MCTS - Microsoft Certified Technology Specialist Windows Server 2008 Active Directory Questions and Answers 1 — Questions and Answers
Question 1: An administrator needs to implement different password policies for executives and standard users within the same Active-Directory domain. The current domain functional level is Windows Server 2003. What is the minimum domain functional level required to implement this feature?
- Windows Server 2008 (Correct answer)
- Windows Server 2003 Native
- Windows Server 2008 R2
- Windows Server 2012
Correct answer: Windows Server 2008
To use Fine-Grained Password Policies (FGPP), which allow for multiple password and account lockout policies within a single domain, the domain functional level must be at least Windows Server 2008.
Question 2: A company wants to deploy a domain controller in a branch office with low physical security. The administrator is concerned about the potential theft of the server and the compromise of all domain credentials. Which Windows Server 2008 feature should be implemented to mitigate this risk?
- BitLocker Drive Encryption on a standard Domain Controller
- Read-Only Domain Controller (RODC) (Correct answer)
- Active Directory Federation Services (AD FS)
- A Backup Domain Controller (BDC)
Correct answer: Read-Only Domain Controller (RODC)
A Read-Only Domain Controller (RODC) is designed for scenarios like branch offices where physical security is a concern. By default, an RODC does not cache user passwords, minimizing the security risk if the server is compromised. It hosts a read-only copy of the Active Directory database.
Question 3: An administrator accidentally deleted an entire Organizational Unit (OU) containing several user accounts. They want to restore the objects with all their attributes and group memberships intact. Which of the following features, first available in Windows Server 2008 R2, must be enabled BEFORE the deletion occurs to allow for this type of recovery?
- Authoritative Restore from a System State backup
- Tombstone Reanimation
- Active Directory Recycle Bin (Correct answer)
- Restartable Active Directory Domain Services
Correct answer: Active Directory Recycle Bin
The Active Directory Recycle Bin, when enabled, preserves all attributes of deleted objects, allowing for a complete restoration. To enable this feature, the forest functional level must be at least Windows Server 2008 R2. Standard tombstone reanimation does not preserve all attributes like group memberships.
Question 4: You are performing maintenance on a Windows Server 2008 domain controller that also runs other critical services. You need to perform an offline defragmentation of the Active Directory database (Ntds.dit). Which feature allows you to take Active Directory offline without rebooting the entire server?
- Directory Services Restore Mode (DSRM)
- Active Directory Snapshots
- Detached Database Mounting
- Restartable Active Directory Domain Services (Correct answer)
Correct answer: Restartable Active Directory Domain Services
Restartable Active Directory Domain Services (AD DS) is a feature new to Windows Server 2008 that allows an administrator to stop and start the AD DS service without rebooting the domain controller. This is useful for performing offline maintenance tasks like defragmentation while other services on the server remain available. While DSRM also takes AD DS offline, it requires a full server reboot into a special safe mode.
Question 5: To which of the following can a Fine-Grained Password Policy (FGPP) be directly applied in a Windows Server 2008 environment?
- Organizational Units (OUs)
- Domain Local Groups
- Global Security Groups and User Objects (Correct answer)
- Computer Objects
Correct answer: Global Security Groups and User Objects
Fine-Grained Password Policies can only be applied directly to user objects and global security groups. They cannot be applied directly to Organizational Units (OUs).
Question 6: A network administrator is deploying the first Read-Only Domain Controller (RODC) into an existing Active Directory forest. What is a key prerequisite for the replication to function correctly?
- The forest functional level must be Windows Server 2008.
- The RODC must hold the PDC Emulator FSMO role.
- There must be at least one writable Windows Server 2008 (or later) domain controller in the domain. (Correct answer)
- All domain controllers in the forest must be running Windows Server 2008.
Correct answer: There must be at least one writable Windows Server 2008 (or later) domain controller in the domain.
An RODC performs only inbound replication and must replicate from a writable domain controller. This writable replication partner must be running at least Windows Server 2008 to handle the specific replication requirements of an RODC.
MCTS - Microsoft Certified Technology Specialist Windows Server 2008 Active Directory Questions and Answers 1
An administrator needs to implement different password policies for executives and standard users within the same Active-Directory domain.
The current domain functional level is Windows Server 2003.
What is the minimum domain functional level required to implement this feature?