MSCE Interview Questions and Answers

The following security requirements must be considered:

1. Specific security groups must be set up to address security requirements.
2. Security must be based on departments and groups of individuals within the
departments.
3. Users in the finance department need access to payroll information on a server
named Payroll, which is located in the HR department.

Customer Requirements

The following customer requirements must be considered:
1. A new service-level agreement that requires a response from the IT department
to users within one hour must go into effect.
2. Personal information about employees must remain secure.
3. All client computers, regardless of office location, must be able to access all other
computers.

Technical Requirements

Active Directory
The following Active Directory requirements must be considered:
1. The company requires a new Active Directory environment that enables the
security requirements of various departments to be met. This must be accomplished
by installing a Windows Server 2003 on all domain controllers.
2. A completely decentralized administrative approach will be used. Each group of
administrators will be responsible for its own departmental environment.
3. Only one operations master role will be allowed per domain controller. This is
required for fault tolerance.
4. DNS replication of the forest root domain must be limited to forest domain
controllers only.

Network Infrastructure

The following infrastructure requirements must be considered:
1. A new Routing and Remote Access solution must be installed:
2. A DHCP solution that is fault tolerant within each office must be implemented
3. All WAN links must be fault tolerant
4. Name resolution must be localized on the local network


QUESTION NO: 1
You are designing a strategy to address the requirements of the advertising
department. What should you do?

A. Create a GPO and link it to the Denver site.
B. Create a GPO and link it to the Advertising OU.
C. Create a GPO and link it to the graphicdesigninstitute.com domain.
D. Configure the Default Domain Policy to have the No Override option.
E. Use block inheritance to prevent the GPO from applying to members of the advertising
department.

Answer: B

Explanation:
The case study states: "Each group of administrators will be responsible for its own
departmental environment."

You can use Group Policy to define user settings such as password restrictions or
computer settings. It is much better to create a Group Policy plan that applies GPOs
efficiently from the outset, and linking GPOs to OUs provides a way to bring such a plan
into effect. Creating GPOs for OUs gives you much better control over the application of
Group Policy, because it eliminates the need to filter Group Policy settings.

Incorrect Options:
A: This would apply the GPO to the entire Denver site, but the question refers to the
advertising department.
C: This would apply the GPO to the entire graphicdesigninstitute.com domain, but the
question refers to the advertising department.
D: The Default Domain Policy applies at the domain level, but the question refers to a
department.


QUESTION NO: 2
You are deploying a NetBIOS name resolution strategy to meet the business and
technical requirements. What should you do?

A. Install one WINS server in each branch office. Configure the WINS servers to use
push/pull replication with the WINS server in Los Angeles. Configure all computers to
have the IP address of the local WINS server.
B. Install two additional WINS servers in Los Angeles. Configure the WINS servers to
use push/pull replication. Configure all computers to have the IP addresses of the WINS
servers.
C. Install the DNS Server service on one domain controller on each branch office.
Configure the DNS server to forward all unanswered queries to the WINS server.
Configure all computers to have the IP address of the DNS servers.
D. Configure the DNS servers in each branch office to forward all unanswered queries to
a local WINS server. Configure all computers to have the IP addresses of the DNS server
in graphicdesigninstitute.com forest root.

Answer: A

Explanation:
The question asks for NetBIOS name resolution, which means we must use WINS.
Your goal, when designing a WINS strategy for your network infrastructure, is to have
the WINS service available to client workstations when they need it. Availability is at
risk when there is only one WINS server configured to support a large number of users. If
that server should fail, all of the users will now need to resolve NetBIOS names using
one of the other methods, namely: Lmhosts files or broadcasts. In situations in which a
slow link exists between two subnets, it is highly recommended that a WINS server be
placed in both subnets to maximize performance of client name-resolution requests. It is
for this reason that "B" is incorrect.

This is the default configuration of a WINS server. A push of an updated WINS database
will occur as discussed previously, and the WINS server is also configured to pull WINS
database information from another WINS server at a designated time. This type of
configuration is recommended in most cases.

After configuring WINS servers as Push/Pull partners, servers, after replication, will
contain NetBIOS records from all subnets. Now, any WINS-enabled client on any subnet
can access resources on a different subnet using the NetBIOS name of that resource.

Incorrect Options:
C and D: The question does not ask for DNS resolution.


QUESTION NO: 3
You are designing a DHCP strategy to meet the business and technical
requirements. What should you do?

A. Install one DHCP server in each branch office and one DHCP server in Los Angeles.
B. Install one DHCP server in each branch office and two DHCP servers in Los Angeles.
C. Install two DHCP servers in each branch office and one DHCP server in Los Angeles.
D. Install two DHCP servers in each branch office and two DHCP servers in Los
Angeles.

Answer: D

Explanation:
The case study states: "A DHCP solution that is fault tolerant within each office must be
implemented." Option "D" allows for this to be achieved, by placing two DHCP servers
in each office.

Incorrect Options:
A, B and C: These options do not conform to the requirements because they do not have
two servers in each office.


QUESTION NO: 4
You are designing a DNS strategy to meet the business and technical requirements.
What should you do?

A. Install the DNS Server service on all domain controllers. Create Active
Directory-integrated zones. Replicate the zones to all DNS servers in the forest.
B. Install the DNS Server service on all domain controllers. Create Active
Directory-integrated zones. Replicate the zones to all DNS servers in the domain.
C. Install the DNS Server service on all domain controllers. Create primary zones and
secondary zones.
D. Create application partitions for the different zones on one domain controller.
Configure replication to occur on all DNS servers.

Answer: B

Explanation:
The case study states: "...the company wants to implement a Windows Server 2003
Active Directory environment." This environment uses DNS for name resolution.
Any domain controller running the DNS Server service can be designated as the primary
source for a zone and can update a zone. In other words, there is not one primary DNS
server, as in the standard primary zone methodology, which can be a single point of
failure for a network. In the Active Directory integrated model, a master copy of the zone
is maintained by Active Directory and replicated to all domain controllers.

Incorrect Options:
A: The case study states: "DNS replication of the forest root domain must be limited to
forest domain controllers only."
C: For standard primary zones, only a single server can host and load the master copy of
the zone. If you create a zone and keep it as a standard primary zone, no additional
primary servers for the zone are permitted. The standard primary model implies a single
point of failure.


QUESTION NO: 5
You need to identify the number of servers that will be used specifically for
operations master roles. How many servers should you recommend?

A. 5
B. 11
C. 14
D. 17
E. 20

Answer: B


QUESTION NO: 6
You are designing a strategy to provide Internet access to all users. What should
you do?

A. Configure Internet Connection Sharing on all client computers.
B. Configure Automatic Private IP Addressing (APIPA) on all client computers.
C. Configure one server as a Routing and Remote Access VPN server.
D. Configure one server as a Routing and Remote Access NAT router.

Answer: D

Explanation:
Computers running a member of the Windows Server 2003 family now allow you to add
the Internal interface as a private interface to the Network Address Translation
component of the Routing and Remote Access service. This allows connected remote
access clients to access the Internet

Incorrect Options:
A: Internet Connection Sharing is recommended only for very small networks.
B: APIPA is an addressing feature for simple networks that consist of a single network
segment. Whenever a computer running Windows Server 2003 has been configured to
obtain an IP address automatically, and when no DHCP server or alternate configuration
is available, the computer uses APIPA to assign itself a private IP address in the range of
169.254.0.1-169.254.255.254.
C:


QUESTION NO: 7
You are designing an Active Directory forest structure to meet the business and
technical requirements. What should you do?

A. Create a single forest that has one domain. Use OUs to separate the departments.
B. Create a single forest that has multiple domains to represent every department.
C. Create a single forest that has three domains: one for finance, one for HR, and one for
the remaining departments.
D. Create multiple forests that have a single domain in each forest to represent the
departments.

Answer: C

Explanation:
The case study states: "The new design must accommodate the finance and HR
departments, which have requirements not addressed by the company's planned password
policy." It also states: "A completely decentralized administrative approach will be used."
This means that they have to have their own domains to which a password policy can be
applied to cater for their respective needs.

There are a number of reasons that you might need to define multiple domains. These
reasons include the following:
1. You need to implement different domain-level security policies.
2. You need to provide decentralized administration.
3. You need to optimize replication traffic across WAN links more than you can by
dividing a domain into multiple sites.
4. You need to provide a different namespace for different locations, departments, or
functions.
5. You need to retain an existing Windows NT domain architecture.
6. You want to put the schema master in a different domain than the domains that contain
users or other resources.


QUESTION NO: 8
You are designing a WAN implementation strategy to meet the business and
technical requirements. What should you do?

A. Configure a demand-dial router.
B. Create multiple Active Directory site links.
C. Configure a VPN connection between each branch office.
D. Install an Internet Authentication Service (IAS) server in each branch office.

Answer: A

Explanation:
Demand-dial connections are used by the Routing and Remote Access service to make
point-to-point connections between LANs over which packets are routed.


QUESTION NO: 9
You are designing a password management solution to meet the business and
technical requirements. Which two actions should you perform? (Each correct
answer presents part of the solution.) (Choose two.)

A. Delegate the password management controls to the help desk staff.
B. Delegate the password management controls to the Domain Users group.
C. Configure the Default Domain Policy to enforce password expiration settings.
D. Configure the Default Domain Controller Policy to enforce password expiration
settings.

Answer: B, D

Explanation:
Security groups are used to group domain users into a single administrative unit. Security
groups can be assigned permissions and can also be used as e-mail distribution lists.
Users placed into a group inherit the permissions assigned to the group for as long as they
remain members of that group. Windows itself uses only security groups.
We have already established that multiple domains must be used when you need to
implement different domain-level security policies. By configuring the Default Domain
Controller Policy we apply the settings to that specific domain.