MCM Active Directory 3 — Questions and Answers
Question 1: Which tool can an administrator use to view and modify Active Directory replication topology?
- ldp.exe
- repadmin /showrepl (Correct answer)
- dcdiag /test:replications
- netdom query fsmo
Correct answer: repadmin /showrepl
Repadmin /showrepl displays the replication topology and shows the last replication attempt and result for each naming context.
Question 2: In Active Directory Sites and Services, what is the purpose of a site link bridge?
- To physically connect two network segments
- To allow transitive routing of replication traffic between sites not directly linked (Correct answer)
- To balance load between multiple domain controllers
- To encrypt inter-site replication traffic
Correct answer: To allow transitive routing of replication traffic between sites not directly linked
A site link bridge enables transitive site link costs, allowing the KCC to route replication through intermediate sites when direct site links don't exist.
Question 3: Which Group Policy setting controls the maximum age of a Kerberos ticket in Active Directory?
- Maximum lifetime for user ticket (Correct answer)
- Maximum tolerance for computer clock synchronization
- Maximum lifetime for service ticket
- Kerberos session key lifetime
Correct answer: Maximum lifetime for user ticket
The 'Maximum lifetime for user ticket' policy controls the TGT validity period, defaulting to 10 hours in Active Directory.
Question 4: What happens when an Active Directory object's USN (Update Sequence Number) is higher than a replication partner's high watermark for that DC?
- The object is flagged as conflicting
- The change is replicated to the partner (Correct answer)
- The object is tombstoned
- The DC is quarantined
Correct answer: The change is replicated to the partner
When an object's USN exceeds the partner's stored high watermark for the originating DC, that change is included in the next replication cycle.
Question 5: Which FSMO role is responsible for maintaining compatibility with older NT-style password changes?
- Schema Master
- PDC Emulator (Correct answer)
- RID Master
- Infrastructure Master
Correct answer: PDC Emulator
The PDC Emulator acts as the primary domain controller for legacy NT clients and handles backward-compatible password change requests.
Question 6: What is the function of the Infrastructure Master FSMO role?
- Manages RID pool allocation for all DCs
- Updates cross-domain group-to-user references (Correct answer)
- Controls schema modifications
- Handles inter-forest trust authentication
Correct answer: Updates cross-domain group-to-user references
The Infrastructure Master updates phantom references (cross-domain group membership pointers) to reflect changes when users are renamed or moved.
Question 7: In AD DS, which attribute uniquely identifies an object across the entire forest, even if the object is moved or renamed?
- Distinguished Name (DN)
- objectGUID (Correct answer)
- objectSid
- sAMAccountName
Correct answer: objectGUID
The objectGUID is a 128-bit GUID assigned at object creation that never changes, making it the stable unique identifier across the forest.
MCM Active Directory 3
Which tool can an administrator use to view and modify Active Directory replication topology?