Administering Windows Server 2012 Research & Evidence-Based Practice 5 — Questions and Answers
Question 1: Which Windows Server 2012 tool provides a graphical view of real-time CPU, disk, network, and memory usage broken down by process and service?
- Resource Monitor (Correct answer)
- Task Manager
- Performance Monitor
- Server Manager
Correct answer: Resource Monitor
Resource Monitor (resmon.exe) shows real-time resource usage per process, including disk I/O paths and network connections, in a single view.
Question 2: An admin researching scheduled task history on Windows Server 2012 finds no entries. What must be enabled to record task execution evidence?
- Task history must be enabled in Task Scheduler via 'Enable All Tasks History' (Correct answer)
- Audit Object Access in Group Policy
- Enable the Application log
- Enable Performance Logging
Correct answer: Task history must be enabled in Task Scheduler via 'Enable All Tasks History'
Task history logging is disabled by default and must be enabled per task or globally via the Action menu in Task Scheduler.
Question 3: Which Windows Server 2012 feature allows an administrator to analyze role configuration compliance across the entire server farm from one console?
- Server Manager with multiple servers added and BPA scans (Correct answer)
- System Center Configuration Manager only
- Group Policy Results Wizard
- Active Directory Users and Computers
Correct answer: Server Manager with multiple servers added and BPA scans
Server Manager can manage multiple remote servers and run BPA scans on their roles, providing centralized compliance evidence.
Question 4: To research the root cause of a Blue Screen of Death (BSOD) on Windows Server 2012, which tool analyzes the resulting minidump file?
- WinDbg with the Windows Debugging Tools (Correct answer)
- Event Viewer
- Reliability Monitor
- Performance Monitor
Correct answer: WinDbg with the Windows Debugging Tools
WinDbg from the Windows SDK Debugging Tools reads crash dump files and, with the Microsoft symbol server, identifies the faulting driver or module.
Question 5: Which PowerShell module on Windows Server 2012 R2 provides cmdlets for researching and managing SMB shares and connections?
- SmbShare module (Get-SmbShare, Get-SmbSession) (Correct answer)
- NetTCPIP module
- ServerManager module
- FileServerResourceManager module
Correct answer: SmbShare module (Get-SmbShare, Get-SmbSession)
The SmbShare module includes Get-SmbShare, Get-SmbSession, and Get-SmbConnection for inventorying and analyzing SMB activity.
Question 6: An admin needs evidence that a specific user accessed a file share. Which must be configured for file access auditing to generate events in the Security log?
- Audit Object Access policy must be enabled AND SACL set on the folder (Correct answer)
- Audit Logon Events policy only
- Enable Share-level auditing in Computer Management
- Set Folder Redirection in Group Policy
Correct answer: Audit Object Access policy must be enabled AND SACL set on the folder
File access auditing requires both the Audit Object Access audit policy and a System Access Control List (SACL) on the resource to be audited.
Question 7: Which Windows Server 2012 command displays current TCP connections and listening ports, useful for researching unexpected network activity?
- netstat -ano (Correct answer)
- ipconfig /all
- nslookup
- route print
Correct answer: netstat -ano
Netstat -ano lists all active TCP/UDP connections with associated Process IDs (PIDs), enabling identification of unexpected listeners.
Administering Windows Server 2012 Research & Evidence-Based Practice 5
Which Windows Server 2012 tool provides a graphical view of real-time CPU, disk, network, and memory usage broken down by process and service?