Windows Server 2008 Chapter 4

Front 1

What forms the base around which Active Directory is built and allows applications to integrate with Active Directory?

Back 1

Lightweight Directory Access Protocol (LDAP)

Front 2

Lightweight Directory Access Protocol is based on what protocol?

Back 2

X.500

Front 3

What are the building blocks of the active directory structure in a domain?

Back 3

Organizational Units (OU's)

Front 4

What are the benefits of using OU's?

Back 4

Hierarchical structures for easy resource access
Delegation of administrative authority
Able to change OU structure easily
Can hide AD objects for confidentiality

Front 5

A person with higher security privileges assigns authority to a person of lesser security privileges to perform certain tasks, is know as what?

Back 5

Delegation of control

Front 6

What are the 3 types of object that can be assigned permission to access an Active Directory object?

Back 6

Users
Groups
Computers

Front 7

Within active directory object permission, users, groups, and computers are referred to as what?

Back 7

Security Principles

Front 8

What are the 3 components that make up an Active Directory's object security settings?

Back 8

Discretionary Access Control List (DACL)
Object Owner
System Access Control List (SACL)

Front 9

Each entry in the DACL is referred to as what?

Back 9

Access control entry (ACE)

Front 10

What defines the settings for auditing access to an object?

Back 10

System Access Control List (SACL)

Front 11

What are the 5 standard permissions that can be assigned to a security principal?

Back 11

Full control
Read
Write
Create all child objects
Delete all child objects

Front 12

What are the 3 ways users can be assigned permission to an object?

Back 12

-User's account is added to the object's DACL (aka effective permissions)
-A group the user belongs to is added to the object's DACL
-The permission is inherited from a parent objects DACL

Front 13

What permission overrides Allow permissions?

Back 13

Deny
-exception is when the deny permission is inherited from a parent object and the allow permission is explicitly added to the object's DACL

Front 14

If a security principal isn't represented in an object's DACL, does it have access to the object?

Back 14

No

Front 15

What defines how permissions are transmitted from a parent object to a child object?

Back 15

Permission Inheritance

Front 16

All object in Active Directory are child object of what?

Back 16

The domain

Front 17

What wizard is used to assign users the authority to perform certain tasks on Active Directory objects?

Back 17

Delegation of control wizard

Front 18

By default, AD Users and Computers hide some system folders and advanced features, but you can display them by enabling what?

Back 18

Advanced Features from the view menu

Front 19

What are the 4 new folders available after enabling the advanced features in Active Directory Users and computers?

Back 19

-Lost and Found
-Program Data
-System
-NTDS

Front 20

Which advanced features option stores quota information that limits the number of Active Directory objects a user, group, computer, or service can create?

Back 20

NTDS

Front 21

What term describes a combination of the allowed and denied permissions assigned to a security principal?

Back 21

Effective permissions

Front 22

What term refers to permissions that override inherited permissions and can create some exceptions to the rule that "deny permissions override allow permissions"?

Back 22

Explicit permissions

Front 23

Permission inheritance is enabled by default on child objects but can be disabled. True or False?

Back 23

True

Front 24

Each Active Directory database is referred to as a what?

Back 24

Directory partition

Front 25

What are the 5 directory partition types in the Active Directory database?

Back 25

-Domain directory partition
-Schema directory partition
-Global catalog partition
-Application directory partition
-Configuration partition

Front 26

Which partition contains all objects in a domain, including users, groups, computers, OU's and so forth?

Back 26

Domain directory partition

Front 27

Which directory partition contains information needed to define AD objects and object attributes?

Back 27

Schema directory partition

Front 28

Which directory partition is a partial replica of all objects in the forest and holds the global catalog?

Back 28

Global catalog partition

Front 29

Which directory partition is used by applications and services to hold information that benefits from Active Directory replication and security such as DNS?

Back 29

Application directory partition

Front 30

Which directory partition holds configuration information that can affect the entire forest, such as details on how domain controllers should replicate with one another?

Back 30

Configuration partition

Front 31

What is the name for a number of operations in a forest having a single domain controller with sole responsibility for the function?

Back 31

Operations master

Front 32

Which domain controller in the forest generally takes on the role of the operations master?

Back 32

First domain controller

Front 33

Can the responsibility for operations master roles be transferred to another domain controller?

Back 33

Yes

Front 34

The 5 operations master roles are referred to as what?

Back 34

Flexible single master operation roles (FSMO)

Front 35

What are the 5 Operations Master Roles?

Back 35

-Schema master
-Infrastructure master
-Domain naming master
-RID master
-PDC emulator master

Front 36

Which FSMO role provides backward compatibility with Windows NT servers configured as Windows NT backup domain controllers or member servers?

Back 36

PDC emulator master

Front 37

Which Operations Master role is responsible for replicating the schema directory partition to all other domain controllers in the forest when changes occur?

Back 37

Schema master

Front 38

Which Operations Master role is responsible for ensuring that changes made to object names in one domain, are updated in references to these objects in other domains?

Back 38

Infrastructure master

Front 39

Which FSMO role manages adding, removing, and renaming domains in the forest?

Back 39

Domain naming master

Front 40

Which FSMO role is responsible for ensuring that no 2 object have the same RID (relative identifier) and issuing unique pools of RID's to each domain controller thereby guaranteeing unique SID's?

Back 40

RID master

Front 41

What is the process of maintaining a consistent database of information when the database is distributed among several locations?

Back 41

Replication

Front 42

What is the term for replication between domain controllers in the same site?

Back 42

Intrasite replication

Front 43

What is the term for replication between two or more sites?

Back 43

Intersite replication

Front 44

What type of replication is used for replicating Active Directory Objects, such as users and computer accounts, which means changes to these objects can occur on any domain controller and are propagated, or replicated to all other domain controllers?

Back 44

Multimaster replication

Front 45

What process runs on every domain controller to determine the replication topology, which defines the domain controller path that Active Directory changes flow through?

Back 45

Knowledge Consistency Checker (KCC)

Front 46

In Active Directory, what defines how security principals from one domain can access network resources in another domain?

Back 46

Through a trust relationship

Front 47

What role provides the following vital funtions:
-Facilitate domain and forestwide searches
-facilitate logon across domains
-Hold universal group membership information

Back 47

Global catalog servers

Front 48

If A=B and B=C, then A=C. This is an example of what?

Back 48

Transitive Trust

Front 49

What type of trust can be used to integrate users of other OS's into a Windows Server 2008 domain or forest?

Back 49

Realm Trust

Front 50

The protocol for accessing active directory objects and services is based on what standard?

Back 50

LDAP

Front 51

What MMC do you use to create OUs?

Back 51

Active directory users and computers

Front 52

User, computer, and group accounts can be referred to as what?

Back 52

Security principals

Front 53

What must you modify if you want to change an active directory object's permissions?

Back 53

DACL

Front 54

An object's owner automatically has full control permission for the object. True or False?

Back 54

False

Front 55

JDoe is a member of a group that has Full control permission for an OU, which the group inherited from a parent OU. What is the best way to stop him from having Write permission to this OU without affecting any other permissions?

Back 55

Add an explicit Deny ACE for JDoe to the OU

Front 56

If you can't view an object's permissions, what is the most likely problem?

Back 56

You need to enable Advanced Features

Front 57

A user's permissions to an object that are a combination of inherited and explicit permissions assigned to the user's account and groups that a user belongs to are referred to as what?

Back 57

Effective permissions

Front 58

Do inherited permissions always overide explicit permissions?

Back 58

No

Front 59

What FSMO role is responsible for management of adding, removing, and renaming domains in a forest?

Back 59

Domain naming master

Front 60

What is responsible for determining the replication topology?

Back 60

KCC

Front 61

How would you give access to company users of domain resources from one forest to another?

Back 61

Forest trust

Front 62

All domains in a forest have what 2 common partitions?

Back 62

Schema and Global catalog

Front 63

What can you do to reduce the delay caused by authentication referral?

Back 63

Create a shortcut trust

Front 64

What can you do to integrate user authentication between Linux and Active Directory?

Back 64

Create a realm trust

Front 65

Trust relationships between all domains in a forest are two-way transitive trusts. True or False?

Back 65

True