MSCE Interview Questions and Answers

Network infrastructure
The following infrastructure requirements must be considered:
1. The planned network is shown in the Planned Network Infrastructure exhibit.
2. Redundancy for any service must be provided if a single service fails.
3. A WAN link from the newly established Berlin office will connect to the Sydney
office. Another WAN link will connect the Paris office with the Berlin office.
4. User's reports of lengthy logon times must be resolved.
5. Daily updates of antivirus software must be executed for all desktop computers.


QUESTION NO: 1
You are designing a top-level OU structure to meet the business and technical
requirements. Which top-evel OU or OUs should you use? (Choose all that apply.)

A. ATC
B. Paris
C. Berlin
D. Sydney
E. Manifast
F. Human Resources

Answer: A, B


QUESTION NO: 2
You are designing an authentication solution to meet the security needs of the
network administrators. You install an enterprise certification authority (CA).
Which three additional actions should you take? (Each correct answer presents part
of the solution. Select three).

A. Enroll each administrative account for a smart card authentication certificate.
B. Configure autoenrollment for computer authentication certificates.
C. Install a smart card reader on each server computer.
D. Install a smart card reader on each network administrator's computer.
E. Configure each administrative account to require a smart card for interactive logon.
F. Configure the Default Domain Policy GPO to require smart cards for interactive login.

Answer: A, D, E

Explanation:
The case study states: "Existing airline security requirements specify that only smart card
authentication should be used for the administration of servers by network
administration."

Enrollmentcan occur automatically, for example, when an application sends a certificate
request to an enterprise CA and immediately receives a certificate in return, or manually,
when a user explicitly requests a certificate from a CA. To send enrollment requests to an
enterprise CA, you use the Certificates snap-in for Microsoft Management Console.
Because smart card logons are intended only for internal users with access to Active
Directory, only enterprise CAs can issue smart card certificates.

A smart card is a credit card-size device used to securely store public and private keys,
passwords, and other types of personal information. To use a smart card, you need a
smart card reader attached to the computer and a personal identification number for the
smart card. In Microsoft Windows Server 2003, smart cards can be used to enable
certificate-based authentication and single sign-on to the enterprise.

Smart card is required for interactive logon, found in the Account options section of
the Account tab, disables logging on without a smart card.


QUESTION NO: 3
You are designing a domain naming strategy for the new environment. Which two
actions should you perform? (Each correct answer presents part of the solution.
Choose two.)

A. Register airlines.com as a new domain name.
B. Register manifest.airlines.com as a new domain name.
C. Register manifest.blueyonderairlines.com as a new domain name.
D. Maintain the existing blueyonderairlines.com registered domain name.
E. Use the UPN suffix of airlines.com for all new users.
F. Use the UPN suffix of blueyonderairlines.com for all new users.

Answer: D, F

Explanation:
In the case study, the Chief Information Officer states: "Blueyonderairlines.com is
already registered to the company and is used for e-mail addresses. This must not
change." It also states that the NetBIOS name of the corp.bloueyonderairlines.com
domain is Airlines and that some applications still rely on this NetBIOS name to operate.
It goes further, saying: "New customers must be able to access this Web site by using a
single URL."

Users logging on using Windows 2000 or later platforms may log on the same way, or
they may log on using the more efficient UPN. The UPN takes the format
@, where the UPN suffix is, by default, the DNS
domain name in which the user object resides.

You should plan names that fit both DNS and NetBIOS name requirements.


QUESTION NO: 4
You are designing a site topology for the new Active Directory environment. What
should you do?

A. Create one site for all offices. Place the subnets for the four branch offices and the
Sydney main office in this site.
B. Create two sites: one site for the four branch offices and one site for the Sydney main
office. Place the subnets for the branch offices in one site. Place the subnet for the
Sydney main office in the other site.
C. Create three sites: one site for the four branch offices, one site for the Sydney main
office, and one site for the Sydney satellite offices.
D. Create four sites: one for the Melbourne and Perth branch offices, one site for the
Berlin and Paris branch offices, one site for the Sydney main office, and one site for the
Sydney satellite offices.
E. Create five sites; one site for the Melbourne branch office, one site for the Perth
branch office, one site for the Berlin branch office, one site for the Paris branch office,
and one site for the Sydney main office. Place the subnets for each branch office and the
Sydney main office in their respective sites.

Answer: E

Explanation:
The answer should be E since you are deploying a separate DC/GC to a site. Users
complain that logon times and GP installation takes forever. If you only create 2 sites
(B), then you will continue to have logon problems because site affinity will find any of
the remote DC's to authenticate. By having a site in each location, site affinity will use
the local DC/GC for authentication and GP processing.


QUESTION NO: 7
You are designing a strategy to enable the ATC application to successfully resolve
computer names. Which name resolution method should you use?

A. DNS
B. WINS
C. Hosts file
D. Lmhosts file

Answer: A

Explanation:
The case study states: "The ATC application is an X.500 directory-enabled application
that runs on Windows NT Server 4.0 computers in the Sydney office. The company plans
to use a new version of the ATC application that will run on a Windows Server 2003
computer hosted by Contoso, Ltd. Only specified users will have access to this
application. Users connect to this application by querying DNS for the application's
service record. This record is stored on a UNIX DNS server running the latest version of
BIND."

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name
System (DNS) written and ported to most available versions of the UNIX operating
system.

QUESTION NO: 9
You are designing a strategy to meet the security and financial requirements related
to the Manifest application.
What should you do?

A. Configure a VPN server in Sydney.
B. Configure a VPN server in each branch office.
C. Configure a dial-up server in Sydney
D. Configure a dial-up server in each branch office.

Answer: A

Virtual private networking (VPN) provides a way of making a secured, private
connection from the client to the server over a public network such as the Internet. Unlike
dial-up networking, in which a connection is made directly between client and server, a
VPN connection is logical and tunneled through another type of connection. Typically, a
remote user would connect to an Internet service provider (ISP) using a form of dial-up
networking (particularly good for users with high-speed connections). The Routing And
Remote Access server would also be connected to the Internet (probably via a persistent,
or permanent, connection) and would be configured to accept VPN connections. Once the
client is connected to the Internet, it then establishes a VPN connection over that dial-up
connection to the Routing And Remote Access server.

The reason for configuring it in the Sydney office is that the Passenger Manifest runs on
a server in the Sydney office, and the information contained in it must never become
publicly available.

Currently, an on-site user must send the information to flight officers via an e-mail
message, so VPN would make it easier for the flight officers to access it.

QUESTION NO: 8
You are designing the placement of the PDC emulator operations master role. In
which location or locations should you place the role? (Choose all that apply.)

A. Sydney
B. Melbourne
C. Perth
D. Berlin
E. Paris

Answer: A

Explanation:
In a native mode Windows Server 2003 environment, the PDC Emulator receives
preference in the replication of user account passwords.
The reason for it being placed in Sydney is, "The IT department manages the entire
network from the Sydney office or by traveling to the branch offices. All resources
are located at the Sydney office and are accessed across the WAN links by users in
the branch offices."

QUESTION NO: 9
You are designing a strategy to improve the performance and reliability of the
domain controllers. What should you do?

A. Create one RAID-5 volume.
B. Create two RAID-5 volumes.
C. Create one mirrored volume and two RAID-5 volumes.
D. Create two mirrored volumes and one RAID-5 volume.

Answer: D

Explanation:

QUESTION NO: 10
You are designing an IP address management strategy to address the anticipated
growth of the company and to meet the business and technical requirements. What
should you do?

A. Install one DHCP server in each branch office and in Sydney. On each server, create
duplicate scopes that contain the necessary scope options. Configure the scopes to assign
all of the available IP addresses to each office.
B. Install one DHCP server in each branch office and in Sydney. On each server, create
duplicate scopes that contain the necessary scope options. Configure the scopes to assign
half of the available IP addresses to each office.
C. Install two DHCP servers in each branch office and in Sydney. Authorize one server
in each office. On each server, create duplicate scopes that contain the necessary scope
options. Configure the scope to assign half of the available IP addresses to each office.
D. Install two DHCP servers in each branch office and in Sydney. Authorize both servers
in each office. On each server, create duplicate scopes that contain the necessary scope
options. Configure the scope to assign half of the available IP addresses to each office.

Answer: D