CMIT 370 FINAL EXAM

1. Buy here:
http://theperfecthomework.com/cmit-370-final-exam/
Your network currently has two domains: eastsim.com and sales.eastsim.com.
You need to remove the sales.eastsim.com domain.
You have removed all domain controllers in the domain except for the
DC1.sales.eastsim.com
server. This server holds the following infrastructure master roles:
• RID master
• PDC emulator
• Infrastructure master
• Domain naming master
You are getting ready to remove Active Directory from DC1. What should you do first?
Which built-in local user account is a member of the local Administrators group?
You are the administrator for WestSim Corporation. The network has a single domain,
westsim.com, running at the Windows 2008 functional level. Five domain controllers, all
running Windows Server 2012 R2, are located on the network. The Active Directory
Structure is shown in the image. All user and computer accounts have been placed in the
department OUs. Main offices are located in Orlando, with additional offices in Boston and
New York and a small branch office in Chicago. There are three departments within the
company: Sales, Marketing, and Accounting. Employees from each department are at each
location. You want to appoint an employee in each department to help with changing
passwords for users within their department. They should not be able to perform any other
tasks. What should you do?
You have a file server that has the File Server Resource Manager role service installed. The
G: drive is used for storing files for the research department. The G:Users folder contains

2. subfolders for user home directories, with one subfolder for each user. The G:Reports folder
is shared by all users for holding weekly department reports. You create a quota entry for the
G:Users folder using the default 100 MB Limit template and auto applying the template to
subfolders. You create a second quota entry for the G:Reports folder using the Create quota
on path option and the default 100 MB Limit template. After several months, the manager is
complaining that the G:Reports folder is full. You are instructed to increase the quota limit to
200 MB while keeping the remaining quota settings. What should you do?
The desktop workstations you recently purchased for the employees in your organization's
Denver office came with two network boards installed: • A RealTek PCIe Fast Ethernet
interface integrated into the motherboard • A Broadcom NetXtreme 57xx Gigabit Ethernet
interface installed in a motherboard slot. Page 3 of 44
http://cdn.testout.com/client-v5-1-10-337/startlabsim.html 5/7/2016 You used the gigabit
controller to connect these systems to the network. Because the integrated interface is not
used, you set up a Devices Group Policy preference that disables the RealTek adapter.
However, because this affects only the employees in the Denver office, you set up an
item-level target that specifies that the preference only be applied to hosts in the Denver site
in Active Directory. Which of the following is true concerning this Group Policy preference
when it is applied?
You are the administrator for a network with a single Active Directory domain called
westsim.com. All computer accounts reside in Organizational Units (OUs) that correspond to
departments. You have previously deployed a WSUS server in your location to specify the
approved list of updates. All client computers are configured to download updates from your
local WSUS server. You decide that you need to configure a separate update approval list
for all computers in the Marketing department. You want the update list to be automatically
identified based on the department membership for the computer. What should you do?
(Select three. Each choice is a required part of the solution.)
You are the network administrator for eastsim.com. The network consists of a single Active
Directory domain. All the servers run Windows Server 2012 R2. All the clients run Windows
8. The company has a main office in New York and several international locations including
facilities in Germany and France. You have been asked to build a domain controller that will
be deployed to the eastsim.com office in Germany. The network administrators in Germany
plan to use Group Policy Administrative Templates to manage Group Policy in their location.
You need to install the German version of the Group Policy Administrative Templates so

3. they will be available when the new domain controller is deployed to Germany. What should
you do?
You manage a small business network with a single subnet. All devices are connected
through a series of three switches. You want to monitor traffic between Srv1 and Srv2. You
install Network Monitor on Srv3 and start a capture to capture all packets. After you stop the
capture, you cannot see any packets sent between Srv1 and Srv2. What should you do?
You have decided to implement Network Access Protection (NAP) with IPsec on your
network. You have installed the NPS role, configured the System Health Validator (SHV),
created health policies, and configured network policies. Which additional steps will you
need to perform to complete the configuration? (Select two. Each choice is a possible
action.)
You have a Windows 8 laptop that is shared by three users. The computer is not a member
of a domain. Each user has been using EFS to encrypt their personal files on the laptop. You
would like to add your user account as a recovery agent so you can recover any encrypted
file encrypted by any user on the laptop. You would like to store the recovery keys on a
smart card. What should you do first?
You have just been put in charge of installing 30 new workstations. The following operating
systems will be installed: • Windows 8 Enterprise on 64-bit computers • Windows 8
Professional on 32-bit computers You decide to use Windows Deployment Services (WDS)
to help automate the installation. How should you create custom install images for
deployment on the WDS server? (Select two. Each choice is a possible solution.)
You manage a Windows Server 2012 R2 server that stores user data files. The system
volume is drive C:, while all user data is on drive E:. You want to use Windows Server
Backup to configure a backup schedule. You want to back up only the E: volume twice a
day. You want to be able to restore individual files and folders. If possible, you want to save
backups on optical media so you can place the backup disc in a media catalog server for
easy retrieval. What should you do? (Select two. Each choice is a required part of the
solution.)
You are in charge of installing a remote access solution for your network. You decide you
need a total of four remote access servers to service all remote clients. Because remote
clients might connect to any of the four servers, you decide that each remote access server

4. must enforce the exact same policies. You anticipate that the policies will change frequently.
What should you do? (Select two. Each choice is a required part of the solution.)
You manage a network with two locations: San Jose and Oakland. The two networks are
connected with a WAN link, and each site has its own Internet connection. Srv1 is in San
Jose,
and Srv2 is in Oakland.
Page 9 of 44
http://cdn.testout.com/client-v5-1-10-337/startlabsim.html 5/7/2016
You decide to implement a WSUS solution using Srv1 and Srv2 as WSUS servers. Your
solution
should meet the following requirements:
• Client computers should contact the WSUS server in their site for a list of approvals and
download the updates from the WSUS server in their site.
• All updates for both sites are approved from Srv1.
• You must minimize traffic on the WAN link between the two sites.
You have completed the configuration of the WSUS server in the San Jose location. How
should you configure Srv2 in Oakland to meet the design requirements?
Members of the sales team use laptop computers while traveling. All laptops run Windows 8.
You have enabled EFS in your domain, and have configured a Group Policy Object (GPO) to
enforce encryption of the Documents folder on each of the sales computers. You would like
to use certificates stored on smart cards to increase the security of EFS for each laptop
computer. You want to require these certificates to be used for EFS on the laptop
computers. You add a smart card reader for each laptop and configure smart cards for each
sales team member. You configure the GPO to require a smart card for EFS. What else

5. must you do to complete the configuration? (Select two. Each choice is a required part of the
solution.)
You manage the network infrastructure for the westsim.com domain. All servers have
recently been upgraded to Windows Server 2012 R2, and all clients run Windows 8. All
server and client computers are members of the domain. You implement a domain-based
DFS solution with Srv1 as the namespace server and Accounting as the namespace root.
You create a folder named Payroll with a target that points to the AccPay shared folder on
Srv2. Srv3 holds a replica of the AccPay shared folder. You configure the namespace to
support access-based enumeration and to replicate data using DFS replication. You want to
create a script so that users of the Accounting department can access the files in the AccPay
shared folder through DFS. Which UNC path should you use?
Emma is a systems administrator for WestSim Corporation. The network has multiple
domains with DNS and DHCP services configured in each domain. All servers are running
Windows Page 11 of 44 http://cdn.testout.com/client-v5-1-10-337/startlabsim.html 5/7/2016
Server 2012 R2 and all clients are running Windows 8. All hosts are members of the
acct.westsim.com domain, the records of which are stored in a primary zone. As part of a
new security initiative, the IT department has developed a custom application that reports
the host name of each client that tries to access three sensitive servers in the Accounting
department. Emma has been asked to test the new application. During a random test, she
finds that the program is not reporting the host names for some clients, even though it
properly records their IP addresses. Emma realizes that the custom application submits
reverse lookup requests to the DNS server to discover the host name for the specified IP
address. She also realizes that the clients whose host names could not be notified have
manually-configured static IP addresses on the 192.168.3.0 subnet, using a default subnet
mask. What should Emma do?
You have decided to use Windows Deployment Services (WDS) for the deployment of
Windows Server 2012 R2 in your organization. You install WDS on a single server and
create a single image group that makes all Server 2012 R2 installations available. You want
to provide a solution so that Mary Barnes, an assistant administrator, can boot new
computers and initiate the installation. Your solution should meet the following requirements:
• Mary should only be able to install the Standard edition of Server 2012 R2. • Only the
Standard edition should appear on the install menu when Mary boots a new computer. • All

6. editions should show for you and other administrators. • You need to minimize the amount of
disk space used by install images on the WDS server. What should you do?
You are the network administrator for westsim.com. The network consists of a single domain
named westsim.com. All the servers run Windows Server 2012 R2. All the clients run
Windows 7 or Windows 8. The main office contains a server named RRAS1 that has been
configured to provide DirectAccess connectivity for clients. Clients complain that when they
connect via DirectAccess, they are not able to resolve intranet names. What should you do?
You manage the DNS infrastructure for your network. Server Dns1 holds a primary zone for
the westsim.com domain. Server Dns2 holds a primary zone for the sales.westsim.com
domain. Both servers are also domain controllers. Computers configured to use Dns1 as the
preferred DNS server are unable to resolve names for hosts in the sales.westsim.com
domain. You need to enable Dns1 to resolve names for hosts in that domain. Zone data for
the sales.westsim.com domain should not be stored on the Dns1 server. What should you
do?
You are adding a new Internet connection to connect your private network to the Internet. A
server running Windows Server 2012 R2 with Routing and Remote Access and NAT
connects the private network to the Internet. The ISP currently hosts your Web server, but
you want to move that server into your private network. You want all Web traffic sent to
135.74.16.86 to be redirected to the server on your private network with address 10.1.1.3.
What should you do?
You are working in PowerShell on a Windows Server 2012 R2 domain controller. You need
to create a group managed service account that will be used by a new service that you will
install later on the server. Which cmdlet should you use to do this?
You need to add Spanish language support for your administrative templates to a Windows
Server 2012 R2 system. Which administrative template component consists of
language-dependent files that provide localized information when viewing template settings
in the GPO?
You are the network administrator for the westsim.com domain. All client computers are
running Windows 8 and all servers are running Windows Server 2008 R2 or Windows Server
2012 R2. Organizational Units (OUs) have been created for each department, and user and
computer accounts have been moved into the department OUs. You have recently

7. configured a Windows Server Update Services (WSUS) infrastructure on the network. All
client computers are configured to download updates from your internal WSUS server. You
have just received notification that the accounting software has a new update. The update is
critical and must be deployed as quickly as possible to all computers in the accounting
department. What should you do?
You have decided to implement Network Access Protection (NAP) on your network. You
decide to create two categories of computers: • Those that pass all health checks • Those
that fail one or more health checks Those that pass all checks should be granted full network
access, while those that fail one or more should be granted access only to the quarantine
network. How should you configure NAP for this scenario? (Select two. Each choice is a
required part of the solution.)
You are the network administrator for eastsim.com. The network consists of a single Active
Directory domain. All of the servers run Windows Server 2012 R2. All of the clients run
Windows 8. The manager of the Sales business unit informs you that critical files have been
inappropriately modified. You need to determine who has modified the files and what
permissions have allowed them to do so. What should you do?
You are the administrator of a network with a single Active Directory domain. The domain
includes two domain controllers. Your company's security policy requires that locked out
accounts are unlocked by administrators only. Upon reviewing the account lockout policy,
you notice the Account lockout duration of 99999. You need to configure your domain's
account lockout policy to comply with your company's security policy. What should you do
next?
Match the Active Directory term on the right with its corresponding definition on the left. Not
all of the definitions on the left have an associated term on the right.
You are the administrator for westsim.com. You have recently installed Windows Server
2012 R2 on a new server in your environment. You have been experiencing a hardware
problem with this new server, so you open Reliability Monitor to view your server's reliability
and problem history in hopes of identifying the problem. Unfortunately, you find that no
reliability information has been collected. What should you do?
You have been assigned to create a remote access strategy for your network. All full-time
company employees should be allowed remote access during any time of the day. In

8. addition, you have some contractors who are working with the Marketing department who
should be allowed access only between 6am and 6pm
You are getting ready to install Windows Server 2012 R2.
You would like to configure the server to use BitLocker. The server should start up without
requiring a PIN or a USB device during startup.
What should you do? (Select two. Each choice is a required part of the solution.)
You have decided to use Windows Deployment Services (WDS) for the deployment of
Windows Server 2012 R2 in your organization. You install WDS on a single server and
create a single image group that makes all Server 2012 R2 installations available. You
realize that you do not currently have any licenses for the Datacenter edition of Server 2012
R2. Until you obtain the necessary licenses, you want to make sure that the version does not
appear in the install menu when a computer boots using WDS. After obtaining the necessary
licenses, you want to be able to quickly allow installation again. What should you do?
You are the network administrator for westsim.com. The network consists of a single Active
Directory domain. All the servers run Windows Server 2012 R2. All the clients run Windows
7 or Windows 8. westsim.com has a number of Product Specialists who travel to remote
areas. The Product Specialists complain that their Internet connections frequently fail,
forcing them to reconnect to the company VPN server. The server and the clients use the
L2TP with IPSec VPN protocol. You need to improve VPN performance by allowing the
clients to automatically reconnect to the company VPN if the clients' Internet connection
should fail. What should you do?
Outside Sales employees in your organization use a VPN connection to access your internal
network while traveling to customer sites. Currently, each user must manually create and
manage the VPN connection settings on their notebook systems and frequently require Help
Desk assistance. Rather than configure each workstation individually, you decide to use a
Group Policy preference setting in a GPO to push down the correct VPN configuration
settings for your organization's VPN server to the notebook systems. Click on the Control
Panel Setting you would use to implement this

9. You are configuring routing on a Windows Server 2012 system. The server has two network
interfaces installed, each one connected to a different network segment. You have installed
and enabled the Routing and Remote Access role on the server. Rather than manually
configure static routes on the server, you want to configure it to communicate with other
routers already in the network to dynamically build its routing table. Click on the routing
protocol you would use to do this.
You manage the intranet servers for EastSim Corporation. The company network has three
domains: eastsim.com, asiapac.eastsim.com, and emea.eastsim.com. The main company
Web site runs on the web1.eastsim.com server with a public IP address of 101.12.155.99. A
host record for the server already exists in the eastsim.com zone. You want Internet users to
be able to use the URL http://eastsim.com to reach the Web site. What should you do?
Your organization runs a Hyper-V hypervisor on a Windows Server 2008 R2 system that
hosts a mix of Windows Server 2008 R2 and Windows Server 2012 R2 virtual domain
controllers. You want to use snapshots to protect your virtual domain controllers on this
hypervisor host. However, you have heard that doing this can cause Update Sequence
Number (USN) rollback issues. What must you do to prevent this from happening? (Select
two. Each response is a part of the complete solution.)
You have a laptop that runs Windows 8 Enterprise. You want to use the laptop to connect to
your corporate intranet while you are at home or traveling. Your solution should meet the
following requirements: • The computer should connect automatically to the intranet without
user initiation. • All communications between your laptop and the intranet should be
encrypted. • The connection should allow for remote management of the computer from the
corporate intranet. • Internet traffic should be directed to Internet servers without going
through servers at the corporate network. • The solution should work through firewalls where
only HTTP and HTTPS are permitted. Which feature should you implement?
You manage a single domain named widgets.com. Organizational units (OUs) have been
created for each company department. User and computer accounts have been moved into
their corresponding OUs. Members of the Directors OU want to enforce longer passwords
than are required for the rest of the users. You define a new granular password policy with
the required settings. All users in the Directors OU are currently members of the
DirectorsGG group, a global security group in that OU. You apply the new password policy
to that group. Matt Barnes is the chief financial officer. He would like his account to have

10. even more strict password policies than is required for other members in the Directors OU.
What should you do?
You are the network administrator for a company that has just implemented Windows Server
2012 R2. To provide Internet access for your corporate office, you have decided to use a
firewall that provides NAT. On the private network, you install and configure DNS on a
Windows Server 2012 R2 server to provide name resolution. After you finish the
configuration, you realize that no one is able to access the Internet, but they are able to
contact internal servers by their FQDN. A ping test using the IP address of Internet hosts is
successful.
You are the network administrator for westsim.com. The network consists of a single
domain. All the servers run Windows Server 2012 R2. All the clients run Windows 8. There is
one main office located in Chicago. The main office is protected from the Internet by a
perimeter network. A server named VPN1 located in the perimeter network provides VPN
remote access for external clients. A server named NPS1 has the Network Policy Server
(NPS) role installed and provides RADIUS services for VPN1. NPS1 is located in the
perimeter network and is configured to use Active Directory for authentication requests.
There are three domain controllers on the internal network. A new company policy requires
that the firewall between the internal network and the perimeter network be configured to
allow traffic only between specific IP addresses. The amount of internal servers that can be
contacted from the perimeter network must be kept to a minimum. You need to configure
remote access to minimize the number of servers on the internal network that can be
contacted by servers on the perimeter network. Your solution should not impact the
availability of remote access services. What should you do?
As a result of a recent security audit, you have made several critical changes to your
domain's security configuration in Group Policy. You need these changes to be applied
immediately. You've right-clicked the Workstations OU in the Group Policy Management
console. Click the option you should use to refresh the Group Policy settings on all of the
workstations in this OU.
Your company has just decided to upgrade from an older non-directory-based server
operating system to Windows Server 2012 R2. You are in charge of designing the new
Active Directory tree. You have a small company that has only one location. You have
determined that you will have approximately 500 objects in your completed tree. The tree

11. design has been the subject of some controversy. In preliminary meetings, you have
determined that there are four primary areas of the company: Accounting, Manufacturing,
Sales, and Administration. Each area is autonomous and reports directly to the CEO. In
meetings on the Active Directory tree design, the manager of each area wants to make sure
that some management control of their users and resources remains in the department.
What should you do?
You manage the intranet servers for EastSim Corporation. The company network has three
domains: eastsim.com, asiapac.eastsim.com, and emea.eastsim.com. You create a primary
zone for the eastsim.com domain on the ns1.eastsim.com server. Two additional servers,
ns2.eastsim.com and ns3.eastsim.com hold secondary copies of the zone. One day the ns3
server fails. While it is offline, you want to remove server ns3 as an authoritative server for
the zone. What should you do?
You manage a network with a single location. You have previously deployed a WSUS server
in your location to specify the approved list of updates. All client computers are configured to
download updates from your local WSUS server. Members of the Accounting department
report that a new system update causes instability with their accounting software. You want
to prevent this update from being applied to the accounting department computers, but you
still want to ensure that all other updates are being applied as they should. What should you
do?
You are the network administrator for a network with a single Active Directory forest. All
domains in the forest are at Windows Server 2003 functional level and the forest is also at
Windows Server 2003 functional level. Offices exist in Denver, Chicago, and Miami. Each
geographic location has an Active Directory site configured. The links that connect the
Denver and Miami sites to the corporate headquarters in Chicago are highly utilized, and you
want to minimize replication traffic over them. Company headquarters is located in Chicago
and that location has multiple global catalog servers to service global queries efficiently.
Several users in Denver and Miami are members of universal groups throughout the forest.
You need to make sure that in the event of a WAN link failure that group membership will be
protected and logons will be available. What should you do?
You are a network engineer for a new company. The company will have offices in Denver,
Atlanta, and Phoenix. All sites will be connected using wide area network (WAN)
connections. The company will have a private network based on two Active Directory

12. domains. All servers, including domain controllers, will run Windows Server 2012 R2. All
servers will be members of an Active Directory domain. The company's research department
will be located in Phoenix and will have its own Active Directory domain named
research.corp.westsim.com. No other departments will be located in Phoenix. All other
departments will be located in Denver or Atlanta and will be part of an Active Directory
domain named corp.westsim.com. According to the Active Directory design, all
research.corp.westsim.com domain controllers will be located in Phoenix. Domain controllers
for the corp.westsim.com domain will be located in Denver and Atlanta. Each company site
will have at least one DNS server running on an Active Directory domain controller. All DNS
servers will be on DCs. You are designing zone configuration requirements for the
company's DNS zones. As part of your security plan, you must minimize the possibility of
DNS data be incorrectly modified by unauthorized servers that are impersonating actual
servers. What should you do? (Choose two. Each correct choice is part of the solution.)
Srv10 is a Windows Server 2012 R2 server that runs server core. Srv5 is a Windows Server
2012 R2 server that runs with a graphical interface. Over the next few days, you want to
monitor Srv10. You would like to automatically save the contents of the Application and
System logs on Srv10 to Srv5. You will then use Event Viewer on Srv5 to view the contents
of the logs from Srv10. Because you will be checking for events periodically throughout the
day, you want to make sure that the events saved on Srv5 are no more than 15 minutes old.
What should you do?
Your network has a single Active Directory forest with two domains: eastsim.private and
HQ.eastsim.private. Organizational units Accounting, Marketing, and Sales represent
departments of the HQ domain. Additional OUs (not pictured) exist in both
theeastsim.private and HQ.eastsim.private domains. All user and computer accounts for all
departments company-wide are in their respective departmental OUs. You are in the
process of designing Group Policy for the network. You want to accomplish the following
goals: • You want to enforce strong passwords throughout the entire forest for all computers.
All computers in both domains should use the same password settings. • The Accounting
department has a custom software application that needs to be installed on computers in
that department. • Computers in the Marketing and Sales departments need to use a custom
background and prevent access to the Run command. You create the following three GPOs
with the appropriate settings: Password Settings, Accounting App, and Desktop Settings.

13. How should you link the GPOs to meet the design objectives? To answer, drag the label
corresponding to the GPO to the appropriate boxes.
You have decided to implement Network Access Protection (NAP) with 802.1x
authentication on your network. You have installed the Network Access and Policy Server
role, configured the System Health Validator (SHV), created health policies, and configured
network policies. Which additional steps will you need to perform to complete the
configuration? (Select two. Each choice is a possible action.)
You are the network administrator for your company. Your company uses Windows 8 as its
desktop operating system. All computers are joined to a single Active Directory domain.
Several computers store sensitive information. You are configuring security settings that will
be distributed to all computers on your network. You want to identify attempts to break into a
computer by having the computer that denies the authentication attempt note the failed
attempt in its Security event log. You want to use an advanced audit policy to accomplish
this. What should you do?
You are configuring a new network policy for temporary employees using the New Network
Policy wizard in the Network Policy Server console. If the conditions and constraints you
configured in the policy are met and the policy grants access to a client, you want
non-compliant clients to be allowed access only to a restricted network where their system
can be remediated before being granted full network access. Click the settings category you
would use to configure this
You have a file server that has the File Services role installed. The E: drive is used for
storing files for the graphic artists. The E:Graphics folder holds all shared graphic files used
by all artists. The E:Users folder contains subfolders for user home directories, with one
subfolder for each user. You would like to keep track of disk space usage by user. You
would like to be notified whenever a user has more than 100 MB of files on the E: drive.
What should you do?
Your network has two sites as shown in the graphic. You want to configure Universal Group
Membership Caching. Which object's properties would you edit to accomplish this?
You are the DNS manager for the southsim.com domain. You want to configure your single
DNS server so that it never uses forwarders for name resolution. What should you do?

14. You are the network administrator for a network with a single Active Directory parent domain
and two child domains. All domain controllers are running Windows Server 2012 R2. You are
responsible for disaster recovery across the entire network. You decide to use Windows
Server Backup. You schedule full server backups to be taken every night, along with a
system state backup an hour later. On Friday morning, you are creating new users in the
Accounting OU when you receive an error stating that the user cannot be created because
the context could not be found. After some investigation you find that a co-worker has
deleted the OU and the change has replicated to all domain controllers. You want to restore
the latest version of the OU without affecting the rest of Active Directory. What should you do
You are configuring a new network policy for temporary employees using the New Network
Policy wizard in the Network Policy Server console. If the conditions and constraints you
configured in the policy are met and the policy grants access to a client, you want the policy
to apply 128-bit MPPE. Click the settings category you would use to do this
You have created a DFS namespace that is accessed using westsim.comAccounting. The
namespace currently has a single folder named Accounting, with two targets. You want to
configure DFS replication so that data can only be modified on Srv1, with all changes being
replicated to Srv2. Users should not be able to make changes to files on Srv2. You want to
follow Microsoft's recommendations for doing this. What should you do?