Font size
WorksheetsActive Directory Domain Services (AD DS) Fundamentals Quiz
Total questions: 109
Worksheet time: 55mins
Which of the following are defining characteristics of an AD DS forest? (Choose two)
Each domain in a forest has its own unique schema and configuration partitions.
Forests are security boundaries, restricting resource access to security principals within the forest.
Forests are replicated between domain controllers in different forests.
Forests are replication boundaries for the domain global catalog.
What is the primary role of the Schema master in an Active Directory Domain Services (AD DS) forest?
Managing changes to the AD DS configuration when domains are added or removed.
Maintaining administrative privileges throughout the forest.
Ensuring the availability of the global catalog across all domain controllers.
Overseeing modifications to the AD DS schema.
Which of the following best defines a characteristic of an Active Directory Domain Services (AD DS) domain?
Each domain is an administrative boundary, allowing full administrative control only to the Domain Admins group.
Domains are replication boundaries, with changes to domain objects replicated between domains.
Each domain has its own unique schema and configuration partitions.
Domains are high-level containers that store objects such as users, groups, computers, and other OUs.
What is one purpose of Organizational Units (OUs) in Active Directory?
To store user and computer account passwords.
To host built-in domain local groups.
To delegate administrative tasks to smaller teams or individuals at departmental levels.
To manage domain controller replication.
What does the Active Directory Domain Services (AD DS) schema define?
The number of objects in a domain.
The location of domain controllers within each site found in a forest.
Types of objects, attributes of those objects, and the AD DS structure.
The naming conventions for OUs.
What is the purpose of the Active Directory Schema console?
To create new user accounts in Active Directory.
To manage the incoming trust relationships between domains in the same forest.
To edit the schema directly and make changes to object classes and attributes.
To manage domain controller replication.
What is required to edit the schema directly and make changes to object classes and attributes in Active Directory?
To edit the schema directly and make changes to object classes and attributes.
To configure Group Policy Objects (GPOs) for domain-wide settings.
To manage user accounts.
To set up file sharing services.
Which method is recommended for securing Domain Controllers (DCs) in branch offices where physical security is challenging?
Deploying Read-only Domain Controllers (RODCs) and enabling BitLocker Drive Encryption.
Configuring DCs to use single-factor authentication.
Storing DC backups on unencrypted external hard drives.
Disabling Lightweight Directory Access Protocol (LDAP) on DCs.
What service does a Domain Controller (DC) advertise using SRV records in DNS?
Active Directory services
File sharing services
Print services
Domain Name System (DNS) services
How can you designate a Domain Controller (DC) as a global catalog server in Active Directory?
During AD DS promotion or using the Active Directory Sites and Services tool after promotion.
By configuring it as the forest root domain controller.
By promoting it to be a read-only Domain Controller (RODC).
By adding it to the Enterprise Admins universal security group.
In a multiple-domain environment, what is the recommendation regarding the deployment of global catalog servers?
Ensure that DCs with the infrastructure operations master role are not global catalog servers.
Make all DCs global catalog servers regardless of their roles.
Deploy at least one global catalog server per domain.
Deploy at least one global catalog server per physical AD DS site.
The Kerberos authentication service is available on which port?
88 over TCP and UDP.
464 over TCP and UDP.
TCP port 389.
TCP port 3268.
Which domain controller (DC) is selected when there is a tie in the lowest numerical priority value for a specific operation?
The DC with the lowest numerical weight value.
The DC with the highest numerical priority value.
The DC with the highest numerical priority value, and if tied, the one with the highest weight value.
The DC with the lowest numerical priority value, and if tied, the one with the highest weight value.
What is the impact of the PDC emulator operations master role becoming unavailable?
Low impact, as it only prevents schema modifications.
Medium impact, as it prevents the creation of new security principals.
High impact, affecting password changes, GPO management, and time synchronization.
No impact, as it does not affect directory functionality.
When should you consider transferring or seizing an operations master role?
When planning software updates for a domain controller.
When deploying a new RODC in the forest.
Prior to taking the role holder offline for planned maintenance.
When adding a new user to the domain.
Which tool would you use to determine the current holder of the RID master operations master role?
Active Directory Users and Computers
Active Directory Schema
Active Directory Domains and Trusts
Active Directory Sites and Services
Which TWO methods can be used to install the Active Directory Domain Services role on a Server Core server? (Choose 2)
Use Server Manager on the Server Core server to add the role.
Open Server Manager on another computer and connect to the Server Core server to add the role.
Use an elevated Windows PowerShell command prompt to run Install-WindowsFeature AD-Domain-Services.
Use the Active Directory Domain Services Configuration Wizard on the Server Core server.
What is the purpose of the "Install from media" option when deploying a Domain Controller (DC)?
To synchronize time between DCs during the promotion process.
To populate the AD DS database without needing to replicate from another DC.
To verify the functionality of SRV records in DNS.
To clone existing DCs for accelerated deployment.
What is the first step in preparing the source virtual DC for cloning?
Add the source DC to the Cloneable Domain Controllers group.
Verify the functionality of SRV records in DNS.
Run the Active Directory Domain Services Configuration Wizard.
Install the DNS Server role on the source DC.
What is a best practice for virtualizing Domain Controllers (DCs)?
Synchronize time between virtualized DCs and physical computers.
Use checkpoints to create backup copies of DCs for easy restoration.
Deploy only one virtualized DC to minimize resource consumption.
Use a hypervisor that does not support VM generation IDs.
What is the primary purpose of Microsoft Entra ID?
Providing authentication and authorization for cloud apps and services
Managing on-premises infrastructure and apps
Supporting directory-aware apps in on-premises environments
Implementing role-based access control for on-premises resources
Which feature is NOT characteristic of Microsoft Entra ID?
Hierarchical structure
Conditional access
Multifactor authentication (MFA)
Compliance with widely used authentication standards
Which Microsoft Entra ID edition is included with Office 365 subscriptions?
Office 365 apps
Free
Premium P1
Premium P2
What administration tools are used to manage Microsoft Entra ID?
Using the Microsoft Entra admin center or Windows PowerShell
The Microsoft Entra ID Domain Services command-line interface
Exclusively through PowerShell scripts
The Azure portal and navigating to the Microsoft Entra ID section
What are objects in Active Directory?
Types of records within the Active Directory database
Different types of folders
Types of databases within Active Directory
Types of users within the network
What type of information can be stored in user accounts in Active Directory?
Only security-related information
Only personal information
Both security-related and personal information
Only group membership information
What is the purpose of the User Principal Name (UPN) in Active Directory?
To provide a user's first name
To display like an email address and must be unique in the forest
To provide the user's last name
To display the user's full name
What is the purpose of enabling the "Store password using reversible encryption" setting in Active Directory?
It allows users to sign in using smart cards
It prevents users from changing their passwords
It stores passwords in a less secure format for legacy protocols and applications
It allows computers to impersonate users to access network resources
Where can Fine Grained Password Policies be created?
Active Directory Users and Computers
Group Policy Management Console
AD Administrative Center
Active Directory Sites and Services
Which tab in Active Directory includes attributes for configuring information such as job title, department, and manager?
Profile tab
General tab
Member of tab
Organization tab
What problem with roaming profiles led Microsoft to consider them a legacy feature?
Profiles can become extremely large, leading to delays and network traffic
Users cannot access their profiles from different computers
Roaming profiles do not replicate changes back to the server
Roaming profiles are not compatible with modern applications
What happens to the security identifier (SID) of a user account when it is deleted?
The SID is reused for new accounts.
The SID is temporarily disabled.
The SID is permanently deleted and cannot be reused.
The SID is transferred to another user account.
What is the recommended best practice regarding user account management to avoid SID-related issues?
Regularly delete unused accounts to prevent SID conflicts.
Disable accounts instead of deleting them when they are not needed.
Reuse SIDs to minimize the number of unique identifiers in the system.
Use a third-party tool to manage user accounts more effectively.
Which command-line tool can be used to create computer, user, group, and other types of objects in Active Directory?
dsmod
csvde
ldifde
dsadd
What is a template account used for in Active Directory?
To disable user accounts
To create multiple similar user accounts
To delete user accounts
To manage group membership
Which attributes of a user account are typically not copied from a template account when creating a new user account?
First name and last name
Account expiration date
Group membership
Logon hours and department
What environment variable can be used in UNC paths to indicate that a folder should be created matching the user's name?
%username%
%profile%
Which of the following is NOT a method for managing objects in Azure AD?
Using AD Users and Computers
Using AD Administrative Center
Using PowerShell scripts
Using the Azure portal as a Guest Account
What advantage does using groups offer in terms of administration?
Groups allow for easier management of user profiles.
Groups simplify administration by allowing for the assignment of permissions and rights to multiple users in a single operation.
Groups eliminate the need for individual user accounts.
Groups ensure compatibility with legacy systems.
What is the major difference between security groups and distribution groups in Active Directory?
Security groups are primarily used for email distribution, while distribution groups are used to assign rights and permissions.
Security groups have SIDs and can be used to assign rights and permissions, while distribution groups do not have SIDs and cannot be used for this purpose.
Distribution groups have SIDs and can be used to assign rights and permissions, while security groups do not have SIDs and cannot be used for this purpose.
Security groups are used for both email distribution and assigning rights and permissions, while distribution groups are used only for email distribution.
What consequence does converting a security group to a distribution group have?
The group gains a SID, allowing assignment of rights and permissions.
The group loses all permissions and rights assigned to it.
The group retains its permissions but gains email distribution capabilities.
The group loses its email distribution capabilities but retains its permissions.
Which group scope allows for the assignment of rights and permissions within the domain they were created in, but cannot be used in other domains in the forest?
Local group
Domain Local group
Global group
Universal group
Which statement accurately describes the nesting rules for group types in Active Directory?
Local groups can contain other local groups, but cannot contain global or universal groups.
Domain Local groups can contain only global groups from the local domain.
Universal groups can only contain global groups from the local domain.
Universal groups can contain global and universal groups from any domain in the forest.
How can you manage group membership across multiple computers using Group Policy in Active Directory?
By configuring permissions through the Group Policy Management Console.
By creating a custom administrative role through PowerShell scripting.
By adding users individually to each computer's local Administrators group.
By using the Restricted Groups node in Group Policy to automatically assign membership to a specified group.
What privileges does the Administrators group in the forest root domain have?
Full administrative rights only on member servers.
Full administrative rights on all domain controllers in the forest.
Limited administrative rights restricted to specific OU.
No administrative rights within the forest.
True or False: Ordinary users have the right to sign in locally at DCs.
True
False
What is a characteristic of protected groups in Active Directory?
Protected group members inherit ACLs from the protected group, rather than the OU in which the user account is located.
Adding a user to a protected group prevents them from accessing resources in the network.
Members of protected groups inherit permissions from the organizational unit (OU) where their user account is located.
Protected groups can be modified by any user with administrative privileges.
Which of the following statements about special identities is true?
Special identities cannot be assigned permissions or rights.
Special identities are managed manually by administrators.
Special identities can be deleted by domain admins.
Special identities are only available in workgroup environments.
Which of the following statements about special identities in Active Directory is correct?
Special identities can be managed and assigned permissions and rights.
Special identities cannot be managed but can be assigned permissions and rights.
Special identities can be deleted by administrators.
Special identities are only available to domain administrators.
Which of the following are options available for populating group members when creating groups in the Azure portal? (Choose three.)
Assigned, Dynamic Computer, Dynamic User
Static User, Static Computer, Dynamic User
Assigned, Static Computer, Dynamic User
Assigned, Dynamic Computer, Static User
What validates a computer as a legitimate member of the domain when it starts?
Providing its IP address to the DC.
Providing its secret password to the DC.
Providing its hostname to the DC.
Providing its MAC address to the DC.
What is the main difference between a default container and an Organizational Unit (OU) in Active Directory?
Default containers allow group policies to be linked, while OUs do not.
OUs can only contain user objects, while default containers can contain both user and computer objects.
Default containers support LDAP queries, while OUs do not.
OUs can be nested within other OUs, while default containers cannot.
Which command can be used to change the default location for computer objects in Active Directory?
redirusr
rediobj
redircmp
redirgrp
What is the LDAP distinguished name for the default Computers container in the Contoso.com domain?
OU=Computers,DC=Contoso,DC=com
CN=Computers,DC=Contoso,DC=com
DC=Computers,OU=Contoso,DC=com
CN=Contoso,OU=Computers,DC=com
Which group is typically given the permission to create and manage computer objects in Active Directory by default?
Authenticated Users
Backup Operators
Domain Guests
Domain Admins
What is the main difference between creating a computer object using user rights and using permissions in Active Directory?
User rights allow unlimited computer creations, while permissions are limited.
User rights set the owner of the computer object to Domain Admins, while permissions set the owner to the creator.
User rights can only be assigned to specific users, while permissions can be assigned to groups.
User rights require administrative approval, while permissions do not.
What is the purpose of the offline domain join file created using djoin.exe?
It contains the computer's current password.
It enables the computer to communicate with the domain controller in real-time.
It provides a backup of the computer's configuration.
It allows a computer to be joined to the domain without real-time connectivity.
What is the purpose of providing credentials when joining a computer to the domain?
To perform a system backup
To enable remote desktop access
To authenticate the computer to the domain
To install additional software packages
What prompt will appear after successfully joining a computer to the domain?
Configure network settings
Restart the computer
Install Windows updates
Set up a user account
What is the term used for creating the computer account in Active Directory before joining the computer to the domain?
Preconfiguration
Prerendering
Prestaging
Preinstallation
What is required to perform a hybrid join for a computer?
Install a third-party antivirus software
Deploy the Azure AD connector on-premises
Use a cloud-based management tool
Activate Windows Defender Firewall
How can you verify if a hybrid join was successful from the target computer?
Run the command dsregcmd /status in an administrator command prompt
Check the System Properties window
Open the Event Viewer and search for hybrid join events
Review the Computer Management console
What is the consequence of reinstalling an operating system on a computer that retains its previous name, but has a new SID?
The computer automatically authenticates with the domain using its previous password.
The computer's secret password is reset to its initial value.
The computer cannot authenticate with the domain due to the new SID.
The computer connects to the domain using its old SID.
What command can you use to repair the secure channel of a computer with the domain using PowerShell?
Reset-ComputerSecureChannel -Repair
Repair-ADComputerSecureChannel
Repair-SecureChannel -Computer
Test-ComputerSecureChannel -Repair
Which PowerShell cmdlet is used to modify properties of a user account?
Set-ADUserModifies
Update-ADUser
Change-ADUserAttributes
Set-ADUser
True or False: If the AccountPassword parameter is not provided during account creation the user account is created in a disabled state.
True
False
How would you specify that a newly created group named "MarketingTeam" should be a security group with a global scope?
New-ADGroup -Name "MarketingTeam" -GroupScope DomainLocal -GroupCategory Security
New-ADGroup -Name "MarketingTeam" -GroupScope Universal -GroupCategory Distribution
New-ADGroup -Name "MarketingTeam" -GroupScope Global -GroupCategory Distribution
New-ADGroup -Name "MarketingTeam" -GroupScope Global -GroupCategory Security
If you want to modify properties of a computer account in Active Directory, which cmdlet would you use?
Modify-ADComputer
Edit-ADComputer
Update-ADComputer
Set-ADComputer
Which cmdlet is used to create a new organizational unit (OU) in Active Directory?
Create-ADOrganizationalUnit
New-ADOU
New-OrganizationalUnit
New-ADOrganizationalUnit
What is a common example of using PowerShell for bulk operations in Active Directory?
Deleting individual user accounts
Modifying the properties of an existing user account
Creating users from a list of accounts in a CSV file
Resetting the password for a user account
Which parameter of the Get-AD* cmdlets defines the AD DS path to begin searching?
StartPath
BasePath
SearchBase
SearchPath
Which symbols are used to surround the query in PowerShell when using the Filter parameter?
( and )
{ and }
[ and ]
< and >
What is the purpose of using the Properties parameter in the Get-AD* cmdlets?
To specify the type of object to retrieve
To define the scope of the search
To retrieve specific attributes of the objects
To filter the results based on specified criteria
Which parameter of the Search-ADAccount cmdlet retrieves a list of accounts that have passwords that will expire within a specified period?
PasswordExpired
PasswordExpiring
AccountExpiring
TimeSpan
What character is used to connect the output of one cmdlet to the input of another cmdlet in PowerShell?
>
|
<
/
What cmdlet is used to read the information in a text file in PowerShell?
Read-File
Get-Content
Read-Content
Import-File
How are attributes represented in the first row of a CSV file?
In parentheses
In square brackets
As column names
As row numbers
What character is used to indicate a blank attribute for a particular user in a CSV file?
-
/
:
,,
What PowerShell construct is used to iterate over the list of objects in the CSV file in the provided code snippet?
For loop
While loop
Do-While loop
Foreach loop
What is one benefit of carefully planning the Organizational Unit (OU) structure?
Facilitating user authentication
Improving network security
Efficiently delegating administrative rights and applying Group Policy
Reducing the number of objects in the Active Directory domain
What is a benefit of using a location-based OU planning strategy?
Facilitating centralized administration
Ensuring frequent reorganization of locations
Decentralizing administration to various levels
Making user and computer movements between locations easier
What would be good advice regarding the complexity of the OU structure in a resource-based strategy?
Keep it simple and avoid unnecessary complications
Expand the structure to include as many OUs as possible
Create separate OUs for every individual object
Prioritize detailed hierarchy over simplicity
What is a potential limitation of the organization-based OU planning strategy?
It is not suited for organizations with stable structures
It is not suited for organizations with fluid job roles
It is not suited for organizations with multiple locations
It is not suited for organizations with limited resources
What is a common approach used by most organizations when structuring their OUs?
Utilizing a single, overarching strategy for all OUs
Employing a combination of strategies, with high-level OUs representing either locations or departments
Creating separate OUs for each individual object
Assigning distinct policies for each OU based on its function
How can administrative control be delegated in Active Directory?
By setting permissions on individual objects within the domain
By creating a new domain for each user
By assigning all rights to a single administrator
By disabling user accounts
Which of the following is a method for setting which administrator has what permissions for an Organizational Unit (OU) and its contents in Active Directory?
By setting permissions on OUs to indicate which administrator has what permissions for that OU and its contents
By deleting unused OUs regularly
By renaming OUs frequently
By disabling all permissions on OUs
Why is it important to consider the ability to block permissions and policy inheritance when designing the OU structure in Active Directory?
To allow for selective control over which OUs inherit permissions and policies from parent OUs
To ensure all OUs have the same permissions
To prevent OUs from being deleted
To make the domain slower
Which two command line tools can be used to create OUs in Active Directory? (Choose two.)
Command-line tools like dsadd OU
PowerShell cmdlets such as New-ADOrganizationalUnit
Active Directory Administrative Center
LDAP distinguished name
What features introduced with Windows Server 2008 R2 help prevent the unintentional removal of Organizational Units (OUs) and their contents? (Choose two.)
AD recycle bin
Prevent Accidental Deletion attribute
Active Directory Administrative Center
LDAP distinguished name
Where can you access advanced settings for setting granular permissions in Active Directory?
From the Advanced settings in the Security tab of the OU or object
From the Command Prompt
From the Group Policy Management Console
From the Active Directory Administrative Center
What level of permissions allows an administrator to apply changes to an OU and all objects within it?
This object and all descendent objects
This object only
This object and all sibling objects
This object and all parent objects
Which of the following is a reason for creating exceptions within the hierarchy in Active Directory?
To create exceptions within the hierarchy
To enforce default security settings
To simplify permissions management
To grant full control permissions to all objects
What are the individual entries in the Discretionary Access Control List (DACL) referred to as?
Access Control Entries (ACEs)
Security Principals
System Access Control Entries (SACEs)
Discretionary Access Control Entries (DACEs)
Who initially owns an object in Active Directory, and what control do they have over it?
The user who created the object, with full control.
The domain administrator, with read-only control.
The group with the highest permissions, with write control.
The system administrator, with modify permissions.
What is the risk associated with giving an administrator full control over an OU?
Accidental or malicious deletion of objects
Overwriting existing permissions
Inability to modify objects within the OU
Limited visibility into object properties
How can you access the Delegation of Control Wizard in Active Directory?
Right-clicking on the container and choosing "Delegate Control"
Through PowerShell commands
Via the Active Directory Administrative Center
By modifying the registry settings
What permissions are required, at minimum, to move an object in Active Directory?
Delete all child objects permission on the source OU, Write permission for the object, and Create all child objects permission on the destination OU
Read permission on the source OU and Write permission on the destination OU
Full control permission on the source OU and Read permission on the destination OU
Modify permission on the source OU and Create permission on the destination OU
What forms the security boundary in an AD DS forest by default?
The schema naming context
The forest itself
The Global Catalog servers
The configuration naming context
What is a characteristic of the replication boundary for DCs designated as Global Catalog servers?
It contains full copies of objects only within their own domain
It contains full copies of objects from all domains within the forest
It restricts access to security principals within the forest
It shares a subset of attributes with DCs serving as Global Catalogs in other forests
What does the creation of multiple domains within the same forest not provide from a security standpoint?
Administrative autonomy
Full isolation
Centralized administration
Segregation of administrative duties
What might be a reason for configuring separate domains in an AD DS environment based on bandwidth limitations?
To achieve administrative autonomy
To centralize administration of forest-level operations
To facilitate strict oversight over changes
To minimize replication traffic volume
What is a common reason for implementing multiple forests in an AD DS environment to address regulatory and compliance dependencies?
To achieve administrative autonomy
To minimize replication traffic volume
To eliminate replication traffic entirely
To comply with data residency requirements
What option involves the cloud provider managing the Domain Controllers (DCs) in a public cloud environment?
Infrastructure as a service (IaaS)
Platform as a service (PaaS)
On-premises deployment
Hybrid cloud deployment
What IP configuration method is recommended for Azure VMs hosting AD DS Domain Controllers?
Static IP configuration
DHCP
IPv6 only
Manual IP configuration
What is a common task in the implementation of self-service in Active Directory Domain Services (AD DS) environments?
Delegating user management tasks to IT administrators
Allowing users to unlock their accounts or reset their passwords
Restricting users from creating groups or managing their membership
Disabling self-service options for users
What feature of Microsoft Identity Manager (MIM) allows users to unlock their accounts or reset their passwords?
Multifactor authentication (MFA) support
Group maintenance via approval-based workflows
Certificate management
Privileged Access Management (PAM)
What do functional levels determine in Active Directory Domain Services (AD DS) environments?
The number of domains allowed in a forest
The number of Group Policy Objects (GPOs) that can be linked to a domain
The supported operating systems for domain-joined computers
The capabilities available in domains and forests
What is the minimum forest and domain-functional level required to host Windows Server 2022 Domain Controllers (DCs)?
Windows Server 2003
Windows Server 2008
Windows Server 2012
Windows Server 2016
True or False: The domain-functional levels can be less than the level assigned to the forest-functional level.
True
False
