MCTS Windows Server 2008 Active Directory 3 — Questions and Answers
Question 1: An administrator needs to delegate control of an OU to a junior admin so they can reset passwords only. What is the best approach?
- Add the junior admin to the Domain Admins group
- Use the Delegation of Control Wizard on the OU (Correct answer)
- Grant the junior admin Schema Admin rights
- Edit the Default Domain Policy GPO
Correct answer: Use the Delegation of Control Wizard on the OU
The Delegation of Control Wizard allows granular permission delegation on OUs without granting broad administrative rights.
Question 2: Which protocol does Active Directory use for directory queries and authentication by default?
- RADIUS
- LDAP (Correct answer)
- SNMP
- FTP
Correct answer: LDAP
Active Directory uses LDAP (Lightweight Directory Access Protocol) on port 389 (or 636 for LDAPS) for directory queries and authentication.
Question 3: What is a 'shortcut trust' in Active Directory used for?
- Creating a trust with an external non-Windows domain
- Speeding up authentication between specific domains in a large forest (Correct answer)
- Allowing users from a workgroup to access domain resources
- Establishing a trust between two separate forests
Correct answer: Speeding up authentication between specific domains in a large forest
Shortcut trusts optimize the authentication path between specific domains within the same forest, reducing traversal through the trust hierarchy.
Question 4: Which Windows Server 2008 feature allows you to install only the Active Directory components needed, without a full GUI, to reduce the attack surface?
- Active Directory Lightweight Directory Services
- Server Core installation (Correct answer)
- Read-Only Domain Controller
- Active Directory Application Mode
Correct answer: Server Core installation
Server Core is a minimal Windows Server 2008 installation option that provides essential server roles without the full GUI, reducing the attack surface.
Question 5: When a Group Policy Object (GPO) is linked to both a site and an OU, and they have conflicting settings, which GPO takes precedence by default?
- Site GPO always wins
- OU GPO takes precedence over site GPO (Correct answer)
- The newer GPO always wins
- The GPO with higher priority number wins
Correct answer: OU GPO takes precedence over site GPO
GPOs are applied in LSDOU order (Local, Site, Domain, OU), so OU-linked GPOs are applied last and override conflicting settings from site or domain GPOs.
Question 6: What is the purpose of the 'Infrastructure Master' FSMO role in Active Directory?
- Manages schema changes across the forest
- Updates cross-domain object references for group memberships (Correct answer)
- Handles RID pool allocation for new accounts
- Controls the authoritative time source for the domain
Correct answer: Updates cross-domain object references for group memberships
The Infrastructure Master updates references to objects in other domains (such as group memberships that span domains) to keep them current.
Question 7: Which utility is used to perform an authoritative restore of Active Directory objects from backup?
- Ntbackup
- Ntdsutil (Correct answer)
- Dcpromo
- Netdom
Correct answer: Ntdsutil
Ntdsutil is used after a non-authoritative restore to mark specific objects as authoritative, ensuring they replicate to all other domain controllers.
MCTS Windows Server 2008 Active Directory 3
An administrator needs to delegate control of an OU to a junior admin so they can reset passwords only.
What is the best approach?