Font size
WorksheetsWindows Server 2012 R2 - Exam 2 - Quiz 7
Total questions: 25
Worksheet time: 15mins
Which of the following is true about organizational units? (Choose all that apply.)
OUs can be added to an object’s DACL.
OUs can be nested.
A group policy can be linked to an OU.
Only members of Domain Administrators can work with OUs.
You want to see the permissions set on an OU, so you open Active Directory Users and Computers, right-click the OU, and click Properties. After clicking all the available tabs, you can’t seem to find where permissions are set in the Properties dialog box. What should you do?
Log on as a member of Enterprise Admins and try again.
In the Properties dialog box, click the Advanced button.
Right-click the OU and click Security.
In Active Directory Users and Computers, click View, Advanced Features.
You have hired a new junior administrator and created an account for her with the logon name JrAdmin. You want her to be able to reset user accounts and modify group memberships for users in the Operations department whose accounts are in the Operations OU. You want to do this with the least effort and without giving JrAdmin broader capabilities. What should you do?
In Active Directory Administrative Center, right-click the Operations OU, click Properties, and click Managed By.
In Active Directory Users and Computers, right-click the Operations OU and click Delegate Control.
Open the Operations Security tab and add JrAdmin to the DACL.
Add JrAdmin to the Password Managers domain local group.
Another administrator has been changing permissions on the Operations OU by adding some groups and users to the DACL. You’re concerned that the JrAdmin account has been given more access to the OU than it should have. You need to see all permissions the JrAdmin account has to the Operations OU. What should you do?
In Active Directory Users and Computers, right-click the JrAdmin account, click Properties, and view her group memberships.
In Active Directory Administrative Center, run the Permissions Wizard and select JrAdmin as the target.
In Active Directory Users and Computers, enable Advanced Features, open the Operations OU’s Properties dialog box, and navigate to the Effective Access tab.
In Active Directory Administrative Center, open JrAdmin’s account properties and click the Manager Of tab.
An account named SrAdmin created an OU named QandA under the Operations OU. Which of the following is true by default?
Domain Admins is the owner of the QandA OU.
SrAdmin is the owner of the QandA OU and all objects created inside it.
SrAdmin has all standard permissions except Full control for the QandA OU.
The Everyone group has Read permission to the QandA OU.
Which of the following is a user account category? (Choose all that apply.)
Local
Global
Domain
Universal
Which of the following is a built-in user account? (Choose all that apply.)
Administrator
Operator
Anonymous
Guest
Sam*Snead is a valid user account name. True or False?
True
False
Which of the following is true about user accounts in a Windows Server 2012/R2 domain? (Choose all that apply.)
The name can be from 1 to 20 characters.
The name is case sensitive.
The name can’t be duplicated in the domain.
Using default settings, PASSWORD123 is a valid password.
Which of the following account options can’t be set together? (Choose all that apply.)
User must change password at next logon.
Store password using reversible encryption.
Password never expires.
Account is disabled.
Global groups can have domain local groups as members. True or False?
True
False
Jane has left the company. Her user account is a member of several groups and has permissions and rights to a number of forest-wide resources. Jane’s replacement will arrive in a couple of weeks and needs access to the same resources. What’s the best course of action?
Find all groups Jane is a member of and make a note of them. Delete Jane’s user account and create a new account for the new employee. Add the new account to all the groups Jane was a member of.
Copy Jane’s user account and give the copy another name.
Disable Jane’s account. When the new employee arrives, rename Jane’s account, assign it a new password, and enable it again.
Export Jane’s account and then import it when the new employee arrives. Rename the account and assign it a new password.
Over the past several months, Tom, who has access to sensitive company information, has logged on to computers in other departments and left them without logging off. You have discussed the matter with him, but the problem continues to occur. You’re concerned that someone could access these sensitive resources easily. What’s the best way to solve this problem?
Ensure that all computers Tom is logging on to have screen savers set to lock the computer after 15 minutes of inactivity.
Specify which computers Tom can log on to in the domain by using the Log On To option in his account’s properties.
Move Tom’s account and computer to another domain, thereby making it impossible for him to log on to computers that are members of different domains.
Disable local logon for Tom’s account on all computers except Tom’s.
You have noticed inappropriate use of computers for gaming and Internet downloads by some employees who come in after hours and on weekends. These employees don’t have valid work assignments during these times. You have been asked to devise a solution for these employees that doesn’t affect other employees or these employees’ computers during working hours. What’s the best solution?
Install personal firewall software on their computers in an attempt to block the gaming and Internet traffic.
Request that the Maintenance Department change the locks on their office doors so that they can enter only during prescribed hours.
Set the Logon Hours options for their user accounts.
Before you leave each evening and before the weekend, disable these employees’ accounts and reenable them the next working day.
The Users domain local group in the Builtin folder can be a member of the local Administrators group on a Windows client OS computer. True or False?
True
False
Which of the following is considered a security principal? (Choose all that apply.)
Contacts
Computer accounts
User accounts
Distribution groups
Which of the following is a valid group scope? (Choose all that apply.)
Global
Domain local
Forest
Domain global
What happens if a security group that’s an ACE in a shared folder is converted to a distribution group?
A security group can’t be converted to a distribution group if it has already been assigned permissions.
The group is removed from the DACL automatically.
The group remains in the DACL, but the ACE has no effect on members’ access to the resource.
The group remains in the DACL, and permissions assigned to the group affect access to the resource as though it were still a security group.
Which of the following can be a member of a universal group? (Choose all that apply.)
User accounts from the local domain only
Global groups from any domain in the forest
Other universal groups
Domain local groups from the local domain only
Which direct group scope conversion is allowed?
Domain local to universal, provided no domain local group is already a member
Global to domain local, without restriction
Domain local to global, provided no domain local group is already a member
Universal to global, without restriction
Which of the following is true about the Users domain local group?
It’s in the Users folder.
It can be converted to a global group.
Domain Users is a member.
Its members can log on locally to a domain controller.
A domain user logging on to the domain becomes a member of which special identity group?
Creator Owner
System
Authenticated Users
Anonymous Logon
Which of the following creates a file named disabled.txt containing a list of disabled Active Directory accounts?
net accounts /show disabled
ldifde -accounts -property=enabled -value=false
Query-Account -Disable=True | disabled.txt
Search-ADAccount -AccountDisabled > disabled.txt
A user is having trouble logging on to the domain from a computer that has been out of service for several months, and nobody else can seem to log on from the computer. What should you try first to solve the problem?
Reinstall Windows on the workstation and create a new computer account in the domain.
Rename the computer and create a new computer account with the new name.
Reset the computer account, remove the computer from the domain, and rejoin it to the domain.
Disable the computer account, remove the computer from the domain, and rejoin it to the domain.
Which commands can you use together to change attributes of several users at once?
dsget and dsadd
dsget and dsmod
dsquery and dsmod
dsquery and dsget
