Case Studies & Practical Application Flashcards

Consolidated Messenger is migrating from Windows Server 2003 to Windows Server 2008 R2. After raising the domain functional level, administrators notice that fine-grained password policies still cannot be configured. What is the likely cause?

Answer: The domain functional level must be Windows Server 2008 or higher

Fine-Grained Password Policies require a minimum domain functional level of Windows Server 2008.

Wide World Importers has a single forest with three domains. They want a user in the child domain to manage GPOs linked to the parent domain root. What is the minimum group membership required?

Answer: Group Policy Creator Owners in the parent domain

Group Policy Creator Owners members can create and manage GPOs in a domain without being full Domain Admins.

An RODC at a branch office of Proseware Inc. is caching credentials. An attacker steals the RODC. What action should the administrator take immediately?

Answer: Reset passwords for all users whose credentials were cached on the RODC

Resetting passwords for cached accounts invalidates any stolen credentials the attacker may extract from the RODC's local database.

Alpine Ski House needs to audit all successful and failed logon attempts for privileged accounts. Which Group Policy node contains the relevant settings?

Answer: Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Logon auditing settings are under Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.

Tailspin Toys has a universal group containing users from multiple domains. When a user is added to the group, global catalog replication traffic spikes. What can reduce this replication overhead?

Answer: Use domain local groups to nest users and add the domain local group to the universal group

Nesting domain local groups (which don't replicate to the GC) inside the universal group means individual member changes don't trigger GC replication.

Margie's Travel needs to redirect all domain users' Documents folders to a file server share. The policy should apply only to computers running Windows 7 or later. What is the correct mechanism?

Answer: Folder Redirection in User Configuration with a WMI filter targeting Windows 7+

Folder Redirection is configured under User Configuration, and WMI filters allow targeting by OS version.

Datum Corporation's AD environment has grown to 50 sites. Administrators notice that KCC-generated replication topology creates too many direct connections. What should be implemented to optimize this?

Answer: Manually configure preferred bridgehead servers for each site

Defining preferred bridgehead servers gives administrators control over which DCs handle inter-site replication, optimizing traffic flow.