MCTS 70-642 Case Studies & Practical Application 3 — Questions and Answers
Question 1: A company migrates from a single-site to a multi-site SSTP VPN deployment. Remote clients connecting to the secondary site receive Certificate warnings. The primary site works correctly. What is the most likely cause?
- The secondary VPN server's certificate CN does not match its external FQDN (Correct answer)
- SSTP port 443 is blocked at the secondary site firewall
- The CRL distribution point is unreachable from the secondary site
- The remote clients do not trust the issuing CA for the secondary server
Correct answer: The secondary VPN server's certificate CN does not match its external FQDN
SSTP validates that the server certificate's CN or SAN matches the DNS name clients use to connect; a mismatch triggers certificate warnings.
Question 2: Clients on a Windows Server 2008 R2 network obtain IP addresses via DHCP but cannot reach hosts on remote subnets. All clients have valid IP addresses, subnet masks, and default gateways. What should the administrator verify on the DHCP server?
- That DHCP option 003 (Router) is configured with the correct gateway IP (Correct answer)
- That the DHCP lease duration is set to at least 8 days
- That the DHCP server has a static IP address
- That superscopes are configured for all subnets
Correct answer: That DHCP option 003 (Router) is configured with the correct gateway IP
DHCP option 003 provides the default gateway; if it is missing or incorrect, clients cannot route traffic beyond their local subnet.
Question 3: After implementing DNSSEC on a Windows Server 2008 R2 DNS zone, some older resolvers report SERVFAIL for queries in that zone. What is the most likely reason?
- The older resolvers do not support EDNS0 extensions required for DNSSEC (Correct answer)
- The DNSSEC key signing key (KSK) has expired
- The DNS server is not configured to return RRSIG records
- The zone's SOA serial number was not incremented after signing
Correct answer: The older resolvers do not support EDNS0 extensions required for DNSSEC
DNSSEC responses are larger than standard DNS responses and require EDNS0 support; resolvers without EDNS0 cannot process the additional records and return SERVFAIL.
Question 4: An administrator must configure Windows Server 2008 R2 to allow only authenticated computers to obtain IP addresses from DHCP. Which feature combination achieves this without third-party software?
- NAP with DHCP enforcement and 802.1X on switches
- DHCP MAC address filtering combined with IPsec policies
- NAP DHCP enforcement with health policies checking domain membership (Correct answer)
- Dynamic ARP inspection combined with DHCP snooping
Correct answer: NAP DHCP enforcement with health policies checking domain membership
NAP DHCP enforcement can use a health policy that checks domain membership, issuing full leases only to computers that pass the health check.
Question 5: A Windows Server 2008 R2 IIS server hosts an HTTPS site. After renewing the SSL certificate, users receive a 'certificate not trusted' error. The old certificate worked fine. What should the administrator check first?
- Whether the new certificate's private key is accessible to IIS
- Whether the intermediate CA certificate is installed in the correct store (Correct answer)
- Whether the SSL binding in IIS is mapped to the new certificate
- Whether the CRL of the new certificate is accessible from the Internet
Correct answer: Whether the intermediate CA certificate is installed in the correct store
If the intermediate CA certificate is missing from the server's Intermediate Certification Authorities store, clients cannot build a trusted chain to the root CA.
Question 6: A routing table on a Windows Server 2008 R2 RRAS server shows a persistent route to 10.2.0.0/16 via interface 1, but traffic to that network fails. Ping to the next-hop gateway succeeds. What is the most likely issue?
- The next-hop gateway does not have a return route to the source subnet (Correct answer)
- The metric for the route is set too high
- The RRAS service needs to be restarted to apply the route
- The route is marked as non-persistent in the routing table
Correct answer: The next-hop gateway does not have a return route to the source subnet
Asymmetric routing occurs when the remote gateway lacks a return path; packets reach the destination but responses cannot return, causing the connection to appear failed.
Question 7: A company deploys Windows Server 2008 R2 with the DNS Server role. The internal zone uses the same name as the company's public domain. External names resolve correctly from the internet but internal clients cannot resolve external names in the same domain. What should be implemented?
- Split-brain DNS with internal zone serving internal records and conditional forwarders for external (Correct answer)
- A secondary zone on the internal DNS server that mirrors the public zone
- Root hints pointing to the public authoritative servers
- A stub zone for the public domain on the internal DNS server
Correct answer: Split-brain DNS with internal zone serving internal records and conditional forwarders for external
Split-brain (split-horizon) DNS allows the internal zone to serve internal-only records while forwarding external queries to public resolvers for names not defined internally.
MCTS 70-642 Case Studies & Practical Application 3
A company migrates from a single-site to a multi-site SSTP VPN deployment.
Remote clients connecting to the secondary site receive Certificate warnings.
The primary site works correctly.
What is the most likely cause?