REAL QUESTIONS SUBMIT MATERIAL ADVERTISE
Braindumps

Microsoft

Cisco

Citrix

CIW

CompTia

CWNA

Apple

Adobe

HP

Legato

Exin

Filemaker

Brocade

Ericsson

TIA

Veritas

ISEB

SCP

IISFA

ISM

OMG

Apc

Mile2

Foundry

Huawei

McData

Symantec

TeraData

RedHat

Solar Winds

Blue Coat

Riverbed

 

 
 
Click on name of dumper to view the dump
 

Jonson

Hayden

 
 

Braindumps of 70-647
PRO: Windows Server 2008, Enterprise Administrator

 


Submitting dumps with some changes. The original is also available in www.braindumps.org.
 


QUESTION 1:
You are an enterprise administrator for Abc . The company has a head office in San Diego and a branch office in New York. The corporate network of Abc consists of an Active Directory forest having two domains, Abc .com and Branch. Abc .com for the head office and the branch office respectively. All the servers on the corporate network run Windows Server 2008 and both the offices hold their respective domain controllers on their physical office locations. The two domain controllers at Abc .com are called Abc Server1 and Abc Server2 and the two domain controllers at Branch. Abc .com are called Abc Server3 and Abc Server4. All domain controllers host Active Directory-integrated DNS zones for their respective domains. As an enterprise administrator of the company, you have been assigned the task to ensure that users from each office can resolve computer names for both domains from a local DNS server. Which of the following options would you choose to accomplish this task?
A. Add the Abc .com and the Branch. Abc .com DNS zones to the ForestDNSZones partition.
B. Create a stub DNS zone for Abc .com on Abc Server3 and a stub DNS zone for Branch. Abc .com on Abc Server1.
C. Create a standard primary DNS zone named Abc .com on Abc Server3 and a standard primary DNS zone named Branch. Abc .com on Abc Server1.
D. Configure conditional forwarders on Abc Server1 to point to Abc Server3 conditional forwarders on Abc Server3 to point to Abc Server1.
E. None of the above.
Answer: A
Explanation:
To ensure that users from each office can resolve computer names for both domains from a local DNS server, you need to add the Abc .com and the Branch. Abc .com DNS zones to the ForestDNSZones partition because the ForestDNSZones directory partition can be replicated among all domain controllers (DCs) located in both the domains Abc .com and Branch. Abc .com in the forest of the company.
This is because all the domain controllers have the DNS service installed. Once the DNS Zones data is replicated the users from each office can resolve computer names for both domains from their local DNS server
A stub zone cannot be used because it is used to resolve names between separate DNS namespaces a Standard Primary DNS zone cannot be used because the DNS Server in this type of zone contains the only writable copy of the DNS zone database files. There can be only one Standard Primary DNS Server for a particular zone. A conditional forwarder cannot be used because it handles name resolution only for a specific domain.
Reference:
What causes the error I receive in the event log when I attempt to replicate the ForestDNSZones directory partition?
http://windowsitpro.com/article/articleid/43165/q-what-causes-the-error-i-receive-in-the-event-log-when-iattem
Reference:
Understanding stub zones
http://207.46.196.114/windowsserver/en/library/648f2efd-0ad4-4788-80c8-75f8491f660e1033.mspx?mfr=true
Reference:
DNS Conditional Forwarding in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Conditional_Forwarding_in_Windows_Server_200

QUESTION 2:
You are an enterprise administrator for Abc . The company has a head and a three branch offices. Each office has a Windows Server 2008 server running with a DNS role installed on it. All the branch offices consist of Windows 2000 Professional client computers installed on their networks. As an enterprise administrator of the company, you have been assigned the task to deploy Active Directory Domain Services (AD DS) on the corporate network of the company. You also need to plan the implementation of a name resolution solution for the deployment of AD DS that supports secure dynamic updates and minimize the response times for users connecting to resources anywhere on the network. Which of the following options would you include in your plan to accomplish this task?
A. Implement GlobalNames zone (GNZ) for the forest.
B. Implement a single Active Directory-integrated (ADI) DNS zone.
C. Create a stub zone on the DNS server in each branch office.
D. Create a standard primary zone in the head office and the secondary zones in branch offices.
E. None of the above.
Answer: B
Explanation:
To deploy Active Directory Domain Services (AD DS) on the corporate network of the company with given requirements, you need to implement a single Active Directory-integrated (ADI) DNS zone. Active Directory integrated (ADI) primary DNS zone enables built-in recovery, scalability, and performance. An ADI zone is a writeable copy of a forward lookup zone that is hosted on a domain controller.
It can therefore reduce the response times for users connecting to resources anywhere on the network and because it uses directory-integrated storage it also simplifies dynamic updates for DNS clients that are running Windows 2000. None of the other options can be used to meet the desired objectives.
Reference:
From the Windows 2000 Resource Kit
http://windowsitpro.com/article/articleid/76616/jsi-tip-5312-when-you-change-your-dns-active-directoryintegra
Reference:
ACTIVE DIRECTORY ADMINISTRATION TIPS
http://searchwinit.techtarget.com/tip/0,289483,sid1_gci1115858,00.html

QUESTION 3:
You are an enterprise administrator for Abc . The company has a head office and a branch office located at different physical locations. The corporate network of the company consists of a single Active Directory domain. Both the offices of the company run Windows Server 2008 servers and have 2,000 client computers configured as DHCP clients without having DHCP relay supported on the network routers. As an enterprise administrator of the company, you have been assigned the task to configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails. Which of the following options would you choose to accomplish this task?
A. Install two DHCP servers, one in the head office and the other in branch office and make sure that both the DHCP servers have two scopes.
B. Install a DHCP instance on a two node failover cluster in each office, the head office and the branch office.
C. In the head office, install a DHCP server and in the branch office, install a DHCP Relay Agent.
D. In the head office, install a DHCP instance on a two node failover cluster and in the branch office, install a DHCP Relay Agent.
E. None of the above.
Answer: B
Explanation:
To configure a DHCP addressing solution for both the offices that would minimize the traffic between the offices and is available in case any one of the DHCP server fails, you need to install a DHCP instance on a two node failover cluster in each office, the head office and the branch office. The two node failover cluster in each office will ensure that the DHCP server is always available even if one of the DHCP servers fails. Because DHCP relay is not supported on the network, both the offices need to have a separate DHCP failover clustering solution.
Having two scopes of DHCP servers will not help because DHCP relay is not supported on the network. Installing a DHCP server and DHCP Relay Agent in the branch office and installing a DHCP instance on a two node failover cluster and in the branch office and a DHCP Relay Agent will not help because this solution would increase the traffic between the offices in case any one of the DHCP server fails.
Reference:
Step-by-Step Guide for Configuring Two-Node File Server Failover Cluster in Windows Server 2008
http://209.85.175.104/search?q=cache:9u-snEWIUtgJ:download.microsoft.com/download/b/1/0/b106fc39-936c
Reference:
DHCP Relay Agent Overview
http://www.tech-faq.com/dhcp-relay-agent.shtml

QUESTION 4:
You are an enterprise administrator for Abc . The corporate network of the company consists of a single Active Directory forest that contains 25 domains. All the DNS servers on the corporate network run Windows Server 2008. The users on the corporate network use NetBIOS name to connect to the network applications in all the domains. Currently the network is configured with IPv4 addressing. As an enterprise administrator of the company, you have been assigned the task to migrate the network to an IPv6-enabled only network without affecting any client computer. Which of the following options would you choose to accomplish this task?
A. Configure GlobalNames zones on the DNS servers running Windows Server 2008.
B. Add all domain zones to the ForestDNSZones partition on the DNS servers running Windows Server 2008.
C. Create a new running Windows Server 2008 server and configure WINS server on it.
D. Create a new running Windows Server 2003 server and configure WINS server on it.
E. None of the above.
Answer: A
Explanation:
To migrate the network from IPv4-enabled to an IPv6-enabled only network without affecting any client computer, you need to configure GlobalNames zones on the DNS servers running Windows Server 2008. To help customers migrate to DNS for all name resolution, the DNS Server role in Windows Server 2008 supports a special GlobalNames Zone (also known as GNZ) feature. The client and server name resolution depends on DNS. A DNS Client is able to resolve single-label names by appending an appropriate list of suffixes to the name.
The correct DNS suffix depends on the domain membership of the client but can also be manually configured in the advanced TCP/IP properties for the computer. The problem occurs managing a suffix search list when there are many domains. For environments that require both many domains and single-label name resolution of corporate server resources, GNZ provides a more scalable solution. GNZ is designed to enable the resolution of the single-label, static, global names for servers using DNS.
WINS cannot be used because it does not support IPv6 protocols and both are entering legacy mode for Windows Server 2008. ForestDNSZones partition cannot help to migrate a IPv4-enabled network to an IPv6-enabled only network
Reference:
Understanding GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/windows-DNS-globalnames-zone.htm
Reference:
Using GlobalNames Zone in Windows Server 2008
http://www.petri.co.il/using-globalnames-zone-window-server-2008.htm

QUESTION 5:
You are an enterprise administrator for Abc . The company has a head office and two branch offices. The corporate network of Abc consists of a single Windows Server 2008 Active Directory domain called Abc .com. The DNS Service is installed on the member servers of the Abc .com domain and all the domain controllers and DNS servers for the Abc .com domain are located in the head office. As an enterprise administrator of the company, you have been assigned the task to deploy two new Active Directory domains named branch1. Abc .com and branch2. Abc .com in the branch offices. To accomplish this task, you installed a DNS server in each branch office. Which of the following actions would you perform next to prepare the environment for the installation of the new domains? (Select three. Each selected option will form a part of the answer.)
A. Configure a delegation subdomain DNS record on the main office DNS server for each new domain.
B. Create a new standard primary zone on each branch office DNS server for the new domains.
C. Create a new stub zone on each branch office DNS server for the new domains
D. Configure forwarders on the main office DNS servers to point to the branch office servers.
E. Configure conditional forwarders on the main office DNS servers to point to the branch office DNS servers.
F. Configure zone transfer for the Abc .com zone to the branch office DNS servers.
Answer: A, B, F
Explanation:
To deploy two new Active Directory domains in the branch offices, you need to first configure a delegation subdomain DNS record on the main office DNS server for each new domain then create a new standard primary zone on each branch office DNS server for the new domains and then configure zone transfer for the Abc .com zone to the branch office DNS servers after installing DNS server in each branch office.
In DNS, a subdomain is a portion of a domain that you've delegated to another DNS zone. A subdomain is configured when you need to create domains in existing domain. A company might use subdomains for its various divisions. Because, to migrate your DNS zone data for the Abc .com zone to the branch office DNS servers, you will need to have a functioning standard primary server, you will need to create a new standard primary zone on each branch office DNS server for the new domains.
Reference:
Delegate subdomains in DNS in Windows 2000 Server
http://articles.techrepublic.com.com/5100-10878_11-5846057.html
Reference:
Step-By-Step: How to migrate DNS information to Windows Server 2003
http://www.lockergnome.com/it/2005/01/14/step-by-step-how-to-migrate-dns-information-to-windows-server-20
Reference:
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html

QUESTION 6:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single Active Directory forest that is made up of a single root domain and 15 child domains. The Administrators of the child domains need to frequently modify the records for authoritative DNS servers for the child domain DNS zones. The administrators take a long time in modifying these records. As an enterprise administrator of the company, you have been assigned the task to implement a solution that would minimize the effort required to maintain name resolution on the network. Which of the following options would you choose to accomplish this task?
A. Create stub zones for the root domain zone on the child domain DNS servers.
B. Configure conditional forwarders for the parent domain on the child domain DNS servers.
C. Create stub zones for the child domain zones on the root domain DNS servers.
D. Configure delegation subdomain records for the child domains on the root domain DNS servers.
E. None of the above.
Answer: C
Explanation:
To implement a solution that would minimize the effort required to maintain name resolution on the network, you need to create stub zones for the child domain zones on the root domain DNS servers. Stub zones can help reduce the amount of DNS traffic on your network by streamlining name resolution and zone replication. The Stub zone should be configured for the child domain zones on the root domain DNS servers and not vice versa because a stub zone is like a secondary zone that obtains its resource records from other name servers (one or more master name servers).
Reference:
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html

QUESTION 7:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. On one of the Windows Server 2008 member servers, Abc Server1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, Abc Server2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured. Some client computers that do not have the latest Microsoft updates installed connect to the local area network (LAN) from client computers that are joined to a workgroup. Besides all network switches used for client connections are unmanaged. As an enterprise administrator of the company, you have been assigned the task to implement a Network Access Protection (NAP) solution to protect the network. You need to ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain. Which of the following NAP enforcement method should you use to accomplish this task?
A. 802.1x
B. DHCP
C. IPsec
D. VPN
E. None of the above.
Answer: C
Explanation:
To ensure that only the computers that have the latest Microsoft updates installed must be able to connect to servers in the domain and only the computers that are joined to the domain must be able to connect to servers in the domain, you need to use IPSec NAP enforcement method. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec.
Reference:
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx
Reference:
Network Access Protection (NAP) Deployment Planning / Choosing
Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.aspx

QUESTION 8:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single Windows Server 2008 Active Directory domain and one IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista, Windows XP Professional, and Windows 2000 Professional. On one of the Windows Server 2008 member servers, Abc Server1, Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services are configured. On another Windows Server 2008 member server, Abc Server2, Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA) services are configured. The NAP is configured by using IPsec, DHCP, and 802.1x enforcement methods. Currently the computers that are not joined to the domain can easily connect to the domain and access network resources. As a network administrator, you want to stop this security lapse and want to ensure that only computers that are joined to the domain can access network resources on the domain. Which of the following options would you choose to accomplish this task?
A. Configure all DHCP scopes on Abc Server1 to enable NAP.
B. Configure all network switches to require 802.1x authentication.
C. Create a GPO, link it to the domain. Enable a secure server IPsec policy on all member servers in the domain in the GPO.
D. Create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec communications on all client computers in the domain in the GPO.
E. None of the above.
Answer: C
Explanation:
To ensure that only computers that are joined to the domain can access network resources on the domain, you need to create a GPO, link it to the domain and enable a secure server IPsec policy on all member servers in the domain in the GPO. IPsec domain and server isolation methods are used to prevent unmanaged computers from accessing network resources. This method enforces health policies when a client computer attempts to communicate with another computer using IPsec.
Configuring DHCP scope cannot stop unmanaged computers that are not joined to the domain from accessing the network. NAP is not required in this scenario because you just want the member computers to access network resources. Therefore, you need not create a GPO, link it to the domain. Enable a NAP enforcement client for IPsec communications on all client computers in the domain in the GPO.
Reference:
Protecting a Network from Unmanaged Clients / Solutions
http://www.microsoft.com/technet/security/midsizebusiness/topics/serversecurity/unmanagedclients.mspx

QUESTION 9:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single IP subnet. All servers in the domain run Windows Server 2008 and all the client computers run Windows Vista. The network contains three Windows Server 2008 servers configured as follows:
1. Abc Server1 - Configured with Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and DHCP services.
1. Abc Server2 - Configured with Routing and Remote Access Service (RRAS), Network Policy Service (NPS), Health Registration Authority (HRA), and Microsoft System Center Configuration Manager (SCCM) 2007 services
1. Abc Server3 - Configured with File Services and Microsoft Windows SharePoint Services (WSS).
As an enterprise administrator of the company, you have been assigned the task to configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources. Besides, you need to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only Abc Server1 and Abc Server2 initially. .Which of the following NAP enforcement method should you use to accomplish this task?
A. 802.1x
B. DHCP
C. IPsec communications
D. VPN
E. None of the above.
Answer: A
Explanation:
To configure the NAP environment that would only allow computers that have required Microsoft updates installed to access the internal network resources and to ensure that when the client computers connect to the network, the network switches would only allow them to communicate with only Abc Server1 and Abc Server2 initially, you need to use 802.1x NAP enforcement method because this method enforces health policies when a client computer attempts to access a network using EAP through an 802.1X wireless connection or an authenticating switch connection.
Reference:
Network Access Protection (NAP) Deployment Planning / Choosing Enforcement Methods
http://blogs.technet.com/nap/archive/2007/07/28/network-access-protection-deployment-planning.asp

QUESTION 10:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single Active Directory domain. All the servers in the domain run Windows Server 2008 and all the client computers run Windows Vista with Service Pack 1. The network contains three Windows Server 2008 servers configured as follows:
1. Abc Server1- Configured with Network Policy and Access Services (NPAS).
2. Abc Server2 - Configured with Microsoft Windows SharePoint Services (WSS).
3. Abc Server3 - Configured with File Services.
The company has many remote users (domain members) that need to access the domain resources from their remote locations. Some of the remote users informed you that they can access Abc Server2 by using the URL
https://portal. Abc .com from their remote locations through Internet but the firewall used at their remote location site prevents all other outbound connections. As an enterprise administrator of the company, you have been assigned the task to plan a solution that would allow the remote users to access files on Abc Server3 through a VPN connection Which of the following types of connections should you enable on Abc Server1?
A. Configure IPsec tunnel mode connection
B. Configure a L2TP VPN connection
C. Configure a PPTP VPN connection
D. Configure Secure Socket Tunneling Protocol (SSTP) connection
E. None of the above.
Answer: D
Explanation:
To plan a solution that would allow the remote users using firewall on their remote locations to access files on Abc Server3 through a VPN connection, you need to configure Secure Socket Tunneling Protocol (SSTP) connection.
Before Windows Server 2008, all kinds of VPN connections such as PPTP L2TP, and IPSec had problems with firewalls, NATs, and Web proxies. To prevent problems, firewalls must be configured to allow connections. If your VPN client computer is behind a NAT, both the VPN client and the VPN server must support IPsec NAT-Traversal (NAT-T). Besides, VPN server can't be located behind a NAT, and that L2TP/IPsec traffic can't flow through a Web proxy.
With the advent of SSTP in Windows Server 2008 all the VPN connectivity problems such as firewalls, NATs, and Web proxies are solved. The SSTP connection allows the use of HTTP over secure sockets layer (SSL). SSTP uses an HTTP-over-SSL session between VPN clients and servers to exchange encapsulated IPv4 or IPv6 packets.
Reference:
The Cable Guy: The Secure Socket Tunneling Protocol / The New VPN Solution
http://technet.microsoft.com/en-us/magazine/cc162322.aspx

QUESTION 11:
You are an enterprise administrator for Abc . The company has three departments, Sales, Marketing, and Development. The corporate network of Abc consists of a single Windows Server 2008 Active Directory domain. Some employees in the Development department are allowed to work from home because of their inability to come to the office for some reasons. These employees usually need to access the applications installed on the internal network computers and the file servers on the corporate network. As an enterprise administrator of the company, you have been assigned the task to provide a secure remote access solution for the development department employees keeping in mind the company's security policy. According to the security policy of the company, the remote computers can only connect to the corporate network by using SSL. Besides this all the remote computers that connect to the network must have an up-to-date antivirus application and all available security updates installed on them. Which of the following types of remote connection solution would you select to accomplish this task?
A. Configure a PPTP VPN connection.
B. Configure a L2TP VPN connection.
C. Configure a TS connection that uses TS Gateway.
D. Configure a TS connection that uses TS Web Access.
E. None of the above.
Answer: C
Explanation:
The TSGateway Manager snap-in console enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources. This may include an up-to-date antivirus application and all available security updates installed on them. TSGateway encapsulates Remote Desktop Protocol (RDP) within RPC, within HTTP over a Secure Sockets Layer (SSL) connection.
Reference:
TS Gateway Overview
http://technet2.microsoft.com/windowsserver2008/en/library/722f3aa8-2f22-462f-bcc6-72ad31713ddd1033.msp

QUESTION 12:
You are a network administrator for Abc . The corporate network of the company consists of a single domain. The corporate network of the company consists of a Windows Server 2008 server that run Routing and Remote Access Service (RRAS) and 20 portable client computers that run different client operating systems The portable computers have been issued to the remote users of the company that connect to the network using a VPN connection to the RRAS server. The some remote users also use their personal computers to connect to the corporate network. Which of the following options would you choose to ensure that the computers that connect to the corporate network of the company remotely must have Windows Vista installed, Windows Firewall enabled, most up-to-date antivirus definitions, and most up-to-date updates installed on them?
A. Implement Authorization Manager.
B. Implement Network Access Protection (NAP) on the perimeter network.
C. Install a Microsoft Internet Security and Acceleration Server (ISA) 2006 on the network.
D. Create a Group Policy object (GPO), link it to the domain and publish updated antivirus definitions through it. Also enable Windows Firewall on it.
E. None of the above.
Answer: B
Explanation:
To ensure that the computers that connect to the corporate network meet all the required conditions, you need to implement Network Access Protection (NAP) on the perimeter network. NAP uses System Health Agent (SHA) to check if the specified system health requirements are fulfilled. The SHA can verify whether the Windows Firewall is on; antivirus and antispyware software are installed, enabled, and updated; Microsoft Update Services is enabled, and the most recent security updates are installed.
If the system is not in the required state, the SHA can then start a process to remedy the situation. For example, it can enable Windows Firewall or contact a remediation server to update the antivirus signatures
Reference:
Windows Server 2008 NAP (Network Access Protection) infrastructure
http://4sysops.com/archives/windows-server-2008-nap-network-access-protection-infrastructure/

QUESTION 13:
You are a network administrator for Abc . The corporate network of the company consists of a single Active Directory domain. All domain controllers on the corporate network of the company run Windows Server 2008. You have been assigned the task to configure access restriction policies for the network which would only allow Windows Vista computers that have Windows Firewall enabled to access the network Which of the following option would you choose to accomplish this task?
A. Implement Authorization Manager.
B. Implement Network Access Protection (NAP).
C. Create and link a Group Policy object (GPO) to the domain and then enable the Windows Firewall settings in it.
D. Create a Group Policy object (GPO) and an organizational unit (OU), link the GPO to OU and then enable the Windows Firewall settings in the GPO.
E. None of the above.
Answer: B
Explanation:
To configure access restriction policies for the network which would only allow Windows Vista computers that have Windows Firewall enabled to access the network, you need to implement Network Access Protection (NAP). NAP uses System Health Agent (SHA) to check if the specified system health requirements are fulfilled. The SHA can verify whether the Windows Firewall is on; antivirus and antispyware software are installed, enabled, and updated; Microsoft Update Services is enabled, and the most recent security updates are installed.
If the system is not in the required state, the SHA can then start a process to remedy the situation. For example, it can enable Windows Firewall or contact a remediation server to update the antivirus signatures
Reference:
Windows Server 2008 NAP (Network Access Protection) infrastructure
http://4sysops.com/archives/windows-server-2008-nap-network-access-protection-infrastructure/

QUESTION 14:
You are an enterprise administrator for Abc . The corporate network of Abc consists of a single Active Directory domain. The network contains four Windows Server 2008 servers configured as follows:
1. Abc Server1 (Domain Controller) - Configured with Active Directory Domain Services (AD DS).
2. Abc Server2 (RAS for VPN connections, RADIUS client) - Configured with Routing and Remote Access Service (RRAS).
3. Abc Server3 (RAS for VPN connections, RADIUS client) - Configured with Routing and Remote Access Service (RRAS).
4. Abc Server4 (RADIUS Server) - Configured with Network Policy Server (NPS).
As an enterprise administrator of the company, you have been assigned the task to plan a solution that would allow you to manage all VPN connections to the network by allowing you to specify the allowed VPN connection protocols, allowed VPN client authentication mechanisms, and VPN client access rights based on group membership. Which of the following options would you choose to accomplish this task?
A. Create a GPO and apply it to Abc Server2 and Abc Server3
B. Create a GPO and apply it to the computers that must establish VPN connections
C. Create a local computer policy on Abc Server2 and Abc Server3
D. Create a network policy on Abc Server4
E. None of the above.
Answer: D
Explanation:
To plan a solution that would allow you to manage all VPN connections to the network by allowing you to specify the allowed VPN connection protocols, allowed VPN client authentication mechanisms, and VPN client access rights based on group membership, you need to create a network policy on Abc Server4, which is a Network Policy Server. This server is the Microsoft implementation of a RADIUS server and proxy in Windows Server 2008.
As a RADIUS server, NPS performs centralized connection authentication, authorization, and accounting for many types of network access, including wireless and virtual private network (VPN) connections.
The GPOs cannot be used in this scenario because they can be used to Create/Replace/Update or Delete a Virtual Private Network (VPN) or Dial-Up Network (DUN) connection and cannot be used to specify the allowed VPN connection protocols, allowed VPN client authentication mechanisms, and VPN client access rights based on group membership
Reference:
Network Policy Server
http://technet.microsoft.com/en-us/network/bb629414.aspx
Reference:
Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences
http://www.windowsecurity.com/articles/Group-Policy-related-changes-Windows-Server-2008-Part3.html


70-647

 

 

Braindumps Real exam questions and verified answers - 100% passing guarantee - cheap prices.

 

Free brain dumps Braindumps, notes, books for free

 

Braindumps and Exams - Instant download real exam questions - Passing guarantee.

Follow us on FaceBook
Braindumps on Facebook
 
 
 
 
 

CheckPoint

Linux

Novell

DB/2

Network Appliance

EC-Council

Nortel

McAfee

Juniper

ISACA

PMI

Sybase

EMC

HDI

SNIA

ISC

Sair

IBM

Lotus

Exam Express

3COM

BICSI

DeLL

Enterasys

Extreme Networks

Guidance Software

Computer Associates

Network General

SAS Institute

Alcatel Lucent

SeeBeyond

TruSecure

Polycom

Hyperion

Hitachi

Nokia

Fortinet

Vmware

Fujitsu

Tibco

Intel

PostgreSQLCE

BusinessObjects

RESSoftware

BlackBerry

AccessData

ICDL

Isilon

SAP

The Open Group

ACSM

Altiris

Avaya

Cognos

F5

Genesys

SDI

ACI

ASQ

Google

H3C

HIPAA

HRCI

SOA

IIBA

Zend