TS: Windows Server 2008 Network Infrastructure, Configuring (70-642) — Questions and Answers

Question 1: A Windows Server 2008 administrator is asked to identify which assets are most critical to business operations as the first step in a formal risk assessment. What is this initial inventory step called?

Asset identification (Correct answer)
Threat identification
Control gap analysis
Vulnerability scanning

Correct answer: Asset identification

Asset identification is the foundational first step in risk assessment, cataloging all hardware, software, and data assets and their business value.

Question 2: Which Windows Server 2008 server role must be installed to act as a NAP policy server?

Network Policy and Access Services (NPAS) (Correct answer)
Active Directory Certificate Services
Windows Deployment Services
Active Directory Domain Services

Correct answer: Network Policy and Access Services (NPAS)

The Network Policy and Access Services (NPAS) role includes Network Policy Server (NPS), which serves as the NAP health policy server.

Question 3: What DHCP option specifies the DNS server addresses for clients?

Option 51
Option 3
Option 15
Option 6 (Correct answer)

Correct answer: Option 6

DHCP Option 6 (DNS Servers) provides clients with the IP addresses of DNS servers to use for name resolution.

Question 4: When configuring NPS for 802.1X wireless access, which setting in the Network Policy specifies the VLAN that compliant clients are placed in?

The health policy linked to the network policy
The connection request policy routing rules
IP filters in the network policy constraints
RADIUS attributes such as Tunnel-Pvt-Group-ID in the policy settings (Correct answer)

Correct answer: RADIUS attributes such as Tunnel-Pvt-Group-ID in the policy settings

RADIUS attributes including Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Pvt-Group-ID are configured in the NPS network policy to instruct 802.1X-capable switches or APs to place compliant clients in the correct VLAN.

Question 5: A Windows Server 2008 R2 server running the Routing and Remote Access role is configured for demand-dial routing. The demand-dial interface connects successfully but drops after exactly 5 minutes of idle time. How should the administrator fix this?

Add a static route with a lower metric than the demand-dial route
Enable persistent mode on the demand-dial interface
Increase the idle disconnect time on the demand-dial interface (Correct answer)
Change the dial-out credentials on the demand-dial interface

Correct answer: Increase the idle disconnect time on the demand-dial interface

The idle disconnect timer on a demand-dial interface controls how long it stays up with no traffic; increasing this value prevents premature disconnection.

Question 6: There is an Active Directory domain on your network. The domain houses a server named Server1 and an enterprise certification authority (CA) called Server2. You install Network Policy Server (NPS) and set up a network access server on Server 2. Policy for IPSec protection (NAP) enforcement. The lifetime of health certificates can be set to four hours through the Health Registration Authority snap-in on Server2. You learn that the client computers' health certificates have a one-year expiration date. The health certificates must be limited to a four-hour validity period. What ought you to do?

On Server1, run certutil.exe -setreg policy\editflags +editf_attributeenddate. (Correct answer)
Modify the Request Handling settings of the certificate template used for the health certificates.
Modify the Issuance Requirements settings of the certificate template used for the health certificates.
On Server1, run certutil.exe Csetregdbflags +dbflags_enablevolatilerequests.

Correct answer: On Server1, run certutil.exe -setreg policy\editflags +editf_attributeenddate.

To enforce a specific, shorter validity period for health certificates, the Certificate Authority (CA) must be configured to honor the `EndDate` attribute in certificate requests. The `certutil.exe -setreg policy\editflags +editf_attributeenddate` command enables this flag on the CA. This allows the Health Registration Authority (HRA) to specify a four-hour lifetime for NAP health certificates, overriding the default template settings.

Question 7: Which approach best demonstrates professional competency in MCTS 70-642 practice?

Relying solely on initial training
Integrating continuing education, practical experience, and evidence-based decision making (Correct answer)
Following only personal preferences
Avoiding challenging situations

Correct answer: Integrating continuing education, practical experience, and evidence-based decision making

This is fundamental to MCTS 70-642 Exam practice. Integrating continuing education, practical experience, and evidence-based decision making represents the professional standard for professional standards in the MCTS 70-642 certification framework.

Question 8: A company implements NAP with DHCP enforcement on Windows Server 2008 R2. Non-compliant clients receive an IP address but can only reach remediation servers. How is this achieved?

Non-compliant clients receive a public IP with no default gateway
NPS instructs the DHCP server to assign limited routes and a restricted IP to non-compliant clients (Correct answer)
Non-compliant clients are placed in a separate VLAN automatically
Windows Firewall blocks all traffic except to remediation servers on non-compliant clients

Correct answer: NPS instructs the DHCP server to assign limited routes and a restricted IP to non-compliant clients

With DHCP enforcement, NPS signals the DHCP server to assign non-compliant clients a restricted address with routes only to remediation servers.

Question 9: An administrator wants to configure a Windows Server 2008 R2 server to act as a router between two subnets. Which feature must be enabled?

Network Bridge
IP forwarding via RRAS or registry (Correct answer)
DHCP relay agent
ICS (Internet Connection Sharing)

Correct answer: IP forwarding via RRAS or registry

IP routing must be enabled on the server either by installing and configuring RRAS or by enabling IP forwarding via the registry key IPEnableRouter.

Question 10: Which protocol does NAP use to communicate health information between the NAP client and the NPS server over a RADIUS infrastructure?

LDAP over SSL
WMI over DCOM
Statement of Health (SoH) encapsulated in RADIUS attributes (Correct answer)
SNMP

Correct answer: Statement of Health (SoH) encapsulated in RADIUS attributes

NAP uses Statement of Health (SoH) messages encapsulated within RADIUS access-request packets to transmit client health information to the NPS server.

Question 11: An administrator wants to limit which users can manage a shared printer on Windows Server 2008 R2 without giving them local administrator rights. What is the correct approach?

Add the users to the Print Operators group and assign Manage Printers permission
Grant the users Full Control on the print server's C:\Windows\System32\spool folder
Configure the printer's security properties to grant Manage Printers permission to the users (Correct answer)
Add the users to the Server Operators group

Correct answer: Configure the printer's security properties to grant Manage Printers permission to the users

Assigning Manage Printers permission directly in the printer's Security tab gives granular control over a specific printer without requiring group membership.

Question 12: What is a DHCP scope?

A range of IP addresses available for lease to clients (Correct answer)
A static IP reservation for a specific host
A set of DHCP server options
A list of excluded IP addresses

Correct answer: A range of IP addresses available for lease to clients

A DHCP scope defines a contiguous range of IP addresses that the DHCP server can assign to clients on a specific subnet.

Question 13: What command verifies connectivity to a remote host and measures round-trip latency in Windows Server 2008?

ping (Correct answer)
tracert
netstat
pathping

Correct answer: ping

The ping command sends ICMP echo request packets to a destination and measures round-trip time, verifying basic IP connectivity.

Question 14: What Windows Server 2008 DHCP feature allows a single DHCP server to serve multiple subnets by grouping scopes?

Split scope
Multicast scope
Superscope (Correct answer)
DHCP relay

Correct answer: Superscope

A superscope groups multiple scopes together, allowing a single DHCP server to service clients from multiple subnets on the same physical network.

Question 15: A company has multiple branch offices connected via site-to-site VPNs. Administrators need a centralized location to manage all VPN connections. Which Windows Server role should they deploy?

Network Policy Server (NPS)
Network Load Balancing
DirectAccess
Routing and Remote Access Service (RRAS) (Correct answer)

Correct answer: Routing and Remote Access Service (RRAS)

RRAS provides VPN gateway capabilities and can be used to establish and manage site-to-site VPN connections between branch offices.

Question 16: Which NAP component on the client computer collects and reports the client's health status to the server?

NAP Enforcement Client (EC)
System Health Validator (SHV)
Health Registration Authority (HRA)
NAP Agent (Correct answer)

Correct answer: NAP Agent

The NAP Agent service runs on the client and aggregates health data from System Health Agents (SHAs) to report health status to the NAP infrastructure.

Question 17: An administrator needs to prevent a specific computer from ever receiving an IP address from the DHCP server. The computer has a fixed MAC address. What is the most direct method using Windows Server 2008 R2 DHCP?

Configure a DHCP policy that excludes the MAC address from address assignment
Remove the DHCP client service from the target computer
Add the MAC address to a DHCP filter deny list (Correct answer)
Create a DHCP reservation with the MAC address and assign an IP outside the scope range

Correct answer: Add the MAC address to a DHCP filter deny list

The DHCP server's Allow/Deny filter list can block specific MAC addresses from receiving any IP address from the server.

Question 18: In DHCP, what is the purpose of an exclusion range?

Defines the lease duration
Permanently assigns an IP to a MAC address
Prevents specific IP addresses in the scope from being leased (Correct answer)
Limits the number of leases per client

Correct answer: Prevents specific IP addresses in the scope from being leased

Exclusion ranges prevent specific IP addresses within a scope from being assigned by DHCP, typically used for statically assigned devices.

Question 19: What role does active listening play in MCTS 70-642 Exam practice?

It ensures accurate understanding, demonstrates respect, and improves outcomes (Correct answer)
It means staying silent
It is only for counseling professionals
It wastes time

Correct answer: It ensures accurate understanding, demonstrates respect, and improves outcomes

This is fundamental to MCTS 70-642 Exam practice. It ensures accurate understanding, demonstrates respect, and improves outcomes represents the professional standard for communication in the MCTS 70-642 certification framework.

Question 20: Which VPN protocol in Windows Server 2008 uses SSL/TLS over port 443 and is well-suited for traversing firewalls?

PPTP
L2TP/IPsec
GRE
SSTP (Correct answer)

Correct answer: SSTP

SSTP (Secure Socket Tunneling Protocol) uses HTTPS (port 443) to encapsulate PPP traffic, easily passing through most firewalls and web proxies.

Question 21: What happens to a NAP client in 'monitor only' mode when it fails a health check?

The client receives a warning dialog and must reboot
The client is placed in the quarantine network
The client receives full network access but the non-compliance is logged (Correct answer)
The client is denied all network access immediately

Correct answer: The client receives full network access but the non-compliance is logged

In monitor-only (reporting) mode, non-compliant clients are not restricted; instead, their non-compliance is logged to help administrators assess the environment before enforcing policies.

Question 22: Which authentication protocol for dial-up and VPN in Windows Server 2008 provides mutual authentication and encrypts credentials using MS-CHAPv2?

PAP
CHAP
MS-CHAPv2 (Correct answer)
SPAP

Correct answer: MS-CHAPv2

MS-CHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2) provides mutual authentication between client and server with encrypted credential exchange.

Question 23: When troubleshooting DHCP address exhaustion, which tool provides the most direct evidence of current scope utilization?

ipconfig /all on a client
nslookup against the DHCP server
DHCP console showing active leases and scope statistics (Correct answer)
netstat -a on the DHCP server

Correct answer: DHCP console showing active leases and scope statistics

The DHCP console displays active lease counts and scope utilization percentages, giving direct evidence of address pool exhaustion.

Question 24: You are reviewing QA logs and find that a WINS server is registering stale records. What is the recommended first action to correct this without disrupting active registrations?

Stop and restart the WINS service
Increase the renewal interval
Delete and recreate the WINS database
Run tombstoning on stale records (Correct answer)

Correct answer: Run tombstoning on stale records

Tombstoning marks stale records for deletion and replicates the tombstone state to partner servers, ensuring consistent removal without disrupting active registrations.

Question 25: What is a System Health Validator (SHV) in a NAP deployment?

A network switch that enforces 802.1X policies
A client-side component that generates health certificates
A Group Policy object that configures NAP settings on clients
A server-side component that evaluates the health reports submitted by clients (Correct answer)

Correct answer: A server-side component that evaluates the health reports submitted by clients

An SHV runs on the NPS server and verifies the health state reported by the corresponding System Health Agent (SHA) on the client.

Question 26: A QA engineer must validate that NPS correctly applies different access policies to wired versus wireless 802.1X connections. Which NPS condition attribute differentiates connection type?

NAS-Port-Type (Correct answer)
NAS-Identifier
Framed-Protocol
Called-Station-ID

Correct answer: NAS-Port-Type

The NAS-Port-Type RADIUS attribute specifies the physical port type (Ethernet, wireless IEEE 802.11, etc.), enabling NPS to apply different policies per connection medium.

Question 27: A researcher finds that NAP enforcement is not blocking non-compliant clients on the network. Which log should be examined first to find evidence of enforcement failures?

System Event Log on the client
DHCP audit log
Network Policy Server (NPS) event log (Correct answer)
DNS debug log

Correct answer: Network Policy Server (NPS) event log

The NPS event log records health validation results and enforcement decisions, making it the primary source for NAP troubleshooting evidence.

Question 28: A network administrator needs to evaluate the likelihood and impact of a potential threat to the Windows Server 2008 network infrastructure. Which risk assessment approach quantifies risk using numerical values such as dollar amounts?

Qualitative risk assessment
Residual risk assessment
Hybrid risk assessment
Quantitative risk assessment (Correct answer)

Correct answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical monetary values to assets and risks, enabling calculation of Annual Loss Expectancy (ALE).

Question 29: What NPS feature allows multiple RADIUS clients (such as VPN servers and wireless APs) to send requests to a single NPS server?

RADIUS server groups
NPS proxy chaining
Centralized NPS with RADIUS clients configured on the NPS server (Correct answer)
NPS templates

Correct answer: Centralized NPS with RADIUS clients configured on the NPS server

By configuring each network access server (VPN server, WAP, switch) as a RADIUS client on the central NPS server, all authentication requests can be processed centrally.

Question 30: A NIST 800-53 control requires that the operating system protect audit records from unauthorized deletion. Which Windows Server 2008 setting directly enforces this?

Set 'Audit: Shut down system immediately if unable to log security audits' to Enabled
Restrict event log access permissions so only Administrators can clear logs (Correct answer)
Enable EFS on the Windows\System32\winevt folder
Configure BitLocker on the system volume

Correct answer: Restrict event log access permissions so only Administrators can clear logs

Restricting the Security event log permissions so only administrators can clear it prevents unauthorized deletion or tampering with audit records.

Question 31: When securing a Windows Server 2008 network, which threat modeling approach focuses on categorizing threats by attacker goals such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

DREAD
STRIDE (Correct answer)
PASTA
OCTAVE

Correct answer: STRIDE

STRIDE is Microsoft's threat categorization model that classifies threats into six categories to help identify security risks systematically.

TS: Windows Server 2008 Network Infrastructure, Configuring (70-642)

Validates IT professionals' skills in configuring Windows Server 2008 network infrastructure, including IP addressing, DNS, DHCP, remote access, network protection, and file and print services. Earns the MCTS: Windows Server 2008 Network Infrastructure, Configuring credential.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds