MCTS 70-642 Research & Evidence-Based Practice 5 — Questions and Answers
Question 1: When researching unexplained IP address conflicts on a Windows Server 2008 network, which DHCP server feature generates logged evidence of detected conflicts?
- Conflict detection attempts configured to 1 or more (Correct answer)
- DHCP reconciliation
- DNS dynamic update credentials
- Scope superscope configuration
Correct answer: Conflict detection attempts configured to 1 or more
Enabling DHCP conflict detection causes the server to ping addresses before leasing them and log any conflicts detected, providing evidence of address conflicts.
Question 2: An engineer needs to verify that a Windows Server 2008 DNS server is using forwarders and not root hints for external resolution. Which DNS server property tab provides this evidence?
- Root Hints tab
- Forwarders tab showing configured forwarder IP addresses (Correct answer)
- Advanced tab showing recursion settings
- Interfaces tab
Correct answer: Forwarders tab showing configured forwarder IP addresses
The Forwarders tab displays configured forwarder IP addresses; if forwarders are listed and 'Use root hints if no forwarders are available' is unchecked, forwarding is enforced.
Question 3: A research-oriented network audit requires verifying that IPsec policies are applied consistently across multiple servers. Which tool provides centralized evidence of policy application?
- Local Security Policy on each server
- Group Policy Results (gpresult) showing applied IPsec policy (Correct answer)
- netsh ipsec static show all on each server
- Windows Firewall properties on each server
Correct answer: Group Policy Results (gpresult) showing applied IPsec policy
Running gpresult on each server shows which Group Policy Objects applied, including IPsec policies, providing centralized evidence of consistent policy deployment.
Question 4: Which Windows Server 2008 command-line tool provides evidence of all established, listening, and time-wait TCP connections along with their associated process IDs?
- netstat -ano (Correct answer)
- nbtstat -a
- ipconfig /all
- arp -a
Correct answer: netstat -ano
The 'netstat -ano' command displays all TCP/UDP connections with their state and the owning process ID, enabling identification of which processes hold connections.
Question 5: To provide evidence that a Windows Server 2008 system is receiving time synchronization from a reliable NTP source, which command should be run?
- net time /querysntp
- w32tm /query /status (Correct answer)
- ipconfig /all
- systeminfo | find "Time"
Correct answer: w32tm /query /status
The 'w32tm /query /status' command displays the current time source, leap indicator, stratum, and synchronization state, providing evidence of NTP operation.
Question 6: A network policy requires that only authenticated computers receive DHCP leases. Which combined technology provides cryptographic evidence of machine identity during the DHCP process?
- DHCP MAC address filtering
- NAP with 802.1X enforcement and machine certificates (Correct answer)
- DHCP user class options
- DHCP vendor class filtering
Correct answer: NAP with 802.1X enforcement and machine certificates
NAP with 802.1X enforcement requires machine certificates for authentication before network access is granted, providing cryptographic identity evidence at the port level.
Question 7: When documenting evidence that a Windows Server 2008 DNS zone is Active Directory-integrated, which DNS console indicator confirms this configuration?
- The zone type displays 'Primary' in the zone properties
- The zone type displays 'Active Directory-Integrated' and replication scope is shown (Correct answer)
- The zone has SOA and NS records present
- The zone file exists in C:\Windows\System32\dns\
Correct answer: The zone type displays 'Active Directory-Integrated' and replication scope is shown
An Active Directory-integrated zone shows its type as 'Active Directory-Integrated' in DNS Manager and displays the replication scope, confirming data is stored in AD rather than a flat file.
MCTS 70-642 Research & Evidence-Based Practice 5
When researching unexplained IP address conflicts on a Windows Server 2008 network, which DHCP server feature generates logged evidence of detected conflicts?