MCTS 70-642 Research & Evidence-Based Practice 2 — Questions and Answers
Question 1: A network administrator needs to verify that DNS zone transfers are restricted to authorized secondary servers only. Which DNS zone setting should be configured?
- Allow zone transfers to any server
- Allow zone transfers only to servers listed on the Name Servers tab (Correct answer)
- Disable zone transfers entirely
- Enable DNSSEC on all zones
Correct answer: Allow zone transfers only to servers listed on the Name Servers tab
Restricting zone transfers to servers listed on the Name Servers tab ensures only authorized secondary DNS servers can replicate zone data.
Question 2: When troubleshooting DHCP address exhaustion, which tool provides the most direct evidence of current scope utilization?
- ipconfig /all on a client
- DHCP console showing active leases and scope statistics (Correct answer)
- netstat -a on the DHCP server
- nslookup against the DHCP server
Correct answer: DHCP console showing active leases and scope statistics
The DHCP console displays active lease counts and scope utilization percentages, giving direct evidence of address pool exhaustion.
Question 3: A researcher finds that NAP enforcement is not blocking non-compliant clients on the network. Which log should be examined first to find evidence of enforcement failures?
- System Event Log on the client
- Network Policy Server (NPS) event log (Correct answer)
- DNS debug log
- DHCP audit log
Correct answer: Network Policy Server (NPS) event log
The NPS event log records health validation results and enforcement decisions, making it the primary source for NAP troubleshooting evidence.
Question 4: Which command-line tool produces evidence of the current routing table on a Windows Server 2008 system?
- netstat -r (Correct answer)
- ipconfig /displaydns
- nbtstat -n
- arp -a
Correct answer: netstat -r
The command 'netstat -r' displays the IP routing table, showing all current routes including network destinations, gateways, and interfaces.
Question 5: To research whether a remote VPN client successfully authenticated, which Windows Server 2008 log provides the most authoritative evidence?
- Application event log on the VPN server
- Security event log on the VPN server (Correct answer)
- System event log on the VPN client
- DHCP server audit log
Correct answer: Security event log on the VPN server
The Security event log on the VPN server records authentication success and failure events for remote access connections.
Question 6: A network engineer wants evidence that an IKE security association was established for an IPsec connection. Which command provides this information?
- netsh ipsec static show all
- netsh advfirewall monitor show mmsa (Correct answer)
- netstat -an
- ipconfig /all
Correct answer: netsh advfirewall monitor show mmsa
The 'netsh advfirewall monitor show mmsa' command displays active Main Mode Security Associations, confirming IKE negotiation success.
Question 7: When researching packet loss on a Windows Server 2008 network, which built-in tool generates statistical evidence of round-trip times and packet drop rates?
- tracert
- ping with -n and -l flags
- pathping (Correct answer)
- nslookup
Correct answer: pathping
Pathping combines tracert and ping functionality to collect statistical data on packet loss and latency at each hop over a period of time.
MCTS 70-642 Research & Evidence-Based Practice 2
A network administrator needs to verify that DNS zone transfers are restricted to authorized secondary servers only.
Which DNS zone setting should be configured?