Objective 4.1: Questions

---

1.	You are the administrator of the Active Directory forest for the science department at the local university. You want to create a forest trust relationship with the Active Directory forest for the arts department. All domain controllers in both forests are running Windows Server 2003. All domains in each forest are running at the Windows Server 2003 functional level. When you attempt to create the forest trust relationship, you are only given the option to create an external trust relationship. What do you need to do to create a forest trust relationship between the forests of the arts department and the science department? Forest trust relationships are only available in Windows 2000 forests. You need to install an enterprise root CA in each forest. The first forest needs an enterprise root CA. The second forest needs an enterprise subordinate CA that trusts the enterprise root CA from the first forest. You must raise the forest functional level of both forests to Windows Server 2003.
2.	You are responsible for coordinating the forest trust relationships at the local university. There are seven departments, each of which has its own Windows Server 2003 Active Directory infrastructure. The Medicine, Science and Engineering forests are running at the Windows Server 2003 forest functional level. The Arts, Economics, Law, and Education forests are running at the Windows 2000 functional level. Forest trust relationships exist between Medicine and Science, and between Science and Engineering. External trust relationships exist between the root domains of the following forests: between Arts and Science, between Arts and Economics, between Law and Medicine, between Law and Education, and between Education and Engineering. You have received a telephone call from the Administrator of the Science forest. She asks the following question: If she creates a domain local group in one of the child domains for the Science forest, from which of the other department forests will she be able to add universal groups? How should you answer her question? ArtsIncorrect MedicineCorrect EngineeringCorrect EconomicsIncorrect LawIncorrect EducationIncorrect
3.	There are five accounts that are members of the Domain Admins group in your domain. Because these accounts are sensitive, you want to restrict delegated authentication for these accounts. Which of the following methods could you use to do this? On the General tab of the properties of the Domain Admins group, ensure that the Account Is Sensitive And Cannot Be Delegated check box is checked. Configure the membership of the Domain Admins group by using the restricted groups node of the default domain Group Policy object (GPO). In the Account Policies node of the default domain GPO, add the Domain Admins group to the Restrict Delegated Authentication policy. Use Active Directory Users And Computers to select the user accounts for all five members of the Domain Admins group. Edit the properties of these accounts. On the Account tab in the Account Options section, ensure that the Account Is Sensitive And Cannot Be Delegated check box is selected.
4.	Parsons is the administrator for an Internet Web site that is run by an accounting company. There are particular areas of the Web site that Parsons wants to secure from unauthorized access. Because much of the information stored on the site is confidential, a strong form of authentication is required. The root domain of the accounting company's forest is adatum.com. The Web server is located on the perimeter network in a special child domain named pn.adatum.com. Each user that is to be given access to the confidential area of the site will have a special account created for him within a special child domain called clients.adatum.com. Parsons has the following requirements for the Web site's authentication strategy: Authentication must occur without reference to any third party. Authentication between client and server must not transmit credentials over the Internet without encryption. Authentication must be able to occur through proxy servers and firewalls. Authentication must be as secure as possible, given the constraints of the other conditions. Parsons has made sure that anonymous access has been disabled. Which of the following authentication methods should Parsons use for the accounting company's Web site? .NET Passport authentication Basic authentication Integrated Windows authentication Digest authentication for Windows domain servers
5.	You are planning the rollout of Windows Server 2003 to an environment with a mixed set of clients. The company for which you will be installing Windows Server 2003 has a mixture of computers running Windows NT 4.0 Workstation, notebook computers running Windows Millennium Edition, and computers running Windows 2000 Professional. Which of the following authentication protocols will be used by the computers running Windows NT 4.0 Workstation when they authenticate against a domain controller running Windows Server 2003? NTLM/NTLMv2 SSL/TLS Digest authentication .NET Passport authentication Kerberos v5 authentication

Answers

1.	Correct Answers: D Incorrect Forest trust relationships can only be created if both forests are running at the Windows Server 2003 functional level. Although all of the domains in the example are running at the Windows Server 2003 functional level, and this would enable the forest to be running at this level, unless the level of the forest is explicitly raised, it will stay at the default Windows 2000 functional level. Incorrect Forest trust relationships can exist irrespective of the presence of an enterprise root CA. Forest trust relationships can only be created if both forests are running at the Windows Server 2003 functional level. Although all of the domains in the example are running at the Windows Server 2003 functional level, and this would enable the forest to be running at this level, unless the level of the forest is explicitly raised, it will stay at the default Windows 2000 functional level. Incorrect Forest trust relationships can exist irrespective of the presence of an enterprise root CA. Forest trust relationships can only be created if both forests are running at the Windows Server 2003 functional level. Although all of the domains in the example are running at the Windows Server 2003 functional level, and this would enable the forest to be running at this level, unless the level of the forest is explicitly raised, it will stay at the default Windows 2000 functional level. Correct Forest trust relationships can only be created if both forests are running at the Windows Server 2003 functional level. Although all of the domains in the example are running at the Windows Server 2003 functional level, and this would enable the forest to be running at this level, unless the level of the forest is explicitly raised, it will stay at the default Windows 2000 functional level.
2.	Correct Answers: B and C Incorrect Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust is on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest. Correct Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust occurs on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest. Correct Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust occurs on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest. Incorrect Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust occurs on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest. Incorrect Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust occurs on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest. Incorrect Forest trust relationships are nontransitive. In other words, just because Forest A trusts Forest B, and Forest B trusts Forest C, it does not automatically mean that Forest A trusts Forest C. The difference between a forest trust and an external trust is that an external trust occurs on a domain-to-domain basis. So a child domain of the Science forest will not be able to use an external trust relationship configured between the root domain of the Science forest and the root domain of another forest.
3.	Correct Answers: D Incorrect This option must be set on an account-by-account basis. This is done by editing the account properties, clicking the Accounts tab, and, in the Account Options section, selecting the Account Is Sensitive And Cannot Be Delegated check box. Incorrect This option must be set on an account-by-account basis. This is done by editing the account properties, clicking the Accounts tab, and, in the Account Options section, selecting the Account Is Sensitive And Cannot Be Delegated check box. This cannot be done by using restricted groups. Incorrect This option must be set on an account-by-account basis. There is no Restrict Delegated Authentication policy. To restrict delegated authentication, edit the account properties, click the Accounts tab, and, in the Account Options section, select the Account Is Sensitive And Cannot Be Delegated check box. Correct This option must be set on an account-by-account basis. This is done by editing the account properties, clicking the Accounts tab, and, in the Account Options section, selecting the Account Is Sensitive And Cannot Be Delegated check box.
4.	Correct Answers: D Incorrect .NET Passport authentication occurs with reference to a third party, and hence does not meet Parson's requirements. Incorrect Basic authentication transmits authentication credentials across the network in plaintext format, and hence does not meet Parson's requirements. Incorrect Although Integrated Windows authentication does provide the most secure authentication solution (aside from using digital certificates), it cannot be used over most proxy servers or firewalls. Correct Digest authentication for Windows domain servers transmits credentials by means of an encrypted MD5 hash. It works for trusted domains. Given that pn.adatum.com and clients.adatum.com are members of the same forest, there will be a trust relationship between them. Digest authentication for Windows domain servers also works over proxies and firewalls.
5.	Correct Answers: A Correct Computers running Windows NT 4.0 Workstation do not support the default Kerberos v5 authentication that would be used between a computer running Windows 2000 Professional or Windows XP Professional and a domain controller running Windows Server 2003. Incorrect This authentication protocol is used to authenticate against a Web server running Internet Information Services. It is not used to authenticate domain logons. Incorrect This authentication protocol is used to authenticate against a Web server running Internet Information Services. It is not used to authenticate domain logons. Incorrect This authentication protocol is used to authenticate against a Web server running Internet Information Services. It is not used to authenticate domain logons. Incorrect Computers running Windows NT 4.0 Workstation do not support the default Kerberos v5 authentication that would be used between a computer running Windows 2000 Professional or Windows XP Professional and a domain controller running Windows Server 2003.

---