MCTS 70-640 Technology & Digital Applications 3 — Questions and Answers
Question 1: What is the primary function of Active Directory Federation Services (AD FS) in Windows Server 2008?
- Replicating AD DS data between forests
- Providing single sign-on access to applications across organizational boundaries (Correct answer)
- Managing Group Policy for remote users
- Synchronizing passwords between on-premises AD and LDAP directories
Correct answer: Providing single sign-on access to applications across organizational boundaries
AD FS enables federated identity, allowing users to authenticate once and access resources in partner organizations or web applications using claims-based identity.
Question 2: In AD FS terminology, what is the role of a 'claims provider'?
- The application that consumes the identity token
- The organization that authenticates the user and issues claims (Correct answer)
- The server that stores the AD FS configuration database
- The proxy server that publishes AD FS to the internet
Correct answer: The organization that authenticates the user and issues claims
A claims provider authenticates users and issues security tokens containing claims (attributes) about those users.
Question 3: What is the purpose of AD Rights Management Services (AD RMS) in an enterprise environment?
- Controlling NTFS file permissions on shared folders
- Protecting sensitive documents and email by enforcing usage policies regardless of location (Correct answer)
- Encrypting hard drives using BitLocker integration
- Managing software license compliance for installed applications
Correct answer: Protecting sensitive documents and email by enforcing usage policies regardless of location
AD RMS uses encryption and usage policies to protect documents and email so that access restrictions persist even when content is moved or forwarded.
Question 4: Which AD RMS component issues end-user licenses that allow a specific user to access rights-protected content?
- Rights Account Certificate (RAC) server
- Licensing server
- Root Cluster (Correct answer)
- Enrollment server
Correct answer: Root Cluster
The AD RMS Root Cluster (and subordinate licensing clusters) issue use licenses that grant specific users rights to decrypt and use protected content.
Question 5: An AD FS deployment requires a server that accepts authentication requests from external users on behalf of the internal AD FS server. Which component fulfills this role?
- AD FS Claims Provider Trust
- Federation Service Proxy (Correct answer)
- AD FS Resource Partner server
- Attribute Store connector
Correct answer: Federation Service Proxy
The Federation Service Proxy sits in the DMZ and forwards authentication requests from external clients to the internal Federation Service.
Question 6: What is a 'super users group' in AD RMS, and why is it important?
- A group that can publish rights-protected content to all users
- A group whose members have full owner rights to all protected content, enabling recovery (Correct answer)
- A group that manages AD RMS cluster configuration
- A group exempted from AD RMS licensing requirements
Correct answer: A group whose members have full owner rights to all protected content, enabling recovery
Members of the AD RMS super users group receive full control over all protected content, which is critical for eDiscovery, compliance, and content recovery.
Question 7: In AD FS, what is a 'relying party trust'?
- A trust between two AD forests for Kerberos authentication
- A configuration entry representing an application or partner that accepts claims from the Federation Service (Correct answer)
- A certificate trust used to validate the AD FS SSL certificate
- A Kerberos delegation setting for AD FS service accounts
Correct answer: A configuration entry representing an application or partner that accepts claims from the Federation Service
A relying party trust defines the application or partner organization that will consume tokens issued by the AD FS Federation Service.
MCTS 70-640 Technology & Digital Applications 3
What is the primary function of Active Directory Federation Services (AD FS) in Windows Server 2008?