MCSE Microsoft MCSE: 70-291 5 — Questions and Answers
Question 1: You need to delegate administrative control of a specific DNS zone to a junior administrator without giving them rights to other zones or the DNS server configuration. What is the correct approach?
- Add the user to the DnsAdmins group for that zone's security descriptor only via the zone's ACL (Correct answer)
- Make the user a local administrator on the DNS server
- Add the user to the Domain Admins group with restricted logon hours
- Create a custom MMC console with the DNS snap-in for that zone only
Correct answer: Add the user to the DnsAdmins group for that zone's security descriptor only via the zone's ACL
DNS zones stored in AD or as files have individual security descriptors; granting write access at the zone ACL level limits the user to that specific zone.
Question 2: A DHCP scope has the address range 192.168.1.1-192.168.1.254 with a /24 subnet mask. Several servers in this range have static IPs. How do you prevent DHCP from assigning those static addresses to clients?
- Create exclusion ranges covering each server's static IP address (Correct answer)
- Create DHCP reservations for each server using their MAC addresses
- Reduce the scope range end address to exclude those IPs
- Enable conflict detection attempts on the DHCP server
Correct answer: Create exclusion ranges covering each server's static IP address
Exclusion ranges tell the DHCP server to skip specific addresses within the scope when allocating leases to clients.
Question 3: You need to configure a Windows Server 2003 RAS server to assign IP addresses from a static pool rather than from a DHCP server. Where do you configure this?
- RRAS server Properties > IP tab > Static address pool (Correct answer)
- DHCP server scope options > Router (003) option
- Remote access policy Profile > IP tab > server-assigned addressing
- Network Connections > Local Area Connection > TCP/IP Properties
Correct answer: RRAS server Properties > IP tab > Static address pool
The RRAS server's IP tab in its Properties dialog allows you to define a static pool of IP addresses assigned to remote clients instead of using DHCP.
Question 4: Which DNS record type is responsible for defining the mail servers that accept email for a domain?
- MX (Mail Exchanger) (Correct answer)
- NS (Name Server)
- SRV (Service Locator)
- TXT (Text)
Correct answer: MX (Mail Exchanger)
MX records specify the hostname(s) of mail servers responsible for accepting SMTP email for a domain, along with their preference values.
Question 5: During a network audit you discover that a Windows Server 2003 RRAS server is accepting connections from dial-up clients using PAP. This is a security risk. Without disrupting L2TP/IPSec clients, how do you disable PAP?
- Uncheck PAP in the remote access policy Profile Authentication tab that applies to dial-up clients (Correct answer)
- Disable PAP globally in the RRAS server Security tab
- Delete the dial-up ports in RRAS and recreate them with MS-CHAP v2 only
- Enable IPSec on all dial-up connections to encrypt PAP credentials
Correct answer: Uncheck PAP in the remote access policy Profile Authentication tab that applies to dial-up clients
Authentication methods are controlled per remote access policy profile, so unchecking PAP in the dial-up policy leaves L2TP/IPSec policies untouched.
Question 6: You want Windows Server 2003 to automatically register its A and PTR records in DNS. The DNS zone does not allow unauthenticated dynamic updates. What must be true for dynamic registration to succeed?
- The server must be joined to the domain and the zone must accept secure-only dynamic updates with the computer account having write permission (Correct answer)
- The DHCP server must perform proxy registration on behalf of all clients
- The DNS server must also be the PDC Emulator in the domain
- The zone must be a standard primary zone stored in a flat file
Correct answer: The server must be joined to the domain and the zone must accept secure-only dynamic updates with the computer account having write permission
Secure dynamic updates require the computer to be domain-joined; its machine account authenticates via Kerberos to write records in the AD-integrated zone.
Question 7: A Windows Server 2003 network uses both WINS and DNS. A client queries DNS for a host named 'fileserver' and gets NXDOMAIN, but WINS resolves it correctly. What DNS configuration allows DNS to fall back to WINS for unresolved single-label names?
- Enable WINS lookup on the DNS zone's WINS tab by specifying the WINS server IP (Correct answer)
- Add a CNAME record in DNS pointing 'fileserver' to its WINS-registered name
- Configure the DNS suffix devolution policy on client computers
- Create a stub zone for the NetBIOS domain namespace
Correct answer: Enable WINS lookup on the DNS zone's WINS tab by specifying the WINS server IP
The WINS tab on a DNS forward lookup zone enables DNS-to-WINS integration, causing the DNS server to query WINS when a name is not found in DNS.
MCSE Microsoft MCSE: 70-291 5
You need to delegate administrative control of a specific DNS zone to a junior administrator without giving them rights to other zones or the DNS server configuration.
What is the correct approach?