the domain is controlled by a(n) ____.

A) Access Control Entity
C) Discretionary Access Control List
B) Discretionary Access Control Object
D) Access Control List

Question 27

Discuss the security risk of SID history if you are migrating accounts between forests that aren't completely trusted.

Question 28

You can easily determine what servers hold all the roles by opening a command prompt and entering the following command: ____

A) netdom query trust
C) netdom query pdc
B) netdom query fsmo
D) netdom query dc

Question 29

How is the migration of objects handled between domains?

Question 30

Discuss what happens when SID filtering is disabled.

Question 31

Discuss the difference between domain controllers and servers when raising the level to Windows Server 2008.

Question 32

Beyond autonomy, what are two other reasons to create separate domains?

Question 33

You are designing a plan that will merge two companies and you need to create a forest trust relationship between two forests.What are some considerations you should keep in mind?

Question 34

____ prevents the risk of an attacker obtaining SID history data by blocking the use of any SIDs that did not originate in the same domain.

A) SID blocking
C) SID masking
B) SID selecting
D) SID filtering

Question 35

The ADPrep switch ____ is used to prepare the forest for Windows Server 2008 or Windows Server 2008 R2 domain controllers.

A) /ForestBuild
C) /ForestPrep
B) /ForestNew
D) /ForestSelect

Question 36

An Active Directory ____________________ includes one or more trees comprised of one or more domains.

Question 37

____________________ is achieved when an organization can independently manage their data.

Question 38

_________________________ is used when objects are migrated between domains in the same forest.

Question 39

You can disable SID filtering using the ____ command on the trusting domain.

A) Netdom
C) Wscript
B) Netf
D) Netsh

Question 40

List the extra steps that must be taken to allow SID history to work between different forests.

Question 41

List the trusts that can be used to create a trust relationship in order to run ADMT.