MCTS 70-642 Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: A technician needs evidence that a Windows Server 2008 DHCP server is dynamically registering DNS records on behalf of clients. Which DHCP setting confirms this behavior is configured?
- Enable DNS dynamic updates according to the settings below, with 'Always dynamically update DNS records' selected (Correct answer)
- Disable DNS dynamic updates
- Enable conflict detection attempts set to 3
- Enable BOOTP table
Correct answer: Enable DNS dynamic updates according to the settings below, with 'Always dynamically update DNS records' selected
Selecting 'Always dynamically update DNS records' in DHCP properties configures the server to register both A and PTR records for clients in DNS.
Question 2: Which Windows Server 2008 feature allows administrators to gather evidence about bandwidth utilization per application on a network interface?
- Performance Monitor with Network Interface counters
- Windows Resource Monitor network tab (Correct answer)
- Reliability Monitor
- Task Manager CPU tab
Correct answer: Windows Resource Monitor network tab
Windows Resource Monitor's Network tab shows per-process and per-connection bandwidth usage, providing application-level network utilization evidence.
Question 3: When investigating a suspected DNS spoofing attack, which DNS feature provides cryptographic evidence of record authenticity?
- DNS forwarders
- DNS stub zones
- DNSSEC with digital signatures (Correct answer)
- DNS scavenging
Correct answer: DNSSEC with digital signatures
DNSSEC adds digital signatures to DNS records, allowing resolvers to verify record authenticity and detect spoofed responses.
Question 4: A network administrator researching wireless client connectivity issues needs evidence of 802.1X authentication attempts. Which log source is most relevant?
- Wireless LAN adapter event log on the client
- NPS server event log showing RADIUS authentication records (Correct answer)
- DNS server debug log
- DHCP server audit log
Correct answer: NPS server event log showing RADIUS authentication records
The NPS event log records all RADIUS authentication attempts including 802.1X wireless authentication successes and failures.
Question 5: To gather baseline evidence of normal DNS query volume before implementing changes, which Windows Server 2008 tool should be used?
- DNS debug logging
- Network Monitor packet capture
- Performance Monitor with DNS counters (Correct answer)
- Event Viewer DNS server log
Correct answer: Performance Monitor with DNS counters
Performance Monitor with DNS object counters tracks query rates, zone transfers, and other DNS metrics over time to establish baseline evidence.
Question 6: Which command provides evidence of whether a specific TCP port on a remote Windows Server 2008 system is open and accepting connections?
- ping <server>
- nslookup <server>
- telnet <server> <port> (Correct answer)
- tracert <server>
Correct answer: telnet <server> <port>
Telnet to a specific host and port number tests TCP connectivity and provides evidence that the port is open and accepting connections.
Question 7: A network team needs documented evidence that RRAS is forwarding packets between two subnets. Which RRAS setting must be verified as enabled?
- Demand-dial routing
- LAN routing enabled in RRAS properties (Correct answer)
- Static IP address pool
- PPTP packet filtering
Correct answer: LAN routing enabled in RRAS properties
LAN routing must be enabled in the RRAS server configuration to allow the server to forward packets between directly connected network segments.
MCTS 70-642 Research & Evidence-Based Practice 3
A technician needs evidence that a Windows Server 2008 DHCP server is dynamically registering DNS records on behalf of clients.
Which DHCP setting confirms this behavior is configured?