Certkingdom Exam Preparation Tools, CCIE lab, CCNA Exams, CCNP Exams, CCIE Written Exams

Friday, December 2, 2011

Free Microsoft 70-291 Q & A / Study Guide – part III

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

QUESTION 704:

A. The number of hours after which the fail account should be reset to zero.
B. Whether or not the Recovery attempt should be recorded in the System event log.
C. The number of minutes to wait before the service is restarted.
D. Whether or not the complete memory dump should be saved when the computer is
restarted.

Answer: C

Explaination: The Recovery tab of the Properties dialog box has the option to the
number of minutes to wait before the service is restarted.
Incorrect Answers:
A, B, D: You cannot configure the number of hours after which the fail account should
be reset to zero; or the whether or not the complete memory dump should be saved when
the computer is restarted, or whether or not the Recovery attempt should be recorded in
the System event log.

QUESTION 705:

A. Your first step should be to remove Certkingdom -SR30 from the domain.
Thereafter Certkingdom -SR30 can be rejoined to the domain.
B. To ensure that the user can log on to the domain the user account needs to be added to
the Administrators group on Certkingdom -SR30.
C. You should reset the computer account of Mia Hamm in Active Directory and
Computers to ensure that she will be able to log on to the domain.
D. Your best option would be to add the user account of Mia Hamm to the Power Users
group on Certkingdom -SR30.

Answer: A

Explaination: It is most probably the case that her password has expired. You need
to join the domain with Certkingdom -SR30. Doing this will allow the domain to
authenticate the computer. The password on the domain is regenerated
automatically when the computer rejoins the domain.
Incorrect Answers:
B, D: Mia Hamm does not belong either to the Administrators group or the Power Users
group. You cannot even access the computer with your user account as the administrator.
C: This method will not work properly. You should not reset computer accounts in the
Active Directory and Computers.

QUESTION 706:

A. On all the client computers, enable Shadow Copies.
B. On all the client computers, install the Previous Versions client software.
C. On Certkingdom -SR12 configure disk quotas for all users.
D. On all the client computers, enable disk quotas.

Answer: B

Explaination: Shadow Copies provides periodic snapshots of shared folders on
specific volumes on hard disks.
Incorrect Answers:
A: You cannot do this, because the server side of this feature is not supported by the
client computers.
C, D: Disk quotas are used to limit the amount of disk space. This this not needed in this
scenario.

QUESTION 707:

A. To ensure that Certkingdom -SR10 continues to operate you need to boot from the
Windows Server 2003 installation CD.
Thereafter you can restore the ASR restore.
B. Your best option is to restart Certkingdom -SR10 in Directory Services Restore Mode.
Thereafter you can execute a non-authoritative restore of the CA database.
C. Your first step should be to restart Certkingdom -SR10 in Directory Services Restore
Mode.
Then you can execute an authoritative restore of the CA database.
D. Your best option would be to restore System State from the most recent ASR backup.

Answer: D

Explaination: This is a collection of files (System State) that contains the information
that is needed to rebuild an identical copy of the computer.
Incorrect Answers:
A: It is no need to ASR because the drive C which contains the operating system is not
damage.
B, C: You cannot start Certkingdom -SR10 in Directory Services Restore Mode, because it is
not a domain controller.

QUESTION 708:

A. To comply with the requirements of the CIO you need to allow shadow copies on the
user workstations.
B. Periodical backups need to be executed in order to comply with the requirements.
C. Your best option would be to create a share folder on a new volume on
Certkingdom -SR21 as well as enabling shadow copies.
D. The Previous Versions software needs to be deployed on Certkingdom -SR21 in order
to comply with the instruction of the CIO.

Answer: C

Explaination: Shadow Copies provides periodic snapshots of shared folders on
specific volumes on hard disks.
Incorrect Answers:
A: The user workstations run Windows XP Professional, shadow copies is new and
resides in Windows Server 2003.
B: You should perform periodic backups of all documentation. However these backup
would not be available immediately.
D: The Previous Versions software should be deployed on the user workstations not the
server.

QUESTION 709:

You receive an instruction from the CIO to identify the reason for the new response.
Which component should you identify?

A. A possible reason for the slow response time is the Network Adapter
B. The Processor is the possible cause for the slow response time.
C. The component causing the slow response is the Hard disk
D. The slow response time of the server is caused by the Memory.

Answer: D

Explaination: The memory reports an average of only 20 MB available. The value
should remain 5 % of the total system memory.
Incorrect Answers:
A, B: These counters do not indicate a cause of a bottleneck.
C: The hard disks are very busy. It should remain below 50 %. You should first check the
memory before you identify the hard disk as the source of the bottleneck.

QUESTION 710:

A. You should make use of the Network Monitor utility to identify the users who violates
the security policy.
B. The IP Security Monitor should be used to identify the users who violaste the security
policy.
C. In order for you to determine which users violates the policy you need to make use of
the Replication Monitor utility.
D. You should consider making use of the System Monitor utility to determine which
users are at default.

Answer: A

Explaination: To capture network traffic, the System Monitor is used. You can filter
it so that it can meet the criteria that you are looking for.
Incorrect Answers:
B: The IP Security Monitor is used to monitor IPSec information. You cannot use it to
monitor network traffic.
C: This is used to monitor Active Directory replication.
D: The System Monitor is used to gather information about the CPU, Memory etc.

QUESTION 711:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com The
Certkingdom.com network contains ten Windows Server 2003 computers and 1,100
Windows 2000 Professional computers. Three of the Windows Server 2003
computers in configured as domain controllers.
Certkingdom.com has a Finance department in Chicago and a Marketing department in
Dallas. These departments are connected to the Internet. The users in these
departments use the network often to send and download important files and
Internet e-mail. The Certkingdom.com users also access the Internet to get the latest
information on the product. A new Certkingdom.com security policy requires that
network administrators should use their domain user account to log on. Whenever
the administrators need an administrative privilege, they should use the runas
command. The runas command will launch an application that will allow
permission to execute the required task.
One morning an administrator named Rory Allen complains that the name
resolution has failed on the network. During an investigation you try to run Rory
Allen administrative user account, RMAdmin1 and issue the following command:
runas/user:rmadmin1 replmon. When you use this command the following error
message was displayed:
RUNAS ERROR: Unable to run – replmon
1058: The service cannot be started, either because it is disabled or there are no
enabled devices associated with it. You receive an instruction from the CIO to
identify the service that stops the Replication Monitor from starting.
Which of the following services could it be?

A. Due to DNS Client failure you are unable to start Replication Monitor.
B. The Secondary Logon is the likely cause of you being unable to start Replication
Monitor.
C. The DNS Server is the cause of Replication Monitor not starting.
D. Net Logon is a possible cause of the Replication Monitor not starting.

Answer: B

Explaination: The Secondary Logon permits a user to make use of the runas
command.
Incorrect Answers:
A: The DNS Client allows you to locate Active Directory domain controllers. It also
resolves DNS names locally.
C: The DNS Server service is responsible name resolution queries from DNS clients.
D: This service is responsible for authentication remote users and services.

QUESTION 712:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com
Certkingdom.com consists of a few servers that run Windows Server 2003 and Windows
2000 Server. Some the client computers run Windows 2000 Professional, and the
others run Windows XP Professional.
Certkingdom.com contains 15 Domain controllers, 25 Windows Server 2003 servers, 15
Windows 2000 Server computers, 150 Windows XP Professional client computers
and 300 Windows 2000 Professional client computers. The Certkingdom.com domain
also contains 600 user accounts and 15 administrative accounts. The user and
computer accounts reside in an OU which is linked to a GPO as shown in the
following table:

Certkingdom.com’s user accounts resides in an OU named Certkingdom OU. This OU needs
an application named TKD_Tools which is in a Windows package named
TKD_Tools.msi. The hard disk space for TKD_Tools is 50MB. A Certkingdom.com policy
states that the TKD_Tools.msi should not be installed on a client computer that runs
Windows XP Professional or a server that runs Windows Server 2003 which has less
than 500 MB of hard disk space. Only users that are non administrative are allow to
install this TKD_Tools application. You have received an instruction from the CIO to
configure the domain to effectively install the application. You need to accomplish
this without the unnecessary installation of this application.
What should you do?

A. Your first step should be to add TKD_Tools.msi to the Computer
Configuration\Software Settings node of the MemberServers GPO.
Thereafter you will be able to create a WMI filter that will restrict the application of the
MemberServers GPO to computers with 500 MB and more hard disk space.
B. You can accomplish this by adding TKD_Tools.msi to the Computer
Configuration\Software Settings node of the WinClients GPO.
The subsequent step would be to create a WMI filter that will restrict the application of
the WinClients GPO to computers with 500 MB and more hard disk space.
C. This can bew accomplished by adding TKD_Tools.msi to the Computer
Configuration\Software Settings node of the AdminPolicy GPO.
Thereafter you can create a WMI filter that restricts the application of the
DomainControllers GPO to computers with 500 MB and more hard disk space.
D. Your best option would be to add TKD_Tools.msi to the Computer
Configuration\Software Settings node of the UserPolicy GPO.
Thereafter you can create a WMI filter that restricts the application of the UserPolicy
GPO to computers with 500 MB and more hard disk space.

Answer: D

Explaination: This is the more likely answer, because only the non-administrative
users can have this application installed. That’s way you should add the
TKD_Tools.msi to the UserPolicy GPO.
Incorrect Answers:
A: The MemberServers GPO will only apply to the Windows Server 2003 and Windows
2000 Server computers.
B: The WinClients GPO will only apply to the Windows 2000 Professional and the
Windows XP Professional client computers.
C: The AdminPolicy is users who are administrators. The scenario does not want the
administrator to have this application.

QUESTION 713:

A. Your best choice would be to configure Certkingdom -PR01 to be available.
B. You should consider restarting the Print Spooler on Certkingdom -SR24 to ensure that
the users can print.
C. To ensure that the users can print to Certkingdom -PR01 you have to update the driver.
D. This can be accomplished by uincreasing the priority of Certkingdom -PR01.

Answer: B

Explaination: The function of the Print Spooler is to manage the print queues on a
server. In this case it seems that the Print Spooler has stalled. That’s way you have
to restart the Print Spooler service.
Incorrect Answers:
A: Even if this were available, you cannot access it because you cannot connect to the
Print Spooler.
C: There is no need to update the driver, because the printer was working before.
D: To increase the priority of Certkingdom -PR01, you need to access the Property sheet.
At the moment it seems impossible, because the Print Spooler is not working.

QUESTION 714:

A. You should make use of Network Monitor in order to determine and analyze the
technical errors.
B. The technical errors can be determined and analysed by making use of System
Monitor.
C. You will be able to make use of Task Manager to collect the performance information.
D. You should consider making use of a counter log to determine and analyse the
technical errors.

Answer: D

Explaination: You should create a performance baseline and monitor the values of
the counters. The performance data should be recorded in a counter log.
Incorrect Answers:
A: This tool is used to parse network traffic.
B: The System Monitor can work, however it only presents current performance ion real time.
C: This is used to view information about the processors that are running on the system.

QUESTION 715:

A. You should consider enabling the World Wide Web Publishing Service.
B. Your best option would be to allow the DNS Server service.
C. To support the Web site you need enable the IIS Admin Service.
D. To make sure that the suitable services are allowed you need to permit the HTTP SSL
service.

Answer: A, D

Explaination: The HTTP SSL will provide the private part of the Web site and the
World Wide Web Publishing Service will provide for the public portion.
Incorrect Answers:
B: This option will offer name resolution. This will not ensure that the Web site is
available.
C: This is only needed if you use an IIS to manage the Web site. However you have a
third-party Web management application.

QUESTION 716:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com
Certkingdom.com contains 15 Windows Server 2003, 5 domain controllers and 2000
client computers which runs Windows XP Professional.
Certkingdom.com contains a Marketing department and a Finance department. A
Certkingdom.com server runs mission critical in-house applications which is used by the
users. The client computers and the domain controllers’ clock are incorrect. You
need the time to be correct other wise the Kerberos fails and you will find Kerberos
errors in the event log. You reset the clock of the client computer, but after a while
you find that the clock is again wrong. You receive an instruction from management
to make sure that the clock of the client computers displays the correct time.
What should you do?

A. To ensure that the clock displays the correct time you need to adjust the clock on the
infrastructure master.
B. To ensure that the correct time is displayed you need to select Automatically
synchronize with Internet time server on the Internet Time tab.
C. You can ensure the correct time by installing an exact time resource tool on the
network.
D. Your best option should be to adjust the clock on the PDC emulator.

Answer: D

Explaination: You should adjust the PDC emulator, because all the computers will
synchronize there clock.
Incorrect Answers:
A, B, C: In this scenario you should adjust the clock with the PDC emulator, for
authentication in an Active Directory environment.

QUESTION 717:

A. Your best choice would be to specify TestVol as the additional location on the
BillVol properties.
B. This can be accomplished by moving the shadow copies from BillVol to TestVol on
the Certkingdom -SR14.
C. You should consider sharing TestVol.
Thereafter you will be allowed to enable shadow copies on TestVol.
D. You should consider deleting the shadow copies of BillVol and specifying TestVol
as the location of shadow copies.

Answer: D

Explaination: This is the correct answer. You are unable to change the location of
the shadow copies unless you delete Vol1 of the exiting shadow copies.
Incorrect Answers:
A: You cannot share the shadow copies between BillVol and TestVol. You also cannot
move or copy files on BillVol.
B: You have to delete the shadow copies on BillVol. You cannot move the shadow
copies from BillVol to TestVol.
C: This will result in previous copies on BillVol to be periodically created. The exiting
copies on BillVol would not be affected.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Thursday, December 1, 2011

Free 70-669 Exam Q & A / Study Guide

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

QUESTION 1
You work as a desktop technician at Certkingdom.com. The Certkingdom.com network consists of an Active
Directory Domain Services domain named Certkingdom.com. All servers on the network run Windows
Server 2008. The client computers run a mix of Windows XP Professional and Windows 7 Enterprise.
The company is planning to roll out Windows 7 Enterprise throughout the network. Users that
require legacy applications will be able to run them in Windows XP Mode virtual machines on their computers.
You are conducting some testing with Windows XP Mode virtual machines (VMs). You have two
Windows XP Mode VMs on your Windows 7 client computer.
You want to configure the networking options for the two VMs so that they have network
connectivity to each other but not to your host computer or the rest of the Certkingdom.com network.
How should you configure the VMs?

A. You should navigate to the Networking node in the VM Settings and configure the network
adapter to use the Internal Network option.
B. You should navigate to the Networking node in the VM Settings and configure the network
adapter to use the Shared Networking (NAT) option.
C. You should navigate to the Networking node in the VM Settings and configure the network
adapter to use the Bridge Mode option.
D. You should configure the Bridge Connections option in the Network Adapter properties in
Windows XP on each VM.

Answer: A

Explanation:

QUESTION 2
You work as a desktop technician at Certkingdom.com. The Certkingdom.com network consists of an Active
Directory Domain Services domain named Certkingdom.com. All servers on the network run Windows
Server 2008 R2 and all client computers run Windows 7 Enterprise.
The network includes a Windows Server 2008 R2 server named ABC-Deploy1. ABC-Deploy1 runs
the IIS Server role and is part of the company’s Microsoft Enterprise Desktop Virtualization (MEDV) environment.
Your Windows 7 client computer is named ABC-Tech1. The MED-V Management console is
installed on ABC-Tech1.
You are configuring the Microsoft Enterprise Desktop Virtualization (MED-V) environment to
deploy MED-V virtual machines to several client computers.
You have configured a MED-V image with the required applications. You run Sysprep on the
image and upload it to ABC-Deploy1.
Which two of the following steps will ensure that computer names following a specified naming
convention are generated when the VMs are first run after the deployment? Choose two.

A. In the Workspace settings, navigate to the VM Setup tab and configure the computer name pattern.
B. In the Workspace settings, navigate to the Deployment tab and configure the computer name pattern.
C. Add a Script Action to rename the computer.
D. Run the Setup Manager Wizard and configure the computer name pattern.
E. Add the computer names to Sysprep.inf.

Answer: A,C

Explanation:

QUESTION 3
You work as a desktop technician at Certkingdom.com. The Certkingdom.com network consists of an Active
Directory Domain Services domain named Certkingdom.com. All servers on the network run Windows
Server 2008 R2 and all client computers run Windows 7 Enterprise.
You are in the process of configuring a Microsoft Enterprise Desktop Virtualization (MED-V) environment.
You need to configure a central image repository for client computers to download images from.
You install a Windows Server 2008 R2 member server named ABC-Deploy1. You create a folder
named MEDVImages on ABC-Deploy1.
What should you do next on ABC-Deploy1?

A. You should share the MEDVImages folder.
B. You should install the IIS Server role and configure a virtual directory to point to the MEDVImages folder.
C. You should install the FTP Server component of IIS and configure an FTP site to point to the MEDVImages folder.
D. You should install an SSL Certificate.

Answer: B

Explanation:

QUESTION 4
You work as a network administrator at Certkingdom.com. The Certkingdom.com network consists of an Active
Directory Domain Services domain named Certkingdom.com. All servers on the network run Windows
Server 2008 R2 and all client computers run Windows 7 Enterprise.
Certkingdom.com runs a Microsoft Enterprise Desktop Virtualization (MED-V) environment. A Windows
Server 2008 R2 member server named ABC-Deploy1 is configured to run Microsoft Enterprise
Desktop Virtualization (MED-V) Server and hosts the central MED-V image repository.
You notice that the disk space on ABC-Deploy1 is running low due to the MEDVImages folder
taking up a large amount of disk space.
You open the MED-V Management Console and note that there are several versions of the MEDV
Workspace virtual machines (VMs).
How can you minimize the disk space used by the MEDVImages folder?

A. By deselecting the “Workspace is persistent” option.
B. By configuring the image update settings to keep a limited number of images.
C. By configuring the image update settings to select the “Clients should use the Download
manager when downloading the images” option.
D. By manually deleting old image files.

Answer: B

Explanation:

QUESTION 5
You work as a network administrator at Certkingdom.com. The Certkingdom.com network consists of an Active
Directory Domain Services domain named Certkingdom.com. All servers on the network run Windows
Server 2008. The client computers run a mix of Windows XP Professional and Windows 7 Enterprise.
You are in the process of migrating the Windows XP Professional client computers to Windows 7 Enterprise.
You need to design a solution to resolve application compatibility issues. You are planning a
desktop virtualization solution that will run legacy applications on virtual machines (VMs) running
Windows XP Professional.
You want to deploy Windows Virtual PC 2007 and a virtual machine image to the client computers
when they are migrated to Windows 7 Enterprise.
How can you create a single installation package that includes both Windows Virtual PC 2007 and
a virtual machine image?

A. By using the Packaging Wizard from Microsoft Enterprise Desktop Virtualization (MED-V).
B. By using Package Manager (pkrmgr.exe) from the Windows Automated Installation Kit (WAIK) tools.
C. By using a template created using Microsoft System Center Virtual Machine Manager (VMM) 2008 R2.
D. By using Windows System Image Manager from the Windows Automated Installation Kit (WAIK) tools.

Answer: A

Explanation:

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Wednesday, November 30, 2011

Free Avaya 6401-1 Exam Q & A / Study Guide

Best Avaya Certification Training and Avaya Exams Training and more Avaya exams log in to Certkingdom.com

QUESTION 1
You want to install ContactStore on a PC separate from the VoiceMail Pro PC . Which three steps
would you need to complete for ContactStore to function separately? (Choose three.)

A. Verify that the Voice Recording Library on the VoiceMail Pro server is shared on the customer’s network.
B. Verify that the ContactStore service has read and write permissions to the Voice Recording Library Share.
C. Verify that the ContactStore registry settings have been updated to see the Voice Recording Library share.
D. Verify that the VoiceMail Pro registry settings have been updated to point to the Voice Recording Library share.
E. Verify that the ContactStore licenses have been loaded onto the PC running the ContactStore application.

Answer: A,B,E

Reference: http://www.carrollcommunications.com/contact_store.html

QUESTION 2
A remote user wants to gain access to the network when using the RAS server.
Under which two conditions would you create an IP route? (Choose two.)

A. when the remote user’s dial-up connection method contains a DHCP address that is on a different subnet
B. when the user is on the same subnet as the IP Office
C. when the remote user’s dial-up connection method contains a static IP address that is on a different subnet
D. when the IP Office’s DHCP mode is set to Server or Dial In and the PC connection method is set to obtain an IP Address Automatically

Answer: A,C

Explanation:

QUESTION 3
A user (ext. 199) reports that their IMS client displays an error message when attempting to ring a
phone. What are three reasons that would prevent the IMS program from calling the phone?
(Choose three.)

A. The user profile in Manager has “199″ entered as the user name.
B. The phone is set for “Do Not Disturb”.
C. The user’s “Multi Line Option” is set to “Answer Pre-select”.
D. The user mailbox is set to “Blank” under Outlook Tools/Integrated Messaging.
E. The user’s profile has “System Phone” is set to “On”.

Answer: A,B,D

Explanation:

QUESTION 4
Click the Exhibit button.

A customer has two sites, each with an IP Office linked via a private digital line (E1/T1). The head
office is connected to the public network through a digital exchange line. The remote site gains
access to the public network via the head office.
How should Clock Quality be set in the IP Office on the lines marked X and Y in the exhibit?

A. X – Network — Y – Fallback
B. X ?Fallback — Y – Fallback
C. X ?Network — Y – Unsuitable
D. X ?Fallback — Y – Unsuitable

Answer: A
Reference: http://support.avaya.com/elmodocs2/ip_office/R3.1/maintenance.pdf(page 20)

QUESTION 5
Which two are used to turn on Small Community Networking within the main IP Office 500?
(Choose two.)

A. RAS
B. FastStart
C. Voice Networking
D. Professional License Enabled

Answer: C,D

Explanation:

QUESTION 6
How much space does a recording in VoiceMail Pro use on a hard drive?

A. 1MB per minute
B. 500KB per minute
C. 2MB per minute
D. 1.5MB per minute

Answer: A

Explanation:

QUESTION 7
Which two e-mail protocols are used by VoiceMail Pro to perform voicemail to e-mail? (Choose two.)

A. POP 3
B. SMTP
C. MAPI
D. IMAP

Answer: B,C

Explanation:

QUESTION 8
A customer is receiving calls to a hunt group and the callers are reporting that they are being
forced to wait much longer than VoiceMail Pro reported to them during the queued message. What
is a possible cause for this?

A. The hunt group has a priority set to 1.
B. The hunt group has a priority set to 3.
C. There are two routes going to the hunt group. Each has different priorities set.
D. Users in the hunt group have inconsistent priority settings. The users with a priority set to 3 are always busy.

Answer: C

Explanation:

QUESTION 9
What information do you need from a customer to be able to reproduce a call park problem?
(Choose three.)

A. accurate description of the problem
B. a System Monitor trace of the problem
C. a Network Assessment
D. the system configuration
E. information on the phones and lines being used

Answer: A,D,E

Explanation:

QUESTION 10
When using Small Community Networking which two features require the Small Community
Advanced License to function? (Choose two.)

A. Hot Desking
B. Hot Desking across the SCN
C. playing queued announcements
D. Break Out dialing

Answer: B,D

Explanation:

Best Avaya Certification Training and Avaya Exams Training and more Avaya exams log in to Certkingdom.com

Sunday, November 27, 2011

Free Microsoft 70-291 Q & A / Study Guide Part II

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

QUESTION 1:

A. On Certkingdom -PR01, run the net session command.
B. On Certkingdom -PR01, run the netstat command.
C. On Certkingdom -PR01, run the netsh command.
D. On Certkingdom -PR01, run the netcap command.

Answer: D

Explaination: Netstcap.exe is a command line tool that could be used to capture the
network traffic. A filter can be created to be used during the capture to determine the
MAC address the print jobs are being sent to. The Network Monitor Capture Utility (
Netcap.exe) can be used to capture network traffic in Network Monitor. Netcap provides
capture abilities only from a command prompt; to open the resulting capture (.cap) files,
you must use the full Network Monitor interface. Netcap is installed when you install the
Support tools that are on the Windows XP CD-ROM. Netcap provides capture abilities
that are similar to the version of Network Monitor that is included with the Windows
Server products; however, you must use Netcap at a command prompt. Netcap installs
the Network Monitor driver and binds it to all adapters when you first run the Netcap command.
Incorrect Options:
A: The net session command can be used to view the computer names and user names of
users on a server, to see if users have files open, and to see how long each user’s session
has been idle. Net session manages server computer connections – used without
parameters, net session displays information about all sessions with the local computer.
B: The netstat command is not a utility to use when troubleshooting NetBIOS names, but
is used to display TCP/IP and port information.
C: The Network Shell utility (Netsh.exe) can perform a wide range of system
configuration tasks. You can use commands in the Netsh Interface IP context to
configure the TCP/IP protocol (including addresses, default gateways, DNS servers, and
WINS servers) and to display configuration and statistical information.
Reference:
Microsoft Knowledge Base: 306794: How to Install the Support Tools from the Windows
XP CD-ROM Network Monitor is provided with Windows Server products and
Microsoft Systems Management Server (SMS). Microsoft Corporation, 2004
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd & Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, pp. 686, 854-856,
926

QUESTION 2:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of two subnets. All servers on the Certkingdom.com network run
Windows Server 2003 and all client computers run Windows XP Professional. All
servers are located in a central data center that uses a single IP subnet and all client
computers are located in one subnet.
The data center contains two routers named Certkingdom -SR01 and
Certkingdom -SR02, two domain controllers named Certkingdom -DC01 and
Certkingdom -DC02, and two file servers named Certkingdom -SR03 and
Certkingdom -SR04. The IP addresses of these servers are indicated in the table
below.

Host name	IP address
Certkingdom-DC01	10.10.10.1
Certkingdom -DC02	10.10.10.2
Certkingdom -SR01	10.10.1.1
Certkingdom -SR02	10.10.1.2
Certkingdom -SR03	10.10.11.1
Certkingdom -SR04	10.10.11.2

You have received instruction from the CIO to install a new database server in the
data center. You install Windows Server 2003 on a new server computer named
Certkingdom -DB01 and hand it over to a database administrator named Dean
Austin. Dean Austin installs Microsoft SQL Server 2005 and makes some changes to
the TCP/IP settings on Certkingdom -DB01 as shown in the following table.

Parameter	Value
IP address	10.10.1.3
Subnet mask	255.255.255.0
Default gateway	10.10.1.2

Later, Dean Austin complains that Certkingdom -DB01 cannot communicate with the
other servers in the data center. All other servers in the data center can
communicate with the other servers as well as the client computers. You log on to
Certkingdom -DB01 and attempt to ping Certkingdom -DC01 but you receive the
following error message: “Destination host unreachable”.
What should you do to ensure that Certkingdom -DB01 can communicate with the
other computers in the Certkingdom.com network?

A. Configure Certkingdom -DB01 with a default gateway of 10.10.1.1.
B. Configure Certkingdom -DB01 with a subnet mask of 255.255.0.0.
C. Configure Certkingdom -DB01 with an IP address of 10.10.10.3.
D. Configure Certkingdom -DB01 with an IP address of 10.10.11.3.

Answer: B

Explaination: Large networks are subdivided to create smaller subnetworks to reduce
overall network traffic by keeping local traffic on the local subnet and sending all
nonlocal traffic to the router. In order to create a subnetwork, we need to have a system
for addressing that allows us to use the network ID and host ID within the class-based
system. This is accomplished through the use of a subnet mask. To determine the
appropriate custom subnet mask (typically referred to simply as subnet mask) for a
network, you must first:
1. Determine the number of host bits to be used for subnetting.
2. Determine the new subnetted network IDs.
3. Determine the IP addresses for each new subnet.
4. Determine the appropriate subnet mask.
Incorrect Answers:
A: You need to assign the correct subnet mask to ensure connectivity.
C, D: The problem in this scenario is not a faulty IP address. It is the appropriate subnet
mask that has to be determined to enable connectivity.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, p. 57

QUESTION 3:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of two subnets named Subnet A and Subnet B. Subnet A and
Subnet B are connected by a router. All computers on the Certkingdom.com network
are configured with static IP addresses. All network servers run Windows Server
2003 and all client computers run Windows XP Professional.
Certkingdom.com hires a new Sales manager named Amy Wilson. You install a new
client computer named Certkingdom -WS291 for Amy Wilson. You then add
Certkingdom -WS291 to Subnet A. The relevant portion of the network is configured
as shown in the exhibit.

However, Amy Wilson complains that Certkingdom -WS291 cannot communicate
with other hosts on the network.
What should you do to ensure that Certkingdom -WS291 can communicate with all
local and remote computers on the Certkingdom.com network?

A. Configure Certkingdom -WS291 with a default gateway of 192.168.28.84.
B. Configure Certkingdom -WS291 with a default gateway of 192.168.2.1.
C. Configure Certkingdom -WS291 with a subnet mask of 255.255.255.128.
D. Configure Certkingdom -WS291 with a subnet mask of 255.255.255.192.

Answer: C

Explaination: It is evident from the exhibit that the file server and
Certkingdom -WS291 have a different subnet mask. This is the reason why they
cannot communicate with each other. You must therefore change the subnet mask
of Certkingdom -WS291 to 255.255.255.128.
Incorrect Answers:
A, B: The problem is not the gateway IP address that is faulty, but rather the subnet
mask.
D: This option suggests the correct object that has to be changed, but it gives the wrong
subnet mask.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, p. 57

QUESTION 4:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com
Certkingdom.com has its headquarters in Chicago and branch offices in Dallas and
Miami. All servers on the Certkingdom.com network run Windows Server 2003 and all
client computers run Windows XP Professional. You work in the Miami branch
office.
The network at the Miami branch office consists of 25 different subnets, each with a
maximum of six computers. The network administrator at headquarters has
allocated the 192.168.3.0/24 network address to the Miami branch office.
You install a new server named Certkingdom -SR21 in the Miami branch office. You
need to configure the Internet Protocol (TCP/IP) properties for Certkingdom -SR21.
You configure Certkingdom -SR21 with an IP address of 192.168.3.44. What subnet
mask should you use?

A. A subnet mask of 255.255.255.0.
B. A subnet mask of 255.255.255.128.
C. A subnet mask of 255.255.255.192.
D. A subnet mask of 255.255.255.240.
E. A subnet mask of 255.255.255.248.

Answer: E

Explaination: The network address is: 192.168.2.0/24, which means
11111111.11111111.11111111.0 in binary.
Therefore, you can use the last octet to configure the 30 subnets and 6 hosts in each
subnet
You need only six host PCs. When you convert to binary, it is: 00000111. As a result,
you use 3 bits.
This leaves 5 bits for the subnets 11111000 converted to decimal:
128+64+32+16+8=248, therefore the subnet mask will be: 255.255.255.248.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, p.57

QUESTION 5:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com
Certkingdom.com has its headquarters in Chicago and a branch office in Dallas. All
servers on the Certkingdom.com network run Windows Server 2003 and all client
computers run Windows XP Professional. You work in the Dallas branch office.
The network at the Dallas branch office consists of a single subnet that contains 150
client computers and 12 servers. The network administrator at headquarters has
allocated the 10.10.0.0/16 network address to the Dallas branch office.
You have received instruction from your manager to place all servers at the Dallas
branch office into a separate subnet that uses the 192.168.10 public addressing
scheme. Your manager asks you to make allowance for a maximum of 30 servers in
the new subnet.
Which subnet mask should you use for the new subnet?

A. 255.255.255.224
B. 255.255.255.240
C. 255.255.255.248
D. 255.255.255.252
E. 255.255.255.254

Answer: A

Explaination: A 255.255.255.224 subnet mask gives five host address bits, so the
maximum number of host addresses is 2 ^ 5 – 2 = 30 host addresses. Thus
255.255.255.224 is the only subnet mask that will allow for sufficient IP addresses in
case of further growth, whilst still conserving as many current addresses as possible.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, p. 62

QUESTION 6:

DRAG DROP
You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com All
servers on the Certkingdom.com network run Windows Server 2003 and all client
computers run Windows XP Professional.
You have installed a new server named Certkingdom -SR06 on the network. The
relevant portion of the network is shown on the exhibit.

You want to configure Certkingdom -SR06 with a valid static IP configuration.
Certkingdom -SR06 must be able to communicate with all hosts on the network and
on the internet. You also need to configure Certkingdom -SR06 to use the DNS server
on the local subnet for name resolution. In addition, you must configure redundancy
for name resolution.
How should you configure Certkingdom -SR06?
To answer drag the appropriate IP addresses and Subnet masks to the appropriate
places.

Answer:

Explaination:
The Class C address 192.168.0.100 has to be the IP address to enable
Certkingdom -SR06 to communicate with all hosts on the network and on the internet
as 192.168.0.1, 192.168.0.2 and 192.168.0.110 are already in use. 192.168.5.2 and
192.168.5.100 are on the wrong subnet, and besides, 192.168.5.12 is already in use.
The subnet mask for this Class C address is 255.255.255.0. The default gateway
should be 192.168.0.1. To configure redundancy for name resolution, configure the
preferred DNS server/primary address as 192.168.0.2, and the alternate DNS
server/secondary address as 192.168.5.2.
Reference:
J. C. Mackin, Ian McLean, MCSA/MCSE Self-Paced Training Kit (exam 70-291):
Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 network
Infrastructure, Part 1, Chapter 2, pp. 80-116

QUESTION 7:

A. On the DHCP server, increase the DHCP lease period.
B. Configure alternate IP settings for Certkingdom -SR25 on the Alternate Configuration
tab of the Internet Protocol (TCP/IP) properties.
C. Configure the DHCP scope in the 169.254.0.1. – 169.254.255.254 range.
D. On the DHCP server, configure the DHCP 001 Resource Location Servers reservation
option for Certkingdom -SR25.

Answer: B

Explaination: Windows Server 2003 includes the Alternate Configuration feature.
The Windows Server 2003 servers can be configured to use an alternate static IP
configuration if a DHCP server is unavailable. When a DHCP client determines that
the DHCP server is unavailable, it will automatically change over and also configure
the TCP/IP stack with the static address information specified on the Alternate
Configuration tab of the Internet Protocol (TCP/IP) properties.
Incorrect Answers:
A: Increasing the lease period would result in DHCP clients requesting leases less
frequently, but won’t guarantee that Certkingdom -SR25 will be available when the DHCP
server is down.
C: Modifying the DHCP scope to the 169.254.0.1. – 169.254.255.254 range will still be
reliant on the DHCP server.
D: Configuring the DHCP 001 Resource Location Servers reservation option for
Certkingdom -SR25 on the DHCP server will not ensure that Certkingdom -SR25 will
receive an IP address or have the IP address renewed.
Reference:
J. C. Mackin, Ian McLean, MCSA/MCSE Self-Paced Training Kit (exam 70-291):
Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 network
Infrastructure, Part 1, Chapter 2, pp. 114, 117

QUESTION 8:

A. Establish a Telnet session to Certkingdom -SR34 and then run the net start dhcp
command.
B. Establish a Telnet session to Certkingdom -SR34 and then run the net start dhcpserver
command.
C. Establish a Telnet session to Certkingdom -SR34 and then run the ipconfig /renew
command.
D. On Certkingdom -WS291, run the netsh dhcp server\\ Certkingdom -SR34 show server
command.

Answer: B

Explaination: You can start the DHCP Server service by executing the Net Start
Dhcpserver command at the command prompt.
Telnet is a protocol that enables an Internet user to log on to and enter commands on a
remote computer linked to the Internet, as if the user were using a text-based terminal
directly attached to that computer. Telnet is part of the TCP/IP suite of protocols. The
term telnet also refers to the software (client or server component) that implements this
protocol.
Given the fact that you can ping Certkingdom -SR34 you should then establish a Telnet
session to Certkingdom -SR34 and then run the appropriate command.
Reference:
J. C. Mackin & Ian McLean, MCSA/MCSE self-paced training kit (exam 70-291):
implementing, managing, and maintaining a Microsoft Windows Server 2003 network
infrastructure, Microsoft Press, Redmond, 2004, p. 7-23

QUESTION 9:

A. Run the net session command.
B. Run the netstat command.
C. Run the netsh command.
D. Run the netcap command.

Answer: D

Explaination: Netstcap.exe is a command line tool that could be used to capture the
network traffic. A filter can be created to be used during the capture to determine the
MAC address the print jobs are being sent to. The Network Monitor Capture Utility (
Netcap.exe) can be used to capture network traffic in Network Monitor. Netcap provides
capture abilities only from a command prompt; to open the resulting capture (.cap) files,
you must use the full Network Monitor interface. Netcap is installed when you install the
Support tools that are on the Windows XP CD-ROM. Netcap provides capture abilities
that are similar to the version of Network Monitor that is included with the Windows
Server products; however, you must use Netcap at a command prompt. Netcap installs
the Network Monitor driver and binds it to all adapters when you first run the Netcap
command.
Incorrect Options:
A: The net session command can be used to view the computer names and user names of users
on a server, to see if users have files open, and to see how long each user’s session has
been idle. Net session manages server computer connections – used without parameters,
net session displays information about all sessions with the local computer.
B: The netstat command is not a utility to use when troubleshooting NetBIOS names, but
is used to show what ports your computer is listening on.: -R is used to reload your
LMHOSTS file located in %systemroot%\system32\drivers\etc., -r will show you which
name resolutions have been answered via broadcasts, and which have been answered via
a NetBIOS name server, -RR switch of the command utility refreshes your NetBIOS
name with a configured WINS server.
C: The Network Shell utility (Netsh.exe) can perform a wide range of system
configuration tasks. You can use commands in the Netsh Interface IP context to
configure the TCP/IP protocol (including addresses, default gateways, DNS servers, and
WINS servers) and to display configuration and statistical information.
Reference:
Microsoft Knowledge Base: 306794: How to Install the Support Tools from the Windows
XP CD-ROM Network Monitor is provided with Windows Server products and
Microsoft Systems Management Server (SMS). Microsoft Corporation, 2004
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd & Laura Hunter,
MCSA/MCSE: Exam 70-291: Implementing, Managing, and Maintaining a Windows
Server 2003 Network Infrastructure Guide & DVD Training System, pp. 686, 854-856,
926

QUESTION 10:

Network Topology Exhibit:

LAN Settings Exhibit:

You work as the network administrator at Certkingdom.com The Certkingdom.com
network consists of a single Active Directory domain named Certkingdom.com All
servers on the Certkingdom.com network run Windows Server 2003 and all client
computers run Windows XP Professional. The Certkingdom.com network contains a
Microsoft Internet Security and Acceleration (ISA) Server computer named
Certkingdom -SR01, a DNS server named Certkingdom -SR02, a DHCP server named
Certkingdom -SR03, a file server named Certkingdom -SR21, and a Web server named
Certkingdom-SR25. Certkingdom -SR25 also serves as a central antivirus server.
Certkingdom -SR21 is located on the 10.10.11.0 subnet and Certkingdom -SR25 is
located in the perimeter network. Certkingdom -SR21 contains antivirus software
that checks for new virus definitions on Certkingdom -SR25 every hour. You can also
access Certkingdom -SR25 through a virus update Web page to perform manual
virus definition updates.
Certkingdom -SR03 suffers a catastrophic failure and is removed from the network.
Due to budgetary constraints, a replacement for Certkingdom -SR03 will only be
acquired in the next financial year. You need to redesign network addressing
scheme, and change the IP addresses for Certkingdom -SR01 to the addresses shown
in the Network Topology exhibit.
Certkingdom -SR02 contains the new host (A) resource records for
Certkingdom -SR01.
You receive reports about a new virus threat and want to protect the network
immediately by manually downloading the new virus definitions to
Certkingdom -SR21. you log on to Certkingdom -SR21 but discover that you cannot
access the virus update Web page on Certkingdom -SR25. The static TCP/IP
configuration on Certkingdom -SR21 uses Certkingdom -SR02 as the preferred DNS
server.
You confirm that Certkingdom -SR01 is configured properly. On Certkingdom -SR21,
you view the Internet Explorer LAN settings that are shown in the LAN Settings
exhibit.
What should you do to allow Certkingdom -SR21 to connect to Certkingdom -SR25?

A. At a command prompt on Certkingdom -SR21, run the ipconfig /flushdns command.
B. In the LAN settings of Internet Explorer on Certkingdom -SR21, select the
Automatically detect settings check box.
C. At a command prompt on Certkingdom -SR01, run the ipconfig / flushdns command.
D. At a command prompt on Certkingdom -SR01, run the ipconfig /registerdns command.

Answer: A

Explaination: Running the ipconfig /flushdns command will flush and reset the DNS
resolver cache which is necessary to allow connection. Run this command on
Certkingdom -SR21 to connect to Certkingdom -SR25.
Incorrect Answers:
B: Selecting the “Automatically detect settings” checkbox is not going to allow
Certkingdom -SR21 to connect to WWW.
C: The ipconfig /flushdns command flushes and resets the DNS resolver cache. This is
not what is necessary.
D: The ipconfig /registerdns command refreshes all DHCP leases and registers any related
DNS names. This option is available only on Windows 2000 and newer computers that
run the DHCP Client service. This is not going to allow Certkingdom -SR21 to connect to
WWW when it is run on Certkingdom -SR01.
Reference:
James Chellis, Paul Robichaux and Matthew Sheltz, MCSA/MCSE: Windows Server
2003 Network Infrastructure Implementation, Management, and Maintenance Study
Guide, p. 311

QUESTION 11:

You log on to a client computer named Certkingdom -WS292 and run the ipconfig
/renew command successfully.
What should you do to ensure that Certkingdom -WS291 can receive its IP address
configuration from the Certkingdom -SR25?

A. Restart the DHCP service on Certkingdom -SR25.
B. Restart Certkingdom -WS291.
C. Restart Certkingdom -SR25.
D. Add additional IP addresses to the scope on Certkingdom -SR25.

Answer: B

Explaination: It is probable that the TCP/IP stack has a problem because the
computer is unable to send a DHCP discover broadcast packet. This can happen
when you insert a network cable after the PC has been started. You should restart
the client PC to successfully obtain a new IP address.
Incorrect Answers:
A, C, D: This is unnecessary because Certkingdom -WS292 did obtain an IP address from
the DHCP server, thus indicating that the DHCP server configuration is not the issue.
Reference:
Deborah Littlejohn Shinder and Dr. Thomas W. Shinder, MCSA/MCSE Exam 70-290:
Managing and Maintaining a Windows Server 2003 Environment Study Guide & DVD
Training System, p. 629

QUESTION 12:

You work at headquarters. A Certkingdom.com employee named Andy Booth is one of
three employees that are relocated to headquarters from the Dallas office. Andy
Booth uses a portable client computer named Certkingdom -WS291. Andy Booth
complains that when he plugs Certkingdom -WS291 into the LAN connection in his
new cubicle, he cannot connect to network resources on the LAN or the Internet.
None of the other employees are experiencing the same problem.
When you run the ipconfig command from a command prompt on
Certkingdom -WS291, you see the output as shown in the exhibit.

What should you do to allow Certkingdom -WS291 to connect to network resources
on the LAN or the Internet?

A. Configure Certkingdom -WS291 with a subnet mask of 255.255.240.0.
B. Configure Certkingdom -WS291 with a default gateway of 192.168.3.12.
C. Configure Certkingdom -WS291 with a primary DNS suffix of Certkingdom.com
D. Configure Certkingdom -WS291 to automatically lease an IP address from
Certkingdom -SR01.

Answer: D

Explaination: The client computers on the subnet use DHCP to obtain their IP
configurations. Certkingdom -WS291 has a static IP address, and therefore cannot
obtain a valid IP configuration from the DHCP server.
Incorrect Answers:
A: By changing the subnet mask you will not ensure that Certkingdom -WS291 will
connect to other computers and the Internet.
B: Changing the default gateway will not enable Certkingdom -WS291 LAN connection.
Besides, 192.168.3.12 is the IP address of the DHCP server.
C: Adding a primary DNS suffix means that only domain names listed in that window
will be tried for resolution purposes. Both the connection-specific and primary DNS
suffix are ignored.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
Implementing, Managing, and Maintaining a Windows Server 2003 Network
Infrastructure Guide & DVD Training System, p. 515

QUESTION 13:

A. Reconfigure Internet Connection Sharing on Certkingdom -WS291.
B. Configure the shared dial-up connection on Certkingdom -WS291 so that automatic
dialog is enabled.
C. Configure Certkingdom -WS292 to receive an IP lease from a DHCP server.
D. Configure Certkingdom -WS292 to use Certkingdom -WS291 for DNS name resolution.

Answer: C.

Explaination: The problem is most likely caused by an incorrect or non-existent
default gateway setting on Certkingdom -WS292. If you configure
Certkingdom -WS292 to use DHCP to obtain IP addressing information,
Certkingdom -WS292 will receive the correct settings from the ICS service on
Certkingdom -WS291.
Incorrect Answers:
A: The question refers to a shared dial-up connection on Certkingdom -WS291 not
working. If the dial-up connection is shared, then Internet Connection Sharing is enabled
already.
B: The question states that Certkingdom -WS291 automatically connects to the network at
the main office whenever the user on Certkingdom -WS291 attempts to access resources
located on the main office network. This indicates that automatic dial-up is already
configured.
D: Certkingdom -WS291 is not a DNS server. The ICS service has a DNS proxy that
would pass DNS requests to whichever DNS server Certkingdom -WS291 is using.
Reference:
J. C. Mackin, Ian McLean, MCSA/MCSE Self-Paced Training Kit (exam 70-291):
Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 network
Infrastructure, Part 1, Chapters 1 & 2, pp. 45, 124

QUESTION 14:

A. On Certkingdom -SR25, configure Conflict detection attempts to 1.
B. On Certkingdom -SR25, configure Conflict detection attempts to 3.
C. On Certkingdom -SR25, configure client reservations for each client computer’s MAC
address.
D. On Certkingdom -SR25, activate and reconcile the scopes.

Answer: A

Explaination: When conflict detection attempts are set, the DHCP server uses the
Packet Internet Groper (ping) process to test available scope IP addresses before
including these addresses in DHCP lease offers to clients. A successful ping means
that the IP address is in use on the network. This results in the DHCP server not
offering to lease the address to a client.
If the ping request fails and times out, it indicates that the IP address is not in use on the
network. In this case, the DHCP server offers to lease the address to a client. Each
additional conflict detection attempt delays the DHCP server response by a second while
waiting for the ping request to time out. This in turn increases the load on the server. A
value of no greater than two (2) is recommended for ping attempts.
Incorrect Answers:
B: Due to the latency involved in ping attempts, the higher the conflict detection value is
set, the longer the lease process will be for every client that uses the DHCP server.
C: Configuring client reservations for each client computer MAC address will involve a
physical visit to each and every client computer if you do not ping it successfully.
D: The scope would already be activated in this scenario.
Reference:
Deborah Littlejohn Shinder, Dr. Thomas W. Shinder, Chad Todd and Laura Hunter,
Implementing, Managing, and Maintaining a Windows Server 2003 Network
Infrastructure Guide & DVD Training System, pp. 208-209

QUESTION 15:

A. On Certkingdom -SR31, modify the Dynamically update DNS A and PTR records only
if requested by the DHCP clients option.
B. On Certkingdom -SR38, modify the Always dynamically update DNS A and PTR
records option.
C. On Certkingdom -SR31, modify the Discard A and PTR records when lease is deleted
option.
D. On Certkingdom -SR31, modify the Dynamically update DNS A and PTR records for
DHCP clients that do not request dynamic updates (for example, clients running
Windows NT 4.0) option.

Answer: D

Explaination: Dynamically Update DNS A And PTR Records For DHCP Clients That
Do Not Request
Updates – This checkbox lets you handle these older clients graciously by making the
updates using a separate mechanism. When checking this check box you will ensure that
Certkingdom -SR38can resolve FQDNs for all client computers on the network under the
given circumstances and the role that Certkingdom -SR31 plays.
Incorrect Answers:
A: Dynamically Update DNS A And PTR Records Only If Requested By The DHCP
Clients – This radio button (which is on by default) tells the DHCP server to register the
update only if the DHCP client asks for DNS registration. When this button is active,
DHCP clients that aren’t hip to DDNS won’t have their DNS records updated. However,
Windows 2000, XP, and Server 2003 DHCP clients are smart enough to ask for the
updates.
B: Always Dynamically Update DNS A And PTR Records – This radio button forces the
DHCP server to register any client to which it issues a lease. This setting may add DNS
registrations for DHCP-enabled devices that don’t really need them, like printer servers;
however, it allows other clients (like Mac OS, Windows NT, and Linux machines) to
have their DNS information automatically updated. This is not what is required.
C: Discard A And PTR Records When Lease Is Deleted – When a DHCP lease expires,
what should happen to the DNS registration? Obviously, it would be nice if the DNS
record associated with a lease vanished when the lease expired; when this checkbox is
checked (as it is by default), that’s exactly what happens. If you uncheck this box, your
DNS will contain entries for expired leases that are no longer valid; when a particular IP
address is reissued on a new lease, the DNS will be updated, but in between leases you’ll
have incorrect data in your DNS-always something to avoid.
Reference:
James Chellis, Paul Robichaux and Matthew Sheltz, MCSA/MCSE: Windows Server
2003 Network Infrastructure Implementation, Management, and Maintenance Study
Guide, p. 246

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Sunday, November 13, 2011

Microsoft sloppy on Duqu workaround

Duqu exploits a previously unknown TrueType font parsing bug in the Windows kernel. The bug exists in all the supported versions of Windows: XP, Vista, 7, Server 2003 and Server 2008. It's a big-time bug too, as it lets bad guys do pretty much anything they want to do on the victims' computer.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

While it works on a fix, Microsoft has offered a workaround that prevents access to the buggy component, file t2embed.dll. But Microsoft seems to have been particularly sloppy in explaining their workaround.

I am referring to Microsoft Security Advisory (2639658) Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege.

To begin with, the Suggested Actions section of the advisory offers commands that a Windows user can issue to deny access to T2EMBED.DLL.

Someone running a 64-bit version of Windows XP or Windows Server 2003, is instructed to "enter the following command" after which there are two commands. Likewise, anyone running a 32 bit version of Windows Vista, 7 or Server 2008 is also instructed to "enter the following command" and then given two commands to run.

Should you issue just the first one as instructed, or, assume the instructions are wrong and issue both commands?

And, someone running a 64 bit version of Vista, 7 or Server 2008 is given four commands to enter after the instructions to "enter the following command".

And, it goes without saying that before making sytem modifications, you should always make a restore point. I mean this literally, Microsoft omits this important Defensive Computing step from their instructions. All their "Fix it" solutions make a restore point before changing anything, so it should be in the manual instructions too.

Also missing are instructions for determining if a given copy of Windows is 32 or 64 bit. My favorite method is the free and portable SecurAble utility from Steve Gibson.

More importantly, the advisory appears to conflict with itself.

In the Mitigating Factors section it says "The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message."

In the FAQ section it says "There are multiple means that could allow an attacker to exploit this vulnerability, including ... convincing users to visit a Web page that embeds TrueType."

Many, if not most, email messages are formatted with HTML, the underlying language of web pages. So, can viewing an HTML formatted email message result in an infection? I would think so.

Or, is the point about web pages wrong? I've read my share of articles on Duqu in the technical press and none of them mentioned that infection was possible by viewing a web page.

And, if web pages are a means of infection, Microsoft should say if this is true for all web browsers or only theirs.

I asked Microsoft for clarification, we'll see if I get an answer.

Microsoft has also failed to provide a tester, that is, something that a Windows user can do to verify that the workaround is, in fact, working.

If Word is the only means of infection, they should offer a test Word document. If you can get infected via a web page, Microsoft should create a page with an embedded TrueType font that does something trivial, like running the calculator, on a vulnerable machine.

They also don't say if running as limited/restricted/standard user offers any protection. My guess is that it does not, but considering this is a common defensive tactic against malware, it should be mentioned in the advisory.

Finally, Microsoft is virtually silent on the issue of what breaks when you install the workaround, be it manually with commands or with their dedicated Fix it tool.

A person commenting on a ZDNet story said the workaround "kills the ability to export to PDF in Office 2010". Another person, commenting on the same story, said that Windows Update on Windows XP gets confused by the workaround and tries to install a pair of old patches. I can't vouch for either observation.

EMAIL ATTACHMENT DEFENSE

Taking a step back, its worth noting that infected email attachments are a tried and true attack vector. And, it's a shame, because there is much that Windows users can do to protect against this, for free, that rarely gets discussed.

My first defensive computing tact for email attachments is to open them with unpopular software. For example, use Writer in LibreOffice rather than Word or SumatraPDF rather than the Adobe Reader.

An excellent second line of defense can be provided by running the unpopular software in a Sandboxie sandbox.

Finally, all email attachments need to be treated as dangerous. Just because they appear to come from someone you know means nothing.