Case Studies & Practical Application Flashcards

A server administrator needs to run a PowerShell script on 50 remote servers simultaneously to collect event log data. Which approach is most efficient?

Answer: Use Invoke-Command with the -ComputerName parameter and an array of server names

Invoke-Command with WinRM runs a script block concurrently on multiple remote computers, returning results to the local session.

During a security review, it is discovered that the Guest account is enabled on several domain controllers. What is the immediate recommended action?

Answer: Disable the Guest account via Default Domain Controllers Policy

The Guest account should be disabled on domain controllers through GPO to prevent unauthenticated access to sensitive resources.

An administrator configures a Windows Server 2012 NIC team (LBFO) with two adapters. After configuration, only one adapter shows traffic. What is the expected behavior for the default teaming mode?

Answer: In Switch Independent mode with Dynamic load balancing, traffic is distributed per flow, so one adapter may appear idle

With Switch Independent mode and Address Hash distribution, traffic per individual flow typically uses one adapter; a single active session may not show both adapters loaded.

A company's IT policy requires that all administrator actions on servers be recorded for compliance. Which Windows Server 2012 feature provides session recording for privileged access?

Answer: PowerShell Script Block Logging and Module Logging via GPO

PowerShell Script Block Logging records the content of all executed script blocks to the Security event log, providing an audit trail of administrator actions.

After promoting a new domain controller, replication is failing with error 8453 'Replication access was denied.' What is the most likely cause?

Answer: The account used during DCPromo lacks 'Manage Replication Topology' permissions

Error 8453 indicates the account performing replication lacks the necessary AD replication permissions, often because it is not in the appropriate security group.

A Windows Server 2012 Failover Cluster node fails and the cluster resources do not move to the surviving node. Cluster Validation passes on both nodes. What should you check first?

Answer: The failover policy — maximum failures and period settings on the cluster role

If the maximum failures threshold has been exceeded within the configured period, the cluster role will not fail over and will remain offline to prevent a failover loop.

An organization needs to allow a specific vendor remote access to one server for support purposes with minimal exposure. Which approach follows the principle of least privilege?

Answer: Create a limited local account on the target server with only the required permissions and time-limited access

Creating a scoped local account with only the necessary permissions limits the blast radius if credentials are compromised and ensures access expires.