70-413 Exam Active Directory Infrastructure Design 1 — Questions and Answers
Question 1: What is the recommended approach when designing an AD DS environment where two divisions require completely separate security boundaries?
- Single forest with multiple domains
- Multiple forests with forest trusts (Correct answer)
- Single domain with separate OUs
- Multiple domains with external trusts
Correct answer: Multiple forests with forest trusts
Multiple forests provide the strongest security isolation because each forest has its own schema, configuration, and administrative boundary.
Question 2: Which trust type improves authentication performance by creating a direct trust path between two domains in the same forest that are not directly connected?
- Forest trust
- External trust
- Shortcut trust (Correct answer)
- Realm trust
Correct answer: Shortcut trust
Shortcut trusts create a direct Kerberos trust path between domains, bypassing the need to traverse the full domain tree hierarchy.
Question 3: When planning AD DS site link costs, what factor should primarily drive the cost values you assign?
- Number of domain controllers per site
- Available network bandwidth between sites (Correct answer)
- Number of users per site
- Physical distance between locations
Correct answer: Available network bandwidth between sites
Site link costs should inversely reflect available bandwidth so that replication traffic is directed over the most efficient network paths.
Question 4: Which Active Directory feature introduced in Windows Server 2008 R2 allows administrators to restore accidentally deleted objects while preserving all attributes?
- Shadow Copies
- Active Directory Recycle Bin (Correct answer)
- System State Restore
- Authoritative Restore
Correct answer: Active Directory Recycle Bin
The Active Directory Recycle Bin allows full recovery of deleted objects including all linked and non-linked attributes without requiring a restore from backup.
Question 5: What is the minimum forest functional level required to enable the Active Directory Recycle Bin?
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2 (Correct answer)
- Windows Server 2012
Correct answer: Windows Server 2008 R2
The Active Directory Recycle Bin feature requires the forest functional level to be raised to Windows Server 2008 R2 or higher.
Question 6: Which command-line tool is used to seize FSMO roles when the current role holder is permanently unavailable and cannot be brought back online?
- Active Directory Users and Computers
- ADSI Edit
- ntdsutil (Correct answer)
- repadmin
Correct answer: ntdsutil
The ntdsutil command-line tool is used to seize (forcibly transfer) FSMO roles from a domain controller that is permanently offline.
70-413 Exam Active Directory Infrastructure Design 1
What is the recommended approach when designing an AD DS environment where two divisions require completely separate security boundaries?