MCSE Microsoft MCSE: 70-293 3 — Questions and Answers
Question 1: Your Windows Server 2003 network uses IPSec policies. You need to ensure that all communication between domain controllers and member servers is encrypted without requiring manual configuration on each server. What is the most efficient approach?
- Deploy an IPSec policy via Group Policy to an OU containing the servers (Correct answer)
- Configure a local IPSec policy on each server individually
- Enable IPSec in the RRAS configuration on all servers
- Create a certificate-based IPSec rule in the Default Domain Policy
Correct answer: Deploy an IPSec policy via Group Policy to an OU containing the servers
Deploying IPSec policy through Group Policy to an Organizational Unit is the most efficient method to consistently apply encryption settings across multiple servers.
Question 2: You configure a demand-dial interface on a Windows Server 2003 RRAS server to connect to a branch office router. The connection triggers successfully but traffic is not routed to the branch network. What is the most likely cause?
- A static route for the branch subnet pointing to the demand-dial interface is missing (Correct answer)
- The demand-dial interface credentials are incorrect
- The calling router does not have a matching demand-dial interface
- The RRAS service needs to be restarted after adding the interface
Correct answer: A static route for the branch subnet pointing to the demand-dial interface is missing
A demand-dial interface requires a corresponding static route that points traffic destined for the remote subnet through that interface.
Question 3: A Windows Server 2003 DNS server is configured with a forwarder pointing to an ISP DNS server. DNS resolution for internal names works, but Internet names fail to resolve. Which setting should you check first?
- Verify the forwarder IP address is correct and the ISP DNS server is reachable (Correct answer)
- Disable the 'Do not use recursion for this domain' option on the forwarder
- Check that the root hints are configured correctly
- Verify the DNS server is not configured as a caching-only server
Correct answer: Verify the forwarder IP address is correct and the ISP DNS server is reachable
If internet name resolution fails, the forwarder IP address being incorrect or unreachable is the most common cause.
Question 4: You need to implement a PKI solution for your Windows Server 2003 domain. The CA must be trusted by external partners who access your web applications. Which CA type should you deploy?
- Standalone root CA with certificates issued by a commercial CA (Correct answer)
- Enterprise root CA installed on a domain controller
- Enterprise subordinate CA chained to an internal root
- Standalone subordinate CA with auto-enrollment enabled
Correct answer: Standalone root CA with certificates issued by a commercial CA
External partners trust certificates from commercial CAs that are already in their trusted root store, so a commercially-signed certificate ensures external trust.
Question 5: You are reviewing DHCP audit logs on a Windows Server 2003 server to investigate an IP address conflict. Which event ID in the DHCP log indicates that the server detected a conflict before leasing an address?
- 15 (Correct answer)
- 10
- 11
- 12
Correct answer: 15
DHCP log event ID 15 is logged when the DHCP server detects an IP address conflict via ping before assigning the lease.
Question 6: Your Windows Server 2003 network has multiple sites connected by slow WAN links. You want DNS clients to preferentially query the DNS server in their local site. How should you configure this?
- Configure the local DNS server as the preferred DNS server on clients via DHCP scope options (Correct answer)
- Enable round-robin DNS on all DNS servers
- Configure subnet prioritization on the DNS server
- Use a single centralized DNS server for all sites
Correct answer: Configure the local DNS server as the preferred DNS server on clients via DHCP scope options
Assigning the local site's DNS server as the preferred server via DHCP scope options ensures clients query local DNS servers first.
Question 7: You need to configure Windows Server 2003 RRAS to assign IP addresses to VPN clients from a specific pool rather than using DHCP. Where do you configure the static address pool?
- RRAS server Properties > IP tab (Correct answer)
- RRAS server Properties > General tab
- Remote Access Policy conditions
- DHCP server scope exclusion range
Correct answer: RRAS server Properties > IP tab
The IP tab of the RRAS server properties dialog allows you to define a static IP address pool that will be assigned to connecting VPN clients.
MCSE Microsoft MCSE: 70-293 3
Your Windows Server 2003 network uses IPSec policies.
You need to ensure that all communication between domain controllers and member servers is encrypted without requiring manual configuration on each server.
What is the most efficient approach?