Review Questions

1.	Which of the following are security groups scopes that can be used in a Windows 2003 forest? (Choose all that apply.) Local Domain Local Global Enterprise
2.	Hallie would like to add a Global security group named Central Accounting to another Global security group called Central Administration. She cannot do this. What could be the reason? The domain is not operating at a minimum of Windows 2000 Mixed mode functional level. The domain is not operating at a Windows 2000 Native mode functional level. The Group Nesting option is not enabled in the forest. The Central Accounting group is in domain that is not operating at Windows 2003 functional level.
3.	You would like to create a group in which the users and computers that need access to a resource will be made members . What type of group will you create? User list group Access control list Resource group Account group
4.	What type of group would you create if you want to define access to a new print device on your network? Resource group Account croup Access control group Principal group
5.	You are the network administrator of a small network that consists of about 30 users. You define access to all resources on the network by assigning permissions to the individual users who need access to each resource. What type of resource authorization method does this describe? Role-based authorization method Account group/DACL method (AG/DACL) User/DACL method Account group/Resource group method (AG/RG)
6.	When designing an access control strategy for your network, you define access to printers by groups. You create a group for each printer on your network. When adding new users to your network, you add the user to the Account groups that are needed by that user, then add them to the Printer groups so that they have access to printers without changing the DACL on each individual printer. What type of resource authorization method is this an example of? Role-based authorization method Account group/DACL (AG/DACL) User/DACL method Account group/Resource group (AG/RG)
7.	By default, what security groups have the ability to create security groups and delegate group object permissions? (Choose all that apply.) Domain Admins Enterprise Admins Domain Local Admins Account Operators
8.	Which of the following are group types in Active Directory? (Choose all that apply.) Security User Computer Distribution
9.	When designing the group naming strategy, which of the following criteria should be part of the group name ? (Choose all that apply.) Group purpose Group permission Group scope Group owner
10.	You are naming your groups according to their scope. Which of the following security groups could be used when a domain is in the Windows Server 2003 functional level? (Choose all that apply.) L-Chi-HRFiles DL-Chi-RDPrint G-Miami-MedRecords U-Acct

Answers

1.	A, B, C. Security groups are used to organize user accounts, computer accounts, and other types of accounts into manageable units. Security groups available in Windows 2003 include Local, Domain Local, Global, and Universal.
2.	B. You can only nest Global security groups if your domain is running in a Windows 2000 Native mode or higher forest functional level.
3.	D. An Account group is a security group that contains the User accounts and Computer accounts that have a common access requirement to a resource.
4.	A. A Resource group is a security group that is added to the discretionary access control list for a resource.
5.	C. In a small environment, the account/DACL method of resource authorization is acceptable. In this environment, you define access to a resource by adding individual user accounts to the DACL of a resource.
6.	D. The AG/RG authorization method is often used in large environments to make administration easier. When defining access by Account groups and Resource groups, you can save time by defining access to resources by groups, rather than by adding individual users or groups to the DACL of the resource.
7.	A, B, D. By default, the members of Domain Admins, Enterprise Admins, and Account Operators have the ability to create group objects and delegate group object permissions.
8.	A, D. There are two group types within Active Directory: security and distribution. You should create groups based what the group will be used for. Distribution groups are used for e-mail. An e-mail program such as Microsoft Exchange Server can use distribution groups as distribution lists once they have been mail-enabled. Security groups are used to organize users and grant them access to objects and resources. Security groups can be mail-enabled and used for distribution purposes. You will create security groups to allow users with the same resource access needs to be grouped together.
9.	A, C, D. The three criteria that make up a functional naming strategy that will allow an administrator to easily locate the group within Active Directory and understand what the group is used for are the group s scope, purpose, and owner.
10.	A, B, C, D. All of the options are correct because the domain is in a Windows Server 2003 functional level. They would also be available in the Windows 2000 Native mode functional level.