Objective 4.2 Questions | MCSA/MCSE Self-Paced Training Kit (Exam 70-299): Implementing and Administering Security in a MicrosoftВ® Windows Server(TM) 2003 Network (Pro-Certification)

< Day Day Up >

Tailspin Toys is migrating from a Windows NT 4.0 network to a Windows Server 2003 network. Windows NT 4.0 backup domain controllers (BDCs) are gradually being replaced by Windows Server 2003 domain controllers on a site-by-site basis. There are three domains in the Tailspin Toys forest. These domains are named west.tailspintoys.com, east.tailspintoys.com, and central.tailspintoys.com. The west.tailspintoys.com domain is the forest root domain. There are no servers running Windows 2000 in the Tailspin Toys forest. Only users from one domain—west.tailspintoys.com— authenticate completely against computers running Windows Server 2003. The other domains still have some Windows NT 4.0 BDCs. Each domain is running at its highest possible functional level. You are configuring a group strategy for the Tailspin Toys forest. Which of the following statements are true?

All domains in the forest can use domain local groups.
All domains in the forest can use global groups.
All domains in the forest can use universal groups.
A global group in the central.tailspintoys.com domain can have a global group in the east.tailspintoys.com as a member.
A universal group running in the west.tailspintoys.com domain can have members from the central.tailspintoys.com and east.tailspintoys.com domains.

A forest trust relationship exists between the science.internal and the arts.internal forests. The administrator of the philosophy.arts.internal domain wants to give certain users from the mathematics.science.internal and the physics.science.internal domains access to certain domain resources. This access will be mediated through membership of groups. Which of the following methods could the administrator of the philosophy.arts.internal domain use to configure this access while using the least possible number of groups?

Create a global group in the philosophy.arts.internal domain. Then add the individual accounts that should be given access from the mathematics.science.internal and physics.science.internal domains to this global group. Finally, use this global group to apply the required permissions to the appropriate domain resources.
Create a universal group in the philosophy.arts.internal domain. Ask the administrators of the mathematics.science.internal and physics.science.internal domains to add the required user accounts to universal groups in each respective science.internal domain. Add the universal groups from the mathematics.science.internal and physics.science.internal domains to the universal group created in the philosophy.arts.internal domain. Apply the required permissions for the resource to this universal group.
Create a global group in the mathematics.science.internal domain. Add the appropriate users from this domain to this group. Create a global group in the physics.science.internal domain. Add the appropriate users from this domain to this group. Create a domain local group in the philosophy.arts.internal domain. Add the global groups that you created to the domain local group in the philosophy.arts.internal domain. Apply the required permissions for the resource to this domain local group.
Create a domain local group in the philosophy.arts.internal domain. Ask the administrators of the mathematics.science.internal and physics.science.internal domains to add the required user accounts from each respective science.internal domain to a universal group located in the mathematics.science.internal domain. Add the universal group from the mathematics.science.internal domain to the domain local group created in the philosophy.arts.internal domain. Apply the required permissions for the resource to this domain local group.

You are the network administrator at a university. The university has a disparate set of departments, each of which has instituted its own Active Directory infrastructure. Three departments—law, science, and arts—have configured trust relationships between their domains. The Law forest is at Windows Server 2003 functional level. The Science forest is at Windows 2000 native functional level. The Arts forest is at Windows 2000 mixed functional level. External trusts exist between the root domain of the Law forest and the root domain of the Science forest, between the root domain of the Science forest and the root domain of the Arts forest, and between the root domain of the Arts forest and the root domain of the Law forest. You are configuring a domain local group in the root domain of the Law forest. Which of the following groups can you add to this group?

A universal group from a child domain of the Law forest
A global group from the root domain of the Arts forest
A universal group from a child domain of the Science forest
A domain local group from a child domain of the Arts forest
A domain local group from a child domain of the Law forest

A. Datum Corporation has an Active Directory forest that contains three trees. The root of the first tree is adatum.com, the root of the second tree is proseware.com, and the root of the third tree is contoso.com. Each domain in the forest uses a combination of Windows Server 2003 and Windows 2000 Server domain controllers. There are no Windows NT 4.0 domain controllers present. If the domains and the forest are configured to the highest functional level possible while maintaining the Windows 2000 Server domain controllers, which of the following statements would be correct? (Select all that apply.)

A domain local group created in the western.adatum.com domain can include a universal group from the southern.contoso.com domain in its membership.
A universal group created in the northern.proseware.com domain can include domain local groups from the southern.proseware.com and western.proseware.com domains in its membership.
A global group created in the southern.contoso.com domain can include global groups from the northern.proseware.com and eastern.adatum.com domains in its membership.
A global group created in the eastern.adatum.com domain can include a universal group from the proseware.com domain in its membership.
A universal group created in the western.proseware.com domain can include universal groups from the southern.adatum.com and northern.contoso.com domains in its membership.

Rooslan is the systems administrator for A. Datum Corporation. The company’s network infrastructure has a forest configured at the Windows Server 2003 functional level. The forest has two separate domain trees. The root domain of the first domain tree and the forest is adatum.com. The root domain of the second domain tree is proseware.com. The adatum.com tree contains five domains and the proseware.com tree contains three domains.

There are several users in the A. Datum Corporation organization who have exceptional systems administration skills. Unfortunately, the accounts of these users are located in different domains. The users and their domains are listed in the following table.

User	Domain
Rooslan	adatum.com
Oksana	western.adatum.com
Mick	eastern.adatum.com
Agim	western.proseware.com
Kasia	northern.proseware.com
Shan	southern.adatum.com

Rooslan is in the process of configuring a strategy for the implementation of groups.

He has the following goals:

Primary goal: Create a single group whose membership includes all of these users.

First secondary goal: Grant administrator permissions to these users on all member servers in all domains, except for the root domains adatum.com and proseware.com.

Second secondary goal: No other users, except for the ones in this list, should be able to become members of the sysadmins group.

Rooslan plans to do the following:

Add each of the users in the list to a universal group in the adatum.com domain named sysadmins.
Add the sysadmins group to the local administrator group on each member server in all domains, except for the adatum.com and proseware.com domains.
Which goals will Rooslan accomplish with this plan?

Rooslan’s plan accomplishes the primary goal and both secondary goals.
Rooslan’s plan accomplishes the primary goal and one secondary goal.
Rooslan’s plan accomplishes only the primary goal.
Rooslan’s plan does not accomplish the primary goal; however, it does accomplish both secondary goals.
Rooslan’s plan accomplishes only one of the secondary goals. It does not accomplish the primary goal.
Rooslan’s plan accomplishes none of his goals.

Answers

1.	Correct Answers: A, B, and E Correct Of the listed domains, only west.tailspintoys.com domain will be running at the Windows Server 2003 functional level. The east.tailspintoys.com and central.tailspintoys.com domains are most likely running in either Windows Server 2003 interim or Windows 2000 mixed mode, because both of these modes support Windows NT 4.0 BDCs. Domain local groups can be used in all domain functional levels. Correct Of the listed domains, only west.tailspintoys.com domain will be running at the Windows Server 2003 functional level. The east.tailspintoys.com and central.tailspintoys.com domains are most likely running in either Windows Server 2003 interim or Windows 2000 mixed mode, because both of these modes support Windows NT 4.0 BDCs. Global groups can be used at all domain functional levels. Incorrect Of the listed domains, only west.tailspintoys.com domain will be running at the Windows Server 2003 functional level. The east.tailspintoys.com and central.tailspintoys.com domains are most likely running in either Windows Server 2003 interim or Windows 2000 mixed mode, because both of these modes support Windows NT 4.0 BDCs. Universal groups can only be used at the Windows 2000 native or Windows Server 2003 functional level, so only the west.tailspintoys.com domain can use such a group. Incorrect Of the listed domains, only west.tailspintoys.com domain will be running at the Windows Server 2003 functional level. The east.tailspintoys.com and central.tailspintoys.com domains are most likely running in either Windows Server 2003 interim or Windows 2000 mixed mode, because both of these modes support Windows NT 4.0 BDCs. Global groups can only contain other global groups as members if the domain is running at the Windows 2000 native or Windows Server 2003 functional level. Correct Of the listed domains, only west.tailspintoys.com domain will be running at the Windows Server 2003 functional level. The east.tailspintoys.com and central.tailspintoys.com domains are most likely running in either Windows Server 2003 interim or Windows 2000 mixed mode, because both of these modes support Windows NT 4.0 BDCs. Global groups can only contain other global groups as members if the domain is running at the Windows 2000 native or Windows Server 2003 functional level. Even though the east.tailspintoys.com and central.tailspintoys.com domains are not running at the Windows Server 2003 functional level, user accounts from these domains can be added to a universal group in the west.tailspintoys.com domain.
2.	Correct Answers: D Incorrect Global groups cannot have users from trusted domains as members. Only users, computers, and global groups from the domain in which the global group is created can be added to a global group. Incorrect Universal groups from one forest cannot include universal groups from another forest as members. Incorrect Although this method would work, it does not use the least possible number of groups. A universal group could be created in the physics.science.internal or mathematics.science.internal domain, and the requisite users from the science.internal forest could be added to this universal group. This universal group could in turn be added to a domain local group in the philosophy.arts.internal domain. After this was done, the appropriate permissions could be applied. Correct This method achieves the goals and uses the least possible number of groups.
3.	Correct Answers: A and B Correct Universal groups from the same domain can be added to domain local groups. Correct A global group from the root domain of a trusted domain can be added to a domain local group in the root domain of the Law forest. Incorrect Because forest trusts have not been configured, universal groups from child domains in the Science forest will not be visible to the root domain of the Law forest. Incorrect Even if a forest trust were configured, under no circumstances can domain local groups from remote domains be added to domain local groups. Incorrect Under no circumstances can domain local groups from remote domains be added to domain local groups.
4.	Correct Answers: A and E Correct Domain local groups can include universal groups from the same forest. Incorrect Domain local groups cannot be members of universal groups. Incorrect Global groups can only have global groups, users, and computers from the same domain as members. Global and universal groups from other domains in a forest cannot be members of a global group. Incorrect Global groups can only have global groups, users, and computers from the same domain as members. Global and universal groups from other domains in a forest cannot be members of a global group. Correct Universal groups can have other universal groups from within the forest as members.
5.	Correct Answers: B Incorrect Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished. Correct Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished. Incorrect Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished. Incorrect Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished. Incorrect Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished. Incorrect Universal groups are visible in all domains in a forest configured at the Windows Server 2003 functional level. Universal groups can be added to computer local groups, such as the administrators groups on member servers. Universal groups can have members from any domain in the forest. Rooslan’s first action accomplishes the primary goal. Rooslan’s second action accomplishes the first secondary goal. Because Rooslan institutes no restricted Group Policy, the second secondary goal is not accomplished.

< Day Day Up >