MSCE Interview Questions and Answers

All terminal servers in a single office must be configured to use Network Load
Balancing. All users must use roaming profiles to ensure that they have a consistent
desktop appearance and access to applications. Terminal server user profiles
must be stored on a network shared folder. Redundancy for all other servers is
required.

QUESTION NO: 1
You are designing a strategy for configuring a newly installed Windows Server 2003
computer to meet the Active Directory DNS requirements. How should you
configure the computer?

A. As a caching-only DNS servers
B. As the primary DNS server for the fourthcoffee.com DNS zone
C. With a stub zone for the fourthcoffee.com DNS zone hosted by the ISP
D. As a secondary DNS server for the fourthcoffee.com DNS zone hosted by the ISP

Answer: B

Explanation:

Primary DNS servers store original source data for zones. With Windows Server 2003,
you can implement primary zones in one of two ways: as standard primary zones, in
which zone data is stored in a text file, or as an Active Directory-integrated zone, in
which zone data is stored in the Active Directory database

Incorrect Options:
A: A caching-only server does not host a zone, its only purpose is to cache queries so
that future requests for the same resource record are done instantly because the results of
the previous query are already in cache.
C: A stub zone is a copy of a zone that contains only the resource records needed to
identify an authoritative DNS server.
D: Secondary DNS servers are authoritative backup servers for the primary server. The
servers from which secondary servers acquire zone information are called masters. A
master can be the primary server or another secondary server.

QUESTION NO: 2
You are designing the forest and domain structure to meet the business and
technical requirements.
Which structure should you use?

A. A single forest with one tree, and one domain
B. A single forest with one tree two domain
C. A single forest with two trees, each with a single domain
D. Two forests, each with a single tree and a single domain
E. Two forests, each with two trees, with a single domain in each tree.

Answer: A

Explanation:

The case study states: "All security settings must be equal to or more restrictive than the
default Windows Server 2003 settings." It also states: "...users must be forced to change
their passwords at least once a month."

In a single-domain model, all objects are located within the same security boundaries, so
you won't have to worry about planning trust relationships with other domains or
implementing cross-domain authentication and permissions. When using a single-domain
model, user and group planning is simpler, as is the implementation of group policy. In
fact, almost all management functions are simpler-and simpler means less planning, less
administration, less troubleshooting, and a lower total cost in the end. Active Directory
domains are scalable and can grow much larger than Windows NT domains, which
removes a significant obstacle that prevented the use of single-domain networks in
structures based on Windows NT, in which the Security Accounts Manager
(SAM) could support only up to 40,000 objects in a domain. By contrast, an Active
Directory domain can hold more than one million objects.

Incorrect Options:
A:
Multiple domains are necessary when you need to implement different domain-level
security policies. Certain policies can only be controlled at the domain level. For
example, one department may enforce tighter password policies or account lockout
policies than another department.
C and D: You might need to implement multiple forests in situations where you are
linking two existing separate organizations, creating an autonomous unit or creating an
isolated unit.

QUESTION NO: 3
You are designing a group management strategy for users in the finance
department. You need to identify the appropriate changes that need to be made to
the current group management strategy. You want to accomplish this goal by using
the minimum number of groups. What should you do?

A. Add the finance users to the financeData group to which the necessary permissions
have been assigned.
B. Add the finance users to the financeGG group to which the necessary permissions
have been assigned.
C. Add the finance users to the financeGG group. Then add the financeGG group to the
financeData group to which the necessary permissions have been assigned.
D. Add the finance users to the financeGG group. Add the financeGG group to the
financeUG group to the financeDat group to which the necessary permissions have been
assigned.

Answer: B

Explanation:
The question specifies that the minimum number of groups must be used to accomplish
this goal, and "B" conforms to it.

QUESTION NO: 4
You are designing a strategy of enforce the corporate security policy. Which action
or actions should you perform? (Choose all that apply.)

A. Configure a password policy that requires strong passwords
B. Configure a password policy that requires all users to change their passwords once a
month.
C. Allow users in the branch offices to log on between the hours of 8:00 A.M and 5:00
P.M., Monday through Friday.
D. Allow users in the retail outlets to log on between the hours of 6:00 A.M and 11:00
P.M., daily.
E. Enable a policy that forces users to log off when their logon hours expire.

Answer: A B, C, D, E

Explanation:
The case study asks for complex passwords to be implemented, and in the process of
designing a strong password policy you can select the "Require the use of complex
passwords" option.

According to the case study, users must be forced to change their passwords at least once
a month.

The case study says: "The users at the retail outlets sometimes leave the terminal
connected to the application for weeks without disconnecting. This results in failed
backups of the application data. All of the users in the branch offices also leave their
computers on for long periods of time."

It also says "The duration of logon hours must be strictly enforced."

Therefore, all actions should be performed.

QUESTION NO: 5
You are designing a migration strategy to meet the business and technical
requirements. What should you do?

A. Upgrade the fourthcoffee BDC to Windows Server 2003. Then upgrade the PDC to
Windows Server 2003
B. Upgrade an existing domain controller to Windows Server 2003. Establish a two-way
trust relationship with the fourthcoffee domain.
C. Install and configure a new Windows NT 4.0 BDC. Promote the BDC to a PDC. Then
upgrade the PDC to Windows Server 2003
D. Create a new Windows 2000 Server Active Directory domain. Establish a two-way trust
relationship with the fourthcoffee domain. Use the Active Directory Migration Tool
(ADMT) to migrate all user and computer accounts.

Answer: C

Explanation:
First, spec out the hardware for a server that is adequate for your domain controller
needs. Do a test installation of Windows Server 2003 on this server just to make sure you
have no compatibility issues. Make sure you test all the SCSI channels and drives that
you will eventually use to store Active Directory files.
Now, wipe the operating system drive on the new server and install NT4 as a BDC in

your existing NT domain. Make sure you verify that you get steady replication between
this server and the PDC. Leave the new server on the wire for a day or two to check for
complications prior to upgrading.

Promote the new server to PDC with User Manager. This automatically demotes the
existing PDC to a BDC. Again, let the system bake for a couple of days to make sure
everything works as you would expect.

When you're ready to upgrade the domain, start by upgrading the new PDC to Windows
Server 2003.

QUESTION NO: 6
You are designing for implementing Group Policy objects (GPOs) to meet the
business and technical requirement. What should you do?

A. Create one new GPO to enforce software restriction policies. Link this GPO to the
domain.
B. Create one new GPO to enforce software restriction policies. Link this GPO to the
appropriate organizational unit (OU).
C. Create one new GPO to enforce software restriction policies. Link this GPO to all
organizational units (OUs).
D. Create new GPOs to match the number of organizational units (OUs).configure these
GPOs to enforce software restriction policies. Link this GPO to its respective OU.

Answer: A

Explanation:
In the problem statements, it states: "Employees in the branch offices often log on to
install software by using local computer accounts rather than domain accounts."
Microsoft uses the term Group Policy Object as an umbrella to identify the two
components of a group policy: the Group Policy Container and the Group Policy
Template. Container objects in Active Directory such as sites, domains, and
organizational units (OUs) can be linked to a GPO. This applies the GPO settings to user
and computer objects under that container.

A GPC is an Active Directory object that lists the names of the GPTs associated with a
particular GPO. Windows clients use the information in a GPC to determine which GPTs
to download and process. (Microsoft documentation sometimes uses the terms GPO and
GPC interchangeably.)

A GPT is the set of instructions that implements a set of policies. For example, policies
that update the Registry are stored in a GPT file called Registry.pol. File-based GPTs are
stored in policy folders under the Sysvol folder on each domain controller.

QUESTION NO: 7
You are designing a DNS name resolution strategy to allow all users access to
internal and external web sites. What should you do?

A. Allow zone transfers to any DNS server.
B. Create a new stub zone for the DNS zone on the DNS server.
C. Configure the DNS server to forward all unanswered queries to a DNS server located
at the ISP
D. Add the DNS server located at the ISP to the list of name servers for the
fourthcoffee.com DNS zone

Answer: C

Explanation:
The question states: "...allow all users access to internal and external web sites."
When a DNS server receives a query, it will first check to see whether it can answer the
query authoritatively-that is, on the basis of information contained in a locally configured
zone on the server. If it cannot, it will query other DNS servers on the network. In this
case it will be a DNS server at the ISP, which is authoritative for external queries.
The process of a DNS server querying other DNS servers on behalf of an original
querying client is known as recursion.

QUESTION NO: 8
You are designing a strategy to assign the IP addresses to meet the business and
technical requirement. Which two actions should you perform? (Each correct
answer presents part of the solution. choose two)

A. Install and Configure one DHCP server in Atlanta and one DHCP server in each
branch office.
B. Install and Configure two DHCP servers in Atlanta and two DHCP servers in each
branch office.
C. Create one scope on each DHCP server. Specify one DHCP server to always update
DNS records. Configure the scope to assign half of the IP addresses available to each office.
D. Create two scopes on each DHCP server. Specify one DHCP server to update DNS
records only for client computers that request it. Specify a second DHCP server to never
update DNS records.

Answer: B, C

Explanation:
Dynamic Host Configuration Protocol (DHCP) is an industry standard protocol that lets a
server automatically assign IP addresses to clients. This would the one of the problem
statements, which says: "IP addresses are configured manually. This leads to incorrectly
configured or duplicate addresses on the network."

When you install Windows Server 2003 DHCP service, you can enable the DHCP server
to perform updates on behalf of DHCP clients to any DNS server that supports dynamic
updates. In other words, DHCP can register the A (host) records and PTR records for all
DHCP-enabled clients. DHCP clients can provide their FQDN to the DHCP server, as
well as instructions on how it would like the server to process DNS dynamic updat

QUESTION NO: 9
You are designing a name resolution strategy for the retail outlets to ensure that the
existing bandwidth is used efficiently. Which three actions should you perform?
(Each correct answer presents part of the solution. Choose three.)

A. Configure the DNS server service on the terminal servers as caching-only servers.
B. Configure multiple sites to have site links and set up a specific replication schedule.
C. Configure the default site to have the subnets of Atlanta and the branch offices.
D. Create a new DNS zone and configure zone transfers to name servers only.
E. Create an application partition to be used for DNS
F. Specify the scope of replication to be used for DNS

Answer: D, E, F

Explanation:
In an incremental zone transfer (IXFR), servers keep track of, and transfer only, changes
that are made to resource records in a particular zone, the advantage being that less traffic
is sent over the network.

The application partition can be configured to replicate objects to any set of domain
controllers in the forest, not necessarily all in the same domain. This partition provides
the capability to host data in Active Directory without significantly impacting network
performance by providing control over the scope of replication and placement of replicas.
Therefore, dynamic data from network services such as Remote Access Service (RAS),
RADIUS, Dynamic Host Configuration Protocol (DHCP), and Common Open Policy
Service (COPS) can reside in a directory, allowing applications to access them uniformly
with one access methodology.

QUESTION NO: 10
You are designing a strategy for installing Windows server 2003 on the new domain
controllers. Which method should you use?

A. Unattended installation
B. Remote Installation Services (RIS)
C. Automated Deployment Services (ADS)
D. Microsoft Systems Management Server (SMS)

Answer: A

Note: Uncertainty

Explanation:
Although we would not automate install for only 10 DC's (based on the case study) from
the available answers C does make cense, so a multiple answer could be correct.
Since we have already decided on automation (since there is no manual installs), lets
eliminate the obvious ones (D and B) SMS does not automate installations, RIS does but
there is no support for installing Domain Controllers.

That leaves us with both A and C, which both can be done.
Answer A would be the old answer (for 2000 test) but since ADS is relatively new for
2003 this is what MS is going to recommend even though it would take a considerable
time to setup and perfect (more than the time it would just take to manually install the 10
servers).

Microsoft recommends using ADS for deployment of Windows Server 2003 DC's.
If installation is provided via network practice, such as by using Remote Installation
Services (RIS) or Automated Deployment Services (ADS), a separate network should be
provided-one that has no connection with the production network and absolutely no
connection with the Internet. The server should not be physically moved until you have
completed the initial installation and additional hardening.

QUESTION NO: 11
You are designing a strategy to ensure that all employees have Internet access. For
each branch office, what should you do?

A. Configure a DNS server to function as caching-only servers
B. Configure Internet Connection sharing on terminal servers.
C. Install and configure an Internet Security and Acceleration (ISA) Server Computer
D. Install and configure a server running Routing and Remote Acess to function as a
VPN server

Answer: C

Explanation:
Proxy servers, such as ISA Server 2000, client computers can access Internet resources
through the proxy server, which will perform name resolution on their behalf. The proxy
server and computers that cannot use the proxy client software need to be configured to
use separate, internal DNS forwarders or other DNS servers for Internet name resolution.
A proxy server is a firewall component that manages Internet traffic to and from a local
area network (LAN) and that can provide other features, such as document caching and
access control. A proxy server can improve performance by supplying frequently
requested data, such as a popular Web page, and it can filter and discard requests that the
owner does not consider appropriate, such as requests for unauthorized access to
proprietary files.