MCTS 70-642 Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: An administrator wants evidence that Windows Firewall with Advanced Security is blocking specific outbound traffic. Which tool provides the most detailed rule-match evidence?
- netsh advfirewall monitor show firewall
- Windows Firewall audit logging with dropped packet logging enabled (Correct answer)
- netstat -b
- ipconfig /all
Correct answer: Windows Firewall audit logging with dropped packet logging enabled
Enabling Windows Firewall audit logging with dropped packet recording creates log entries for each blocked connection, providing rule-match evidence.
Question 2: When researching WINS name resolution failures on a Windows Server 2008 network, which file contains evidence of locally cached NetBIOS name mappings?
- C:\Windows\System32\drivers\etc\hosts
- C:\Windows\System32\drivers\etc\lmhosts (Correct answer)
- C:\Windows\System32\dns\samples\
- C:\Windows\System32\drivers\etc\networks
Correct answer: C:\Windows\System32\drivers\etc\lmhosts
The lmhosts file contains static NetBIOS name-to-IP mappings that can be used as evidence of pre-configured name resolution entries.
Question 3: Which Windows Server 2008 command provides evidence of the current NetBIOS name cache on a workstation, useful for diagnosing name resolution issues?
- ipconfig /displaydns
- nbtstat -c (Correct answer)
- netstat -n
- arp -a
Correct answer: nbtstat -c
The 'nbtstat -c' command displays the current NetBIOS name cache including all recently resolved names and their IP addresses.
Question 4: A security audit requires evidence that all administrative RDP sessions to servers are encrypted. Which Group Policy setting should be verified?
- Set client connection encryption level to High (Correct answer)
- Allow connections only from computers running Remote Desktop with Network Level Authentication
- Set RDP port to a non-standard value
- Disable Remote Desktop Services
Correct answer: Set client connection encryption level to High
Setting the RDP encryption level to High ensures all data transmitted during remote desktop sessions is encrypted with 128-bit encryption.
Question 5: To research the impact of a network change, an administrator compares Performance Monitor baseline data with post-change data. Which counter provides evidence of network saturation?
- Network Interface\Output Queue Length (Correct answer)
- Processor\% Processor Time
- Memory\Available MBytes
- PhysicalDisk\Avg. Disk Queue Length
Correct answer: Network Interface\Output Queue Length
Network Interface Output Queue Length greater than 2 sustained over time provides evidence that the network interface is saturated and cannot keep pace with traffic.
Question 6: Which Windows Server 2008 feature generates automatic evidence reports about network health policy compliance across all managed clients?
- WSUS reports
- Network Policy Server (NAP) with System Health Validators (Correct answer)
- DHCP statistics reports
- DNS aging and scavenging reports
Correct answer: Network Policy Server (NAP) with System Health Validators
NAP with System Health Validators evaluates client compliance with defined health policies and generates enforcement logs that serve as compliance evidence.
Question 7: A network administrator needs evidence that a DHCP server is properly excluding a range of IP addresses from distribution. Where is this configuration verified?
- Under the scope's Address Pool, reviewing Exclusions listed (Correct answer)
- In the DHCP server's IPv4 properties under filters
- In the DHCP audit log file
- In the System event log
Correct answer: Under the scope's Address Pool, reviewing Exclusions listed
Exclusion ranges are listed under the scope's Address Pool node in the DHCP console, where both the distributed range and exclusion ranges are visible.
MCTS 70-642 Research & Evidence-Based Practice 4
An administrator wants evidence that Windows Firewall with Advanced Security is blocking specific outbound traffic.
Which tool provides the most detailed rule-match evidence?