MCTS 70-642 Microsoft 70-642 5 — Questions and Answers
Question 1: Which statement correctly describes the difference between an authoritative DNS server and a recursive resolver?
- An authoritative server queries other servers on behalf of clients; a recursive resolver holds zone data
- An authoritative server holds definitive zone data; a recursive resolver queries other servers on behalf of clients (Correct answer)
- Both hold zone data but authoritative servers do not cache results
- Recursive resolvers never cache responses
Correct answer: An authoritative server holds definitive zone data; a recursive resolver queries other servers on behalf of clients
An authoritative server is the definitive source for a zone's records, while a recursive resolver queries the DNS hierarchy on behalf of clients and caches results.
Question 2: A VPN client is using L2TP/IPsec to connect to a Windows Server 2008 VPN server. The connection fails with error 789. What is the most likely cause?
- The client firewall is blocking TCP 1723
- The IPsec certificate or pre-shared key is missing or mismatched (Correct answer)
- The VPN server is not running the RRAS service
- The client's DNS suffix is incorrect
Correct answer: The IPsec certificate or pre-shared key is missing or mismatched
Error 789 with L2TP/IPsec typically indicates a failure at the IPsec security association phase, caused by a missing machine certificate or a mismatched pre-shared key.
Question 3: You want to ensure that only domain-joined computers can dynamically register DNS records in an Active Directory-integrated zone. Which setting should you configure?
- Disable dynamic updates
- Allow only secure dynamic updates (Correct answer)
- Allow any dynamic updates
- Enable aging and scavenging
Correct answer: Allow only secure dynamic updates
Setting a zone to 'Allow only secure dynamic updates' restricts DNS registrations to computers that authenticate via Kerberos, effectively limiting updates to domain members.
Question 4: A Network Policy Server (NPS) is configured as a RADIUS proxy. What is the role of a connection request policy on the proxy?
- It authenticates users locally against Active Directory
- It determines which requests are forwarded to remote RADIUS server groups (Correct answer)
- It assigns IP addresses to VPN clients
- It enforces health policies for NAP
Correct answer: It determines which requests are forwarded to remote RADIUS server groups
On an NPS RADIUS proxy, connection request policies match incoming authentication requests and specify which remote RADIUS server group should handle them.
Question 5: You enable DNS aging and scavenging on a Windows Server 2008 DNS server. What is the purpose of the 'no-refresh interval'?
- The period after which stale records are automatically deleted
- The period during which dynamic record refreshes are ignored to reduce replication traffic (Correct answer)
- The time a record is cached by resolvers
- The interval between scavenging runs
Correct answer: The period during which dynamic record refreshes are ignored to reduce replication traffic
The no-refresh interval prevents record timestamp updates during a defined window, reducing unnecessary replication traffic while still keeping the record alive.
Question 6: Which Windows Server 2008 component allows administrators to enforce that client computers use specific DNS servers and cannot override DNS settings via DHCP?
- DHCP scope option 006
- Group Policy DNS client settings (Correct answer)
- WINS configuration
- DNS forwarders
Correct answer: Group Policy DNS client settings
Group Policy can configure DNS client settings (server addresses, suffix search lists) in a way that overrides or locks out user and DHCP changes on domain-joined computers.
Question 7: An administrator needs to configure Windows Server 2008 to act as a NAT router so that a private subnet can access the internet through a single public IP address. Which component provides this capability?
- Windows Firewall with Advanced Security
- ICS (Internet Connection Sharing)
- NAT in RRAS (Correct answer)
- Network Bridge
Correct answer: NAT in RRAS
Network Address Translation (NAT) configured within RRAS provides enterprise-grade NAT routing, translating private addresses to a single public IP for internet access.
MCTS 70-642 Microsoft 70-642 5
Which statement correctly describes the difference between an authoritative DNS server and a recursive resolver?