MCTS 70-642 Case Studies & Practical Application 2 — Questions and Answers
Question 1: A company's branch office connects to headquarters via a site-to-site VPN. Users report intermittent connectivity failures every few hours. The VPN tunnel re-establishes automatically after a few minutes. What is the most likely cause?
- IKE Phase 1 lifetime mismatch between endpoints (Correct answer)
- Incorrect pre-shared key configured on branch router
- DNS suffix search order misconfiguration
- Branch office default gateway pointing to wrong IP
Correct answer: IKE Phase 1 lifetime mismatch between endpoints
IKE SA lifetime mismatches cause tunnels to drop and renegotiate at unpredictable intervals when one side expires before the other.
Question 2: An administrator needs to ensure that DHCP leases from a rogue DHCP server cannot reach clients on a specific VLAN. Which switch feature should be enabled?
- Port security with MAC address filtering
- DHCP snooping on the VLAN (Correct answer)
- Dynamic ARP inspection on all ports
- 802.1X authentication on client ports
Correct answer: DHCP snooping on the VLAN
DHCP snooping drops DHCP offers from untrusted ports, preventing rogue DHCP servers from assigning addresses to clients.
Question 3: A Windows Server 2008 R2 DNS server is authoritative for contoso.com. External clients cannot resolve names in contoso.com, but internal clients can. The firewall allows UDP/TCP port 53. What should the administrator check next?
- Whether the zone is configured as Active Directory-integrated
- Whether the zone allows zone transfers to the external DNS server (Correct answer)
- Whether the SOA record TTL is set too low
- Whether forwarders are configured on the internal DNS server
Correct answer: Whether the zone allows zone transfers to the external DNS server
If zone transfers are not permitted to the external/secondary DNS server, external clients querying that server receive NXDOMAIN responses.
Question 4: After enabling IPv6 on a Windows Server 2008 R2 network, administrators notice that link-local addresses are assigned but global unicast addresses are not. DHCPv6 is not in use. What is missing?
- A DHCPv6 scope on the DHCP server
- Router Advertisement messages with the M flag set
- Router Advertisement messages with a valid prefix (Correct answer)
- An IPv6 default gateway configured on each host
Correct answer: Router Advertisement messages with a valid prefix
SLAAC requires Router Advertisement messages containing a valid /64 prefix so hosts can generate their global unicast addresses.
Question 5: A company uses Network Policy Server (NPS) for RADIUS authentication of VPN clients. A new user group must be denied VPN access on weekends. How should the administrator accomplish this?
- Create a new network policy with a day-and-time restriction and set access to Deny (Correct answer)
- Modify the Remote Access Policy to include a time-of-day condition
- Disable the user accounts in Active Directory on Fridays via a scheduled task
- Configure a connection request policy that blocks weekend authentication
Correct answer: Create a new network policy with a day-and-time restriction and set access to Deny
NPS network policies support day-and-time conditions; setting the policy to Deny during weekend hours blocks VPN access for the targeted group.
Question 6: An administrator configures a Windows Server 2008 R2 server as a NAP enforcement point using DHCP enforcement. Noncompliant computers receive a restricted IP address. Compliant computers continue to receive invalid restricted addresses. What is the most likely cause?
- The NAP enforcement client is not enabled on compliant computers (Correct answer)
- The DHCP server does not have a health certificate installed
- The NAP health policy server is unreachable
- The DHCP scope does not have a default gateway configured
Correct answer: The NAP enforcement client is not enabled on compliant computers
DHCP NAP enforcement requires the NAP enforcement client (EC) to be enabled on client machines; without it, the client cannot report health status and is treated as noncompliant.
Question 7: A Windows Server 2008 R2 file server hosts DFS namespace \\contoso\shared. After a DFS namespace server failure, clients cannot access the namespace even though data is replicated to a second server. What must be configured to provide failover?
- DFS Replication with full mesh topology
- Multiple namespace servers hosting the same namespace root (Correct answer)
- A second DFS namespace with an identical path
- DNS round-robin for the namespace server hostname
Correct answer: Multiple namespace servers hosting the same namespace root
Adding multiple namespace servers to the same DFS namespace root provides failover so clients can connect to an alternate server when one fails.
MCTS 70-642 Case Studies & Practical Application 2
A company's branch office connects to headquarters via a site-to-site VPN.
Users report intermittent connectivity failures every few hours.
The VPN tunnel re-establishes automatically after a few minutes.
What is the most likely cause?