MCTS 70-642 Microsoft 70 642: Network Infrastructure, Configuring 5 — Questions and Answers
Question 1: Your company uses DirectAccess to provide remote connectivity. Which requirement must be met for DirectAccess to function properly for client computers?
- Clients must run Windows 7 Ultimate or Enterprise (or Windows 8 Enterprise) (Correct answer)
- Clients must have a VPN client installed
- Clients must be on a domain-joined wireless network
- Clients need a smart card for authentication
Correct answer: Clients must run Windows 7 Ultimate or Enterprise (or Windows 8 Enterprise)
DirectAccess requires client computers to run Windows 7 Ultimate or Enterprise (or Windows 8 Enterprise) and be domain-joined for the seamless always-on connectivity to work.
Question 2: An administrator wants to configure a Windows Server 2008 R2 server to act as a router between two subnets. Which feature must be enabled?
- IP forwarding via RRAS or registry (Correct answer)
- Network Bridge
- ICS (Internet Connection Sharing)
- DHCP relay agent
Correct answer: IP forwarding via RRAS or registry
IP routing must be enabled on the server either by installing and configuring RRAS or by enabling IP forwarding via the registry key IPEnableRouter.
Question 3: A user reports they cannot reach a website by name but can ping its IP address. DNS resolution appears broken only for this one user. Which command should you run first on the user's computer?
- ipconfig /flushdns (Correct answer)
- nslookup
- netsh int ip reset
- ping localhost
Correct answer: ipconfig /flushdns
Running 'ipconfig /flushdns' clears the local DNS resolver cache, which may contain a stale or incorrect entry causing resolution to fail for a specific hostname.
Question 4: You deploy Network Access Protection (NAP) with IPSec enforcement. Which component issues health certificates to compliant clients?
- Network Policy Server (NPS)
- Health Registration Authority (HRA) (Correct answer)
- Certification Authority (CA)
- Active Directory Domain Services
Correct answer: Health Registration Authority (HRA)
The Health Registration Authority (HRA) receives health statements from compliant clients and requests health certificates from the CA on their behalf for IPSec-based NAP enforcement.
Question 5: A DHCP server has a scope with a lease duration of 8 days. A client that obtained a lease 4 days ago attempts to renew. To which server does the client first send the renewal request?
- Any available DHCP server via broadcast
- Only the DHCP server that issued the original lease via unicast (Correct answer)
- The closest DHCP server by hop count
- The domain controller
Correct answer: Only the DHCP server that issued the original lease via unicast
At 50% of the lease duration, the client sends a unicast DHCPREQUEST directly to the DHCP server that issued the original lease to attempt renewal.
Question 6: You need to implement a solution that allows administrators to audit and log all outbound web traffic from internal users, including HTTPS traffic. Which Windows Server role or feature provides this capability?
- Network Load Balancing
- Forefront Threat Management Gateway (TMG) or Web Application Proxy (Correct answer)
- Windows Firewall with Advanced Security
- Internet Connection Sharing
Correct answer: Forefront Threat Management Gateway (TMG) or Web Application Proxy
Forefront TMG (or Web Application Proxy in later versions) acts as a proxy and can inspect, log, and filter both HTTP and HTTPS traffic from internal users.
Question 7: You are configuring RRAS on Windows Server 2008 R2 to support L2TP/IPSec VPN connections. Remote clients are failing to connect. You verify the pre-shared key is correct. What else could be preventing connections?
- Port 1723 is not open on the firewall
- The NAT-T IPSec exception registry key is not set on the client or server behind NAT (Correct answer)
- The VPN server does not have a public IP
- PPTP is not enabled
Correct answer: The NAT-T IPSec exception registry key is not set on the client or server behind NAT
L2TP/IPSec behind NAT requires the NAT-Traversal (NAT-T) exception registry key to be set, as by default Windows blocks L2TP/IPSec when both peers are behind NAT.
MCTS 70-642 Microsoft 70 642: Network Infrastructure, Configuring 5
Your company uses DirectAccess to provide remote connectivity.
Which requirement must be met for DirectAccess to function properly for client computers?