Case Study: Woodgrove Bank

Overview 

Woodgrove Bank is a financial institution that operates in the Netherlands. The company’s primary business is providing residential and commercial mortgages. 

The Company wants to offer its customers secure Internet access to a mortgage management application. 

Physical Location 

The Company's main office is located in Amsterdam. The Company has two branch offices in the 

following Locations:  

• Utrecht 
  
• The Hague 
  

The Company has 200 local banks that are located throughout the Netherlands. The number of users in each location is shown in the following: 

Location Number of Users 

1. Amsterdam 2,500 

2. Utrecht 650 

3. The Hague 800 

4. Each Local Bank 10-100 

Planned Changes 

The Company wants to convert its mortgage management application to a multitier application named NewApp. 

To support this new environment, the company will upgrade its servers to Windows Server 2003. 

Business Processes 

The Amsterdam office and each branch office has its own IT staff in addition, most of the larger local banks have their own IT staff. 

Currently, Local bank employees have access to their local resources and to resources at the Amsterdam office. Each office uses it own instance of a business-critical mortgage application. 

The IT staff at the Amsterdam office includes a development team. The development team is responsible for developing and testing NewApp. 

Infrastructure 

Directory Services 

The Relevant portion of current domain structure is shown in the Existing Domain Model exhibit :

The Company has a Windows NT 4.0 environment that has more that 200 domains; each domain has a two-way trust relationship with the domain at Amsterdam office. 

Currently, Domain administrators manage their own domains. Each Location that has a local 

administrator currently manages its own users and resources. In addition, these administrators share responsibility for administrating ring locations that do not have an IT staff. 

Network Infrastructure 

Domain Controllers vary from single processor servers at 700Mhz to processor Quad server at 1.5 GHz. 

Client Computers run Windows 98, Windows NT Workstation 4.0 and Windows 2000 professional. There are also some Unix Client Computers. 

Managers are issued portable Computers that contain confidential business information. These portable computers are equipped with smart card readers. Managers use portable computers to establish VPN connections to the Amsterdam office when they travel. 

Problem Statements 

The following business problems must be considered: 

• Employees at local banks are often unable to serve customers because of failure of the mortgage application. The failure sometimes lasts many hours because there is nobody available to fix it. 
• The Development team has access to the occasionally, unapproved changes that are made to the application, resulting in unnecessary downtime. 
  
• Deployment of new operating systems takes a long time because network administrators have to each local bank. 
  

Chief Executive Officer 

I want Woodgroove bank to be visible on the Internet. I want NewApp to be easily accessible to our customers by using the Internet. 

The newly designed environment will help to minimize the amount of administrative effort for all IT-related operational tasks. 

For business reasons, I will not allow domain upgrades. 

Officer Worker 

Currently, it is sometimes difficult to access the information I need. For different information, I have to remember different passwords. In the new environment, I want to have one account and one password. 

Business Requirements 

Business Drivers 

The following business requirements must be considered: 

• Woodgroove Bank wants their company name to be visible on the Internet with. 
  
• Customers must be able to access mortgage information 24 hours a day, seven days a week. 
  
• The Company wants to reduce the costs of managing branch offices. 
  

Organizational Goals 

The following organizational requirement must be considered 

• Bank employees need to be able to make a secure connection from their homes to the corporate network. 
  
• The company currently has 1 million customers. About half of them have mortgages. In the next 5 years, the infrastructure must be able to accommodate at least 2 million customers, with about 1 million customers having mortgages. 
  

Security 

The following security requirement must be considered 

• Bank employees must have access to resources at the Amsterdam office, their local banks, and NewApp. 
  
• The Company must ensure that servers can be easily restored when one or more servers fail, with minimum loss of data and minimum downtime. 
  
• The Company needs the highest possible secure authentication method for all computers that contain confidential information. 
  

NewApp Requirements 

The following NewApp requirement must be considered 

• NewApp is a web-based application that contains tools that are used by customers and tools that are used by employees. 
  
• Employees from all locations will connect to the web servers to access NewApp. 
  
• NewApp stores customer information in Active Directory by using custom classes and attributes. 
  
• NewApp stores mortgage information in the NewApp database. 
  
• Developers need to be able to test the NewApp schema modifications without affecting any other servers. 
  
• NewApp must be available 24 hours a day, seven days a week. 
  
• Because of national legal requirements, the server that contains mortgage information requires several security settings that are different from those on the NewApp application servers. 
  

Technical Requirements 

Active Directory 

The following Active Directory requirement must be considered 

• Active Directory must be deployed to support NewApp. 
  
• All domain controllers in the new environment must run Windows Server 2003. 
  
• Administration of Active Directory will not be performed at the local banks. 
  
• Each user should be authenticated locally when possible. 
  
• Domain Controllers will be placed in all locations that support more than 50 users. 

Network Infrastructure 

The following Network Infrastructure requirement must be considered 

The planned network is shown in the planned Network Infrastructure exhibit. 

Network Infrastructure Exhibit: 

Planned Exhibit: 

Bandwidth between the Amsterdam office and the branch offices is not an issue. However, some local banks report that there are slow response times to the branch offices or to the Amsterdam office. 

The company uses some legacy applications that are heavily dependent on NetBios name resolution. These applications will also be used after the migration. 

The Company needs to use the smallest subnets possible in each location because of planned future expansion to include many additional branch offices. 

VPN servers will be placed at the Amsterdam office only. 

It is crucial to ensure 24-hour availability of the VPN servers. 

Dial-up servers exist in each branch office to allow network administrators to administer each branch office in the event of WAN link failure. 

Management of all remote access must be centralized. 

Woodgrove Bank (9 Questions) 

QUESTION NO 1: 

You are designing a forest structure to meet the business and technical requirements. How many forests should you create? 

A. One 

B. Two 

C. Three 

D. Four 

QUESTION NO 2 

You are designing an organizational unit (OU) structure to manage the New App servers. What should you do? 

A. Create one OU that includes both the web servers and the database servers. 

B. Create one OU that includes the web servers and one OU that includes the database servers. 

C. Create one OU that includes the web servers. Then Place the database servers in the Computer Containers. 

D. Place the web server and the database servers in the Domain Controller OU. 

QUESTION NO 3 

You are designing a new NETBIOS naming strategy for the corporate environment. Which domain name should you use? 

A. ad 

B. woodgrovead 

C. woodgrovebank 

D. woodgrovebank.com 

QUESTION NO 4 

You need to configure the security settings for the new app servers. Which two actions should you perform? (Each correct answer presents part of the solutions. (Choose two) 

A. Create a Group policy object (GPO) for the web servers. 

B. Create a Group policy object (GPO) for the database servers. 

C. Modify the Default Domain Policy. 

D. Modify the Default Domain Controllers Policy. 

QUESTION NO 5 

You are designing an Active Directory site infrastructure to meet the bussiness and technical requirements. What should you do? 

A. Create one site for each office and each local bank. 

B. Create one site for all offices. Create one site for all local banks. 

C. Create one site for Amsterdam. Create one site for all branch office and all local banks. 

D. Create one site for Amsterdam. Create one site for the Utercht brach office. Create one site for that Hague branch office. Place half the local banks in the utercht site and half the local banks in the Hague site. 

E. Create one site for Amsterdam. Create one site for the Utercht brach office. Create one site for each local bank that has more than 50 users. Place all the other local banks in the Amsterdam Site. 

QUESTION NO 6 

You are designing a strategy to ensure that DNS queries always take the most efficient route to get resolved. Which action or actions should you perform? (Choose all that apply) 

A. Configure conditional forwarding on the corporate DNS servers to point the development DNS servers. 

B. Configure conditional forwarding on the development DNS servers to point the corporate DNS servers. 

C. Configure conditional forwarding on the perimeter network DNS servers to point the corporate and development DNS servers. 

D. Configure forwarding on the corporate and development DNS servers to point the perimeter network DNS servers. 

E. Disable root hints on the perimeter network DNS Servers. 

QUESTION NO 7 

You are designing a remote access strategy to meet the business & technical requirements. Which authentication mechanism should you use? 

A. MS-CHAP v2. 

B. Internet Authentication service (IAS). 

C. Multilink & Bandwidth Allocation Protocol (BAP). 

D. Remote access policies on all servers running Routing & Remote Access. 

QUESTION NO 8 

You are designing the TCP/IP addressing scheme for the company. What should you do? 

To Answer, Drag the Appropriate subnet mask or masks to the correct location or locations in the work area. 

QUESTION NO 9 

You are designing a VPN Server strategy to meet the business and technical requirement. What should you do? 

A. Configure all client computers to point to a VPN server in Amsterdam. 

B. Configure all client computers to use Multilink Bandwidth Allocation Protocol (BAP). 

C. Create a network Load Balancing cluster of VPN servers. 

D. Create a shutdown script for the VPN servers to delete the host(A) resource record of the VPN sever from the DNS database when the VPN server are shutdown. 

Case Study: Consolidated Messenger

Overview 

Consolidated Messenger is a transportation and express delivery company serving the continental United States. 

The company maintains a commitment to its customers to expedite deliveries within contracted guidelines and offers a 100 percent refund to the customers if the contract is not fulfilled. 

Physical Locations 

The company's main office is in Chicago. The company has two branch offices in the following locations:  

• Boston 
  
• San Diego 
  

Planned Changes 

The company is expanding its business into the Asian market by acquiring Contoso, ltd., which is an Asian import company located in San Francisco. Contoso, Ltd has established relationships with shipping companies and various retail firms in China. Furthermore, Contoso, Ltd. has a strong background in working with the governmental trade protocol in china. 

Consolidated Messenger is also planning changes to enable the office and the branch office to work together more effectively. 

Business Processes 

Consolidated Messenger consists of the following primary departments: 

• Accounting 
  
• Customer service 
  
• Delivery 
  
• Human Resources (HR) 
  
• Information Technology (IT) 
  
• Management 
  

The company has a decentralized IT structure. The Chicago office and each branch office have its own IT staff. 

Each office maintains its resources separately. Each office is using the same delivery tracking database, named Deliveries, but information is not shared between the three offices. 

Each office uses an application named TrackingApp to update the tracking database. 

Every morning, delivery personnel receive a printed list of deliveries to be made for the day. They can contact the appropriate office for additional information, as needed. 

Infrastructure 

Directory Services 

The existing domain model is shown in the Existing Domain Model exhibit. 

Consolidated Messenger has Windows NT 4.0 domains in the branch offices. The Chicago office has a Windows 2000 Active Directory domain named ad.consolidatedmessenger.com 

The domain for the Chicago office contains four toplevel organizational units (OUs) named Accounting, Customer Service, Human Resources, and Delivery. The network consists of a single Active Directory site. 

Contoso, Ltd., has a Windows NT4.0 domain in its San Francisco office. 

Network Infrastructure: 

The company's existing network infrastructure is shown in the Existing Network Infrastructure exhibit. 

Client computers in the accounting, IT and management departments, at Consolidated Messenger, run either Windows 2000 professional or Windows XP professional. Client computers in the customer service department run windows 98. 

Client computers at Contoso, Ltd runs either Windows 98 or Windows NT workstation 4.0. 

Consolidated Messenger has a web site hosted by an ISP in Chicago. The web site, named www.consolidatedmessenger.com, is available for Internet customers to place orders or track deliveries. 

Contoso, Ltd., also has a web site, named www.contoso.com, which provides information to users about Contoso, Ltd. It is hosted by an ISP in San Francisco. The ISP in San Francisco has DNS on a Unix Server. 

The IP address in use for Consolidated Messenger is shown in the Network addresses exhibit. 

 

Problem Statements 

The following business problems must be considered: 

• Consolidated Messenger needs to create a better delivery tracking mechanism for the existing offices. Currently, each office provides point-to-point delivery as orders come in. 
• They are functioning adequately, but there is room for improved operational efficiency. For example, the Chicago office sometimes delivers into the northeast, which overlaps with the territory of the Boston office. Both the Chicago office and the Boston office might deliver to the west coast, which is the territory of the San Diego office. A centralized database is required to make tracking delivers more efficient. 
• When Consolidated Messenger implements a centralized version of the Delivers database, there must be a way to ensure continuous access to up to date delivery data, regardless of WAN status. 
• Consolidated Messenger wants to provide a better solution for delivery personnel to access 
  
• information about scheduled deliveries, than printed delivery lists. 
  
• Consolidated Messenger will need to bring Contoso, ltd, up to its technology standards. Contoso, ltd., does not use much technology. Although there is a Windows NT 4.0 domain present, there is a network administrator and there has been a great deal of turnover in this job. As a result, there is not adequate security for its computers. It does not adequately track Shipments, Inventory, Payable, or Receivable. Although Contoso, ltd. uses a spreadsheet application for its inventory listings it is still primarily a paperbased company. 

Chief Executive Office 

With the acquisition of Contoso, ltd., by Consolidated Messenger, I am concerned that it should be a part of our overall business model, yet remain separate because it is a new venture. This is a positive addition to our current line of business. I want to be sure that have a method for clearly tracking the contributions that Contoso, ltd., makes to our business. 

Chief Information Officer 

I have two major goals for our Deliveries database. First, I want a method for integrating the data between the offices. Second, I want a directory services structure that provides a more straight forward model for maintenance. 

I also want an improved user experience when accessing centralized resources in the Chicago office. Additionally, I have strong reservations regarding the inexperience of the new IT staff to be hired in the San Francisco office. I want to make sure that we are monitoring their activities. 

I foresee substantial expenditure for upgrading desktop computers, and salaries for a new IT staff in the Contoso, Ltd., division. We need to provide sufficient access to Contoso, Ltd.; however, we need to spend only the money necessary to achieve this goal. 

Managers, Contoso, Ltd 

I am unsure if the restrictions imposed by our new parent company will benefit the business of Contoso, Ltd. On the other hand, I fully recognize that being part of a larger company can provide us with more financial stability. 

Business Requirements 

The following business requirement must be considered:  

• Contoso, Ltd., will be a separate division within Consolidated Messenger, maintaining its line of business because Contoso Ltd., is a new endeavor, Consolidated Messenger has elected to keep the namespace separate so that the internal staff will not be confused. 
• The duplication of effort in maintaining the Deliveries database between Consolidated Messenger branch offices must be reduced. 
• Contoso needs to replace spreadsheets. The database, to be named Inventory, will be created and administered in the Chicago office. The IT staff in the Chicago office will be responsible for the maintenance of this database, and will be replicated from the San Francisco office to the Chicago office. It is anticipated that database replication will exceed the available bandwidth provided by the VPN connection between the San Francisco office and the Chicago office. 

Organizational Goals 

The following organizational requirements must be considered: 

• Integrating the separate database into a single nationwide database is extremely important to the business. 
• Delivery workers will begin using PDAs to download delivery information from the Deliveries database. As a result, they will discontinue telephone check in for delivery information. As each delivery is completed, the customer will sign the PDA. At the end of each day, the delivery information will be batch uploaded from each PDA to the Deliveries database either from a company office or, if delivery personnel are too far away from a company office, a remote connection.  
• Each office must support wireless access for PDAs 
  

Security 

The following security requirements must be considered: 

• Appropriate permissions to trackingapp, the Deliveries database, and other resources will need to be established for users based on that user's job function. Job functions include customer service, delivery personnel, accounting, and management. 
• The IT staff in the Chicago office will audit administrative activity in all domains, particulary in Contoso,Ltd., domain, this includes interactive logons; shutdowns and restarts of domain controllers; changes to security logging; and changes to user and group accounts. 

Tchnical Requirements 

Active Directory 

The following Active Directory requirements must be considered: 

• Enterprise Active Directory administration will take place in the Chicago office. Additionally, the IT staff in the Chicago office has the primary responsibilities for administration of the Deliveries database. 
• Each current Consolidated Messenger domain will undergo an in place upgrade. Contoso, Ltd., will be added to the forest, but will maintain its separate namespace. The Contoso, Ltd., domain will be named ad.contoso.com. Their will be a single forest design with a minimum number of domains. 
• Upgrading the Windows NT 4.0 domains in the Boston and San Diego offices must be optimized to reduce the need for network administrators to travel between offices. 
• Permissions must be maintained. Additional groups can be created for the Deliveries database, as needed. 
• User and group accounts for Contoso, Ltd. will be recreated. However, desktop settings for Contoso, Ltd., users must be preserved. 

Network Infrastructure 

The following Infrastructure requirements must be considered: 

• All Contoso, Ltd., client computers will run Windows XP Professional. Consolidated Messenger has decided to migrate the user settings from the existing Contoso, Ltd., client computers to ease the transition. 
• The Deliveries database is a missioncritical resource for Consolidated Messenger. Database access for the Deliveries databases must be maintained in the event that WAN connectivity is lost. 
• All domain controllers will be configured as DNS servers. Client computers will be configured to point to the local DNS server.  
• DNS zones must be secured. 
  
• VPNs will be implemented in all locations to support remote access for wireless devices. 
  
• Remote access policies will be centralized. 
  
• A single DHCP server will be configured in each office. In the event of a DHCP server failure, client computers must be able to obtain an IP address. 

Consolidated Messenger (9 Questions) 

QUESTION NO: 1 

You are designing the DNS zone to support the Active Directory domain for Contoso.Ltd. Which two actions should you perform? (Each Correct answer presents part of the solution. Choose two). 

A. Create ad.contoso.com as a standard primary DNS Zone. 

B. Create ad.contoso.com as an Active DirectoryIntegrated DNS Zone. 

C. Enable only authorized client computers to update DNS. 

D. Configure a zone transfer between the DNS server at the ISP and the DNS servers at Contoso.Ltd. 

QUESTION NO: 2 

Exhibit 

You are designing the Active Directory Infrastructure for the new forest to meet the business and technical requirements. What should you do? 

A. Choose forest model A. 

B. Choose forest model B. 

C. Choose forest model C. 

D. Choose forest model D. 

QUESTION NO: 3 

You are designing a strategy for adding the additional hardware necessary to support Contoso, Ltd. What should you do? 

A. Add a T1 Wan Link Between Chicago and San Francisco. 

B. Add a T3 Wan Link Between Chicago and San Francisco. 

C. Add a Basic ISDN Connection between Chicago and San Francisco. 

D. Configure HighSpeed modems in Chicago and San Francisco to support demand-dial routing. 

QUESTION NO: 4 

You are designing a client computer upgrade strategy for Contoso.Ltd. What should you do? 

A. Use the ldifde command to migrate user settings. 

B. Use the User State Migration Tool (USMT) to Migrate user settings. 

C. Create trust relationships between the Chicago domain and the San Francisco domain. Use the Active Directory Migration Tool (ADMT) to migrate user settings. 

D. Create trust relationships between the forest root domain and the San Francisco domain. Use the Active Directory Migration Tool (ADMT) to migrate user settings. 

QUESTION NO: 5 

You are designing a DNS Name resolution strategy for the client computer in the customer service department. What are the two possible ways to achieve the goal? (Each Correct answer presents a complete solution. (Choose two) 

A. Create a reverse lookup zone in DNS for each new Domain. 

B. Add a WINS lookup record to the DNS forward lookup zone. 

C. Add a WINS reverse record to the DNS reverse lookup zone. 

D. Enable Dynamic updates for DownLevel client computers on each DHCP server. 

E. Install the Active Directory Client on All Computers in the Customer service department. 

QUESTION NO: 6 

You are designing DNS implemetation Strategy for the new Infrastruce. Which two actions should you perform? (Each correct answer represents part of the solution. Choose two). 

A. Create a Stub Zone in each domain of the root zone. 

B. Create a _msdcs subdomain in a new zone on the root domain. 

C. Replicate the _msdcs subdomain across the roor domain. 

D. Replicate the _msdcs subdomain to the ForestDNS zone applciation partition. 

E. Configure a zone transfer of the _msdcs subdomain to secondary zone on all DNS servers in the forest. 

QUESTION NO: 7 

You are designing a remote access strategy to meet the business and technical Requirement. What should you do? 

A. Configure each server running Routing and Remote Access as a RADIUS Client. 

B. Add a Remote Access policy to each server running Routing and Remote Access. Configure the Access method as VPN access. 

C. Add a Remote Access policy to each server running Routing and Remote Access. Configure the Access method as dialup access. 

D. Add a Remote Access policy to each server running Routing and Remote Access. Configure the Access method as wireless access. 

QUESTION NO: 8 

You are designing a DNS implementing strategy to meet the business and technical requirement. Which type of zone should you use? 

A. Sub Zones 

B. Standard Primary Zones 

C. Secondary Zones 

D. Active DirectoryIntegrated Zones 

QUESTION NO: 9 

You are designing a strategy to perform inplace upgrade of domain controller in Boston and San Diego. Which method should you use? 

A. adprep 

B. sysprep 

C. Answer File 

D. Remote Installtion Services (RIS) 

Case Study: Fourth Coffee

Overview
Fourth Coffee is company that specializes in the retail sale of packaged coffee. The Company has more than 500 retails outlets throughout the United States.

Physical Location
The Company's main office is located in Atlanta. The Company has six branch offices in the following locations:

• Boston 
  
• Chicago 
  
• Dallas 
  
• Denver 
  
• Los-Angeles 
  
• Seattle 
  

Each Branch office manages at least 60 retail outlets.

Planned Changes
The company plans to upgrade the network to make provision for future expansion of the company product line. This will be the first upgrade in six years.

Business Processes
The Atlanta office manages the six branch offices, as well as the retail outlets in the Atlanta area. The branch offices manage the retail outlets in their respective cities and regions. Some of the very large retail outlets have managers who are responsible for daily reporting. Each of those managers has a desktop computer for the purpose of creating reports.

A single group of network administrators, located in the Atlanta office, controls all network resources and access. Two employees per branch office have been trained to assist the administrative group by performing tasks from the branch office whenever necessary.

In each branch office a point-of-sale application, named the retail outlet employees of sale application, is installed on servers that run Windows NT 4.0 Terminal Server Edition. The Retail outlet employees currently do not have access to any other applications.

Employees in the Atlanta office and the branch offices work between the hours of 8:00 A.M and 5:00 P.M, Monday through Friday. The network administrators are required to work on weekends to support the retail outlets. Employees in the retail outlets work in two shifts between the hours of 6:00 A.M and 11.00 P.M.

Infrastructure
Directory Services

The network consists of a single Windows NT 4.0 Domain named Fourth coffee. One PDC and Three BDC’s are located in the Atlanta Office.

Each branch office has a BDC. The Domain Controllers are not used for any other network service. Each group has been named for the function of the Group. For example, the group name of the users in the finance department of the Atlanta office is Atlanta Finance Users.

Network Infrastructure
The network connections between the Atlanta office and the branch offices are shown in the Existing Network Infrastructure exhibit

The Atlanta office and the branch offices have 100-Mbps Ethernet networks.

Each retail outlet connects to the associated branch office by using a fractional T1 line with a committed rate of 256 kbps or greater.

All WAN links are reliable. There is an agreement between Fourth Coffee and its telecommunications provider to have any WAN failure resolved within one hour. The amount of bandwidth currently seems to be sufficient during business hours.

The Atlanta office and the branch offices have servers running Windows NT Server 4.0, Terminal Server Edition. The number of servers per office is based on the number of retail outlets that connect to the Atlanta office or branch offices, and the number of terminals at the retail outlets. The distribution of servers is shown in the following table.

Only one of the terminal servers in Atlanta, running Windows NT Server 4.0, is dedicated to the finance department.

The other six terminal servers are available to be used by the retails outlets. No other servers or
operating systems are in use. All company software has been successfully tested on computers that run Windows Server 2003 and Windows XP Professional.

The Company's existing hardware is shown in the following table.


Problem Statements
The following business problems must be considered:

• Employees in the branch offices often log on to install software by using local computer accounts rather than domain accounts.
• IP addresses are configured manually. This leads to incorrectly configured or duplicate addresses on the network.
• Employees in the retail outlets have been reporting that network performance is slow.
  
• Employees with desktop computers do not want to lose their installed application, data and profiles during the changeover.

Executives
Chief Executive Officer
Fourth Coffee’s Expansion will occur as a phased process over the next three years, and we need to use some of our accumulated profits to achieve this.

A new company policy must be enforced to ensure that all company employees have access to similar network services when they are at work.

A market survey has shown that we need to establish a web presence to remain competitive. We need to provide information about what we do, where we are located and what our business hours are.

Chief Information Officer
The existing network was designed and implemented almost six years ago. Only minor changes have taken place since that time, the only thing that has changed is an upgrade to our WAN links last year. This upgrade did not solve the performance problems experienced by the retail outlets. It has since been established that the performance problems are related to hardware.

With the changes in our product line, we anticipate a growth in the number of customers. This ensures that terminals must be upgraded to provide for the increased connection to our servers from the retail outlets. We do not expect to add a vast number of terminals.

Substantial funds are available for this project. We hope to once again have a network that will last six years without major changes.

Network Administrator
We have noticed in System Monitor that most servers are running high processor and memory
utilization. We currently instruct the retail outlets on which terminal server to connect to, to achieve manual load balancing.

The individual users in the retail outlets must have access to personal data in the new environment. We currently do not have any DNS servers or Internet access available.

Even though I am a newly appointed network administrator, I found that the current management of our groups is incorrect. We use only local groups for the assignment of permissions. This is done by using groups that contain all the users located in the branch offices. Sometimes we may be more specific and focus on the function of the group within the office. Users can also be managed very easily, because we know that almost all of the passwords are "password". Only a few users change their passwords. Complex passwords need to be implemented.

The users at the retail outlets sometimes leave the terminal connected to the application for weeks without disconnecting. This results in failed backups of the application data. All of the users in the branch offices also leave their computers on for long periods of time.

We plan to implement a naming strategy that will identify users by first name, followed by the first character of their surname. Group names will indicate the department, as well as "GG" for global groups or "UG" for universal groups. Domain local groups will be identified by the type of access they will receive.

Retail Manager
We have noticed that the network is gradually becoming slower. No one in the retail outlets has access to e-mail and we do not have Internet access.

All employees in our retail outlet use the same username and password to connect to the terminal server. As a result, we do not have any privacy and cannot even have our own desktop background. Employees in the branch offices have very nice games and other software on their computers that we are not able to access.

Business Requirements
Business Drivers
The following business requirements must be considered:

• A Web site, named www.fourthcoffee.com, must be established to enable customers to search for the retail outlet nearest to them.
• An online ordering system must be established, which will allow customers to order company merchandise online.

Organizational Goals
The following organizational requirements must be considered:

• Retail outlets will be expanded over the next three years to provide seating and to allow for increased business. Future expansion might include providing customers with Internet access while they are having their coffee in the store.
• A manager will be appointed in each retail outlet with the task of improving customer service. The manager’s desktop computer will be used by other staff members to access the Internet and their e-mail by using their own usernames and passwords.

Security
The following security requirements must be considered:

• All security settings must be equal to or more restrictive than the default Windows Server 2003 settings.
• As a part of these requirements, all users must be forced to change their passwords at least once a month.
• Users with desktop computers should no longer be allowed to log on to the local computer as an administrator.
• The duration of logon hours must be strictly enforced.
  
• Users must not be allowed to shutdown the terminal servers.
  

Technical Requirements
Active Directory
The following active directory requirements must be considered:

• The Active Directory design must specify how the management of user and group permissions will be established and maintained.
• The new design must overcome the existing performance issues and also provide all employees with e-mail and Internet access. Employees in the retail outlets will be allowed to use these services only while they are on their lunch or coffee breaks. Employees will be able to use only their own user accounts for network access.
• The design must also facilitate the use of Group Policy to control all user accounts within a branch office. Group Policy settings for users in the branch offices must be different from the Group Policy settings for users in the retail outlets.
• User accounts for users in the finance department must be managed separately.
  

Network Infrastructure
The following network infrastructure requirements must be considered:

• A new T1 WAN link from the Atlanta office to the ISP will be installed.
  
• All server computers must have Windows Server 2003 installed. All desktop computers must have Windows XP professional installed. This must be achieved as quickly as possible.
• All terminal servers in a single office must be configured to use Network Load Balancing. All users must use roaming profiles to ensure that they have a consistent desktop appearance and access to applications. Terminal server user profiles must be stored on a network shared folder. Redundancy for all other servers is required.

Fourth Coffee (11 Questions)

QUESTION NO: 1
You are designing a strategy for configuring a newly installed Windows Server 2003 computer to meet the Active Directory DNS requirements. How should you configure the computer?

A. As a caching-only DNS servers
B. As the primary DNS server for the fourthcoffee.com DNS zone
C. With a stub zone fo the fourthcoffee.com DNS zone hosted by the ISP
D. As a secondary DNS server for the fourthcoffee.com DNS zone hosted by the ISP

QUESTION NO: 2
You are designing the forest and domain structure to meet the business and technical requirements. Which structure should you use?

A. A single forest with one tree, and one domain
B. A single forest with one tree two domain
C. A single forest with two trees, each with a single domain
D. Two forests, each with a single tree and a single domain
E. Two forests, each with two trees, with a single domain in each tree.

QUESTION NO: 3
You are designing a group management strategy for users in the finance department. You need toidentify the appropriate changes that need to be made to the current group management strategy. You want to accomplish this goal by using the minimum number of groups. What should you do?

A. Add the finance users to the financeData group to which the necessary permissions have been assigned.
B. Add the finance users to the financeGG group to which the necessary permissions have been assigned.
C. Add the finance users to the financeGG group. Then add the financeGG group to the financeData group
to which the necessary permissions have been assigned.
D. Add the finance users to the financeGG group. Add the financeGG group to the financeUG group to the financeDat group to which the necessary permissions have been assigned.

QUESTION NO: 4
You are designing a strategy of enforce the corporate security policy. Which action or actions should you perform? (Choose all that apply.)

A. Configure a password policy that requires strong passwords
B. Configure a password policy that requires all users to change their passwords once a month.
C. Allow users in the branch offices to log on between the hours of 8:00 A.M and 5:00 P.M., Monday through Friday.
D. Allow users in the retail outlets to log on between the hours of 6:00 A.M and 11:00 P.M., daily.
E. Enable a policy that forces users to log off when their logon hours expire.

QUESTION NO: 5
You are designing a migration strategy to meet the business and technical requirements. What should you do?

A. Upgrade the fourthcoffee BDC to Windows Server 2003. Then upgrade the PDC to Windows Server 2003
B. Upgrade an existing domain controller to Windows Server 2003. Establish a two-way trust relationship with the fourthcoffee domain.
C. Install and configure a new Windows NT 4.0 BDC. Promote the BDC to a PDC. Then upgrade the PDC to Windows Server 2003
D. Create a new Windows 2000 Server Active Directory domain. Establish a two-way trust relationship with the fourthcoffee domain. Use the Active Directory Migration Tool (ADMT) to migrate all user and computer accounts.

QUESTION NO: 6
You are designing for implementing Group Policy objects (GPOs) to meet the business and technical requirement. What should you do?

A. Create one new GPO to enforce software restriction policies. Link this GPO to the domain.
B. Create one new GPO to enforce software restriction policies. Link this GPO to the appropriate
organizational unit (OU).

C. Create one new GPO to enforce software restriction policies. Link this GPO to all organizational units (OUs).
D. Create new GPOs to match the number of organizational units (OUs).configure these GPOs to enforce software restriction policies. Link this GPO to its respective OU.

QUESTION NO: 7 

You are designing a DNS name resolution strategy to allow all users access to internal and external web sites. What should you do? 

A.  Allow zone transfers to any DNS server. 

B.  Create a new stub zone for the DNS zone on the DNS server. 

C.  Configure the DNS server to forward all unanswered queries to a DNS server located at the ISP 

D.  Add the DNS server located at the ISP to the list of name servers for the fourthcoffee.com DNS zone 

QUESTION NO: 8 

You are designing a strategy to assign the IP addresses to meet the business and technical requirement. 

Which two actions should you perform? (Each correct answer presents part of the solution. choose two) 

A.  Install and Configure one DHCP server in Atlanta and one DHCP server in each branch office. 

B.  Install and Configure two DHCP servers in Atlanta and two DHCP servers in each branch office. 

C.  Create one scope on each DHCP server. Specify one DHCP server to always update DNS records. Configure the scope to assign half of the IP addresses available to each office. 

D.  Create two scopes on each DHCP server. Specify one DHCP server to update DNS records only for client computers that request it. Specify a second DHCP server to never update DNS records. 

QUESTION NO: 9 

You are designing a name resolution strategy for the retail outlets to ensure that the existing bandwidth is used efficiently. Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.) 

A. Configure the DNS server service on the terminal servers as caching-only servers. 

B. Configure multiple sites to have site links and set up a specific replication schedule. 

C. Configure the default site to have the subnets of Atlanta and the branch offices. 

D. Create a new DNS zone and configure zone transfers to name servers only. 

E. Create an application partition to be used for DNS 

F. Specify the scope of replication to be used for DNS 

QUESTION NO: 10 

You are designing a strategy for installing Windows server 2003 on the new domain controllers. Which method should you use? 

A. Unattended installation 

B. Remote Installation Services (RIS) 

C. Automated Deployment Services (ADS) 

D. Microsoft Systems Management Server (SMS) 

QUESTION NO: 11 

You are designing a strategy to ensure that all employees have Internet access. For each branch office, what should you do? 

A. Configure a DNS server to function as caching-only servers 

B. Configure Internet Connection sharing on terminal servers. 

C. Install and configure an Internet Security and Acceleration (ISA) Server Computer 

D. Install and configure a server running Routing and Remote Acess to function as a VPN server 

windows 2003 DNS的新增内容之存根区域(Stub Zone)

了解存根区域

存根区域是一个区域副本，只包含标识该区域的权威域名系统 (DNS) 服务器所需的那些资源记录。存根区域用于在单独 DNS 命名空间之间解析名称。如果公司合并者要求两个单独的 DNS 命名空间的 DNS 服务器解析这两个命名空间中的客户端的名称，则可能必须进行这种类型的解析。

存根区域由以下部分组成：

• 委派区域的起始授权机构 (SOA) 资源记录、名称服务器 (NS) 资源记录和粘附 A 资源记录。
  
• 可用来更新存根区域的一个或多个主服务器的 IP 地址。
  

存根区域的主服务器是对于子区域具有权威性的一个或多个 DNS 服务器，通常 DNS 服务器主持委派域名的主要区域。

存根区域解析

DNS 客户端在建立了存根区域的 DNS 服务器上执行递归查询操作时，DNS 服务器会使用该存根区域中的资源记录来解析查询。DNS 服务器向存根区域的 NS 资源记录中指定的权威 DNS 服务器发送迭代查询，仿佛在使用其缓存中的 NS 资源记录一样。如果 DNS 服务器找不到其存根区域中的权威 DNS 服务器，那么建立了该存根区域的 DNS 服务器会尝试使用根提示进行标准递归。

DNS 服务器将从存根区域中列出的权威 DNS 服务器接收的资源记录存储在它的缓存中，但不会将这些资源记录存储在存根区域本身，只有查询响应中返回的粘附 A 资源记录存储在存根区域中。存储在缓存中的资源记录按照每个资源记录中的生存时间 (TTL) 的值进行缓存。不写入缓存的 SOA、NS 和粘附 A 资源记录，按照在存根区域的 SOA 记录中指定的过期间隔过期，该过期间隔是在创建存根区域期间创建的，在从原始主要区域向存根区域传输期间更新。

如果查询是迭代查询，DNS 服务器会返回一个包含存根区域中指定的服务器的参考信息。

宿主父区域和子区域的 DNS 服务器之间的通信

仅当将这些新的 DNS 服务器的资源记录添加到 DNS 服务器主持的父区域时，已向另一个 DNS 服务器上的子区域委派域的 DNS 服务器，才可了解该子区域的新的权威 DNS 服务器。这是一个手动过程，要求不同的 DNS 服务器的管理员经常通信。使用存根区域，主持其委派域之一的存根区域的 DNS 服务器可在该存根区域更新时获取该子区域的权威 DNS 服务器的更新。更新是从主持该存根区域的 DNS 服务器执行的，不需要与主持该子区域的 DNS 服务器的管理员取得联系。下面的示例将对该功能加以说明。

存根区域方案

父区域 example.com 的权威 DNS 服务器已经向单独的 DNS 服务器委派了一个子域 widgets.example.com。最初执行域 widgets.example.com 的委派时，父区域只包含 widgets.example.com 区域的权威 DNS 服务器的两个 NS 记录。随后，子区域的管理员将其他 DNS 服务器配置为该区域的权威服务器，但不通知主持父区域 example.com 的 DNS 服务器的管理员。结果，主持父区域 example.com 的 DNS 服务器不知道它的子区域的新的权威 DNS 服务器，并继续只查询它知道的两个权威 DNS 服务器。

为父区域 example.com 配置权威 DNS 服务器，使其为委派的域 widgets.example.com 主持一个存根区域，这样做使上面这种情况得到补救。example.com 的权威 DNS 服务器的管理员更新该存根区域时，它会查询该存根区域的主服务器，以获取 widgets.example.com 的权威 DNS 服务器资源记录。结果，父区域的权威 DNS 服务器将了解有关 widgets.example.com 子区域的新的权威 DNS 服务器的信息，并能够向该子区域的所有权威 DNS 服务器执行递归。

如何使用

使用存根区域使用存根区域可执行以下操作：

一 使委派的区域信息保持最新。 通过定期更新它的一个子区域的存根区域，主持父区域和存根区域的 DNS 服务器将维护该子区域的权威 DNS 服务器的当前列表。 

二 改进名称解析。 存根区域使 DNS 服务器能够使用存根区域的名称服务器列表执行递归，而无需查询 Internet 或 DNS 名称空间的内部根服务器。

简化 DNS 管理。 在整个 DNS 结构中使用存根区域可为区域分发权威 DNS 服务器的列表，而不用使用辅助区域。但是，存根区域与辅助区域的用途不同，考虑冗余和负载共享时，存根区域不是备用区域。 

加载和维护存根区域涉及两个 DNS 服务器列表：

DNS 服务器从其加载和更新存根区域的主服务器列表。主服务器可以是区域的主要或辅助 DNS 服务器。在两种情况下，它将拥有区域的 DNS 服务器的完整列表。

区域的权威 DNS 服务器列表。该列表包含在使用名称服务器 (NS) 资源记录的存根区域中。

DNS 服务器加载存根区域（例如，widgets.example.com）时，它查询主服务器（它可位于不同的位置），寻找区域 widgets.example.com 的权威服务器的必要资源记录。主服务器列表可包含一个或多个服务器，可随时更改。

存根区域更新

存根区域更新涉及下列条件：

一 DNS 服务器加载存根区域时，它查询区域的主服务器寻找 SOA 资源记录、区域的根目录的 NS 资源记录和 A 资源记录。

二 存根区域更新期间，主持存根区域的 DNS 服务器查询主服务器，寻找存根区域加载期间请求的同一资源记录类型。

三 SOA 资源记录的刷新间隔确定主持存根区域的 DNS 服务器何时将尝试区域传输（更新）。 

如果更新失败，SOA 资源记录的重试间隔将确定何时重试更新。

一旦重试间隔到期而未成功更新，在 SOA 资源记录的“截止期限”字段中指定的到期时间将确定 DNS 服务器何时停止使用存根区域数据。 

存根区域更新操作：

重新加载。 从主持存根区域的 DNS 服务器的本地存储器重新加载存根区域。

从主服务器传送。 让主持存根区域的 DNS 服务器确定存根区域的 SOA 资源记录中的序列号是否已到期，然后从存根区域的主服务器执行区域传输。

从主服务器重新加载。 从存根区域的主服务器执行区域传输，不管存根区域的 SOA 资源记录中的序列号是多少。

区域委派

委派区域DNS 提供了将名称空间分割成一个或多个区域的选项，可以将这些区域存储、分配和复制到其他 DNS 服务器。决定是否分割 DNS 名称空间以获得附加的区域时，考虑如下使用附加区域的理由：

一 需要将 DNS 名称空间的部分管理工作委派给您单位中的另一位置或部门。

二 为了在多个服务器之间分配通信量负载，需要将一个大的区域分成若干小的区域，这提高了 DNS 名称解析性能或创建了一个容错性更好的 DNS 环境。

三 需要通过立刻添加许多子域来扩展名称空间，例如提供开放的新分支或站点。 

向新区域委派子域

创建子域 (example.lanlanxin.com) 的新区域时，需要有来自父区域(lanlanxin.com) 的委派。

新委派的 example.lanlanxin.com 子域的权威 DNS 服务器计算机根据包含在新区域 (ns1.na.example.lanlanxin.com) 中的派生子域来命名。要使新委派区域以外的其他服务器知道该服务器，在 lanlanxin.com 区域中需要两个 RR 来完成新区域的委派。这些 RR 包括：

一个使委派生效的 NS RR。这个 RR 用于公布名为ns1.na.example.lanlanxin.com 的服务器是被委派子域的权威服务器。一个 A RR （也被称作粘附记录）需要将 NS RR 中指定的服务器名称解析为它的 IP 地址。将该 RR 中的主机名解析为 NS RR 中委派的 DNS 服务器的过程有时也称作粘附跟踪。

Case Study: TestKing.com

Overview 

TestKing.com is a new Government-funded organization, established to consolidate medical research performed at universities in to a single electronic library. 

The Company has been allocated a large budget to start the project, and more funds will be made available as more universities integrate their research with TestKing.com. 

Physical Location 

The Company has one office located in Dallas. The Office currently has 100 users. 

Planned Changes 

A New Office in Seattle will be opened soon. The Seattle office will have 100 users when it opens. An additional 100 users will be hired in the Dallas office over the next year. The number of users is expected to grow by 60 percent over the next five years. 

An external Network will be established to allow universities to share medical research. At launch, the user population will be minimal. It is expected that the external network will have more that 10,000 active users in the next two years. 

Business Processes 

TestKing.com will reorganize its internal staff to include the following departments: 

• Accounting 
  
• Administration 
• Information Technology(IT)
• Knowledge Management  
• Marketing  
• Projects 
  

The Project department will work directly with universities to help them integrate data with 

TestKing.com. 

A separate project team will be dedicated to each university that partners with the Company. This project team is in charge of making external security available, creating user accounts, and establishing security for the university whose resources are made available through the Company's external network. 

The Company has a small internal IT staff that manages internal resources for internal users. The internal IT staff includes a network administrator and technical support team. 

The external network will have its own IT staff. This IT staff will include a network administrator, a technical support team, and a development team. External and internal resources will be managed independently. 

Internal users will require access to data located on both the internal network and the external network. External users and partners from universities will have access only to external resources. Under no circumstances will external users be given access to internal resources. This includes the external IT staff. 

Infrastructure 

Directory Services 

To provide a quick solution to allow for information sharing, an unplanned Windows 2000 network was established when the company was first established. 

A Windows 2000 Active Directory Environment was implemented with the domain name of research.com and the NetBIOS domain name of research. The domain name research.com has been registered by another organization and this name is not available to the company. The domain contains two domain controllers. A single file server exists on the network to store shared data for the internal users. 

Network Infrastructure 

The company has a 10-Mbps Internet connection. The use of the Internet connection is minimal at present, but is expected to grow once external resources are made available to universities. 

Problem Statements 

The Following business problem must be considered: 

• The Current internal network was not properly planned and need to be completely redesigned.  
• Information such as user accounts must be migrated from the current environment to a new Windows Server 2003 Active Directory Environment. 
• A clean separation must exist between external and internal resources. 

Chief Executive Officer 

Funding for TestKing.com has been finalized and it is time to move forward with the design and 

implementation of the internal and external network. A stable environment that has the ability to grow is of at most importance for the external network. 

Chief Information Officer 

The internal and external networks will have very different needs and audiences. For that reason, we have decided to have a separate IT staff to manage each network. Access to internal resources will be made available to internal users only. 

Planned VPN access will allow internal users access to internal data while traveling. A Microsoft 

Exchange server 2003 deployment will be implemented for internal users with a dedicated Exchange Server 2003 computer in each office. 

To avoid confusion, all internal users need to be able to gain access to both internal & external resources by using a single set of credentials. Internal users should not be prompted for alternate credentials when accessing external resources. 

During the migration, internal users must have access to resources in the existing domain. We do not want to manually redefine the security on existing resources. 

Network Administrator 

I will manage server deployment and configuration for all external resources. Technology decisions and implementation done for the internal network should not affect me. 

My technical support team will manage day-to-day server maintenance. The development team will deploy a knowledge management patrol to streamline information sharing with external partners. 

Project teams for the internal network will help in the management of security and will be given strict security areas in which they will be able to manage security for their specific university. The project teams will manage the data security and create user accounts for the university they are managing. 

Business Requirements 

Business Drivers 

The following business requirements must be considered: 

• TestKing.com has registered the domain name treyresearch.com. Internal and External naming needs to be intuitive and easy to manage. Internal and external naming will be managed independently. 
• No new domain names will be registered, and naming decisions must not cause conflicts with any Internet hosts. 
• The naming strategy for the external resources must be as short as possible to make it easy for external partners to access. 
• The company already has a small web site accessible at www.treyresearch.com 
  
• The company will require two domain controllers in each office. A single domain controller failure or WAN link failure between the Dallas and Seattle offices must not affect the operations of the Exchange Server 2003 environment. 

Organizational Goals 

The following Organizational requirements must be considered: 

• External users will only require access to a server named web1. Web1 will provide a web interface to the external users and retrieve resources from other external servers. External resources for universities will be provided by using HTTPS. 
• All external users who require access to resources will require a username and password to gain access to the external resources.  
• Web1 will also host the interface for the public web site. Anonymous access will be provided for the public web site. 
• Internal users will be granted VPN access by connecting to VPN1. 
  
• Domain based DFS servers will be implemented in the Dallas and Seattle offices. DFS replication must not occur during regular business operation. DFS replication must occur between the hours of 9:00 P.M. and 5:00 A.M Central Time. 
• Users in each office should automatically be redirected to the DFS server in their current physical location. In the event of a single DFS server failure, users should be automatically redirected to an available DFS server. 



Security 

The following security requirements must be considered: 

• To maintain the security of both the internal network and the external network, only traffic that is required by the company to meet its goal will be allowed to pass through the perimeter firewall. 
• All other traffic must be blocked. 
  

Technical Requirements 

Active Directory 

The following Active Directory requirements must be considered: 

• External and Internal resources must be managed independently. This includes high-level modifications to the directory service, such as the installation of Exchange Server 2003 or other directory aware applications. 
• During the first two years, many new users will be added to the network. To provide a consistent environment, the replication of internal domain user accounts must occur within a maximum time delay of one hour between the Dallas and Seattle offices. 

Network Infrastructure 

The following infrastructure requirements must be considered: 

The network infrastructure will be configured as shown in the planned network infrastructure exhibit. 

• The internal DNS structure must be secured to prevent unauthorized systems from registering their names with DNS. 
• To reduce the impact that name resolution of Internet based resources might have on WAN links, a solution must be identified that allows name resolution to occur without generating excessive and unnecessary traffic. A single domain controller in each office will be configured as a DNS server. 
• A single DHCP server will be present at each office. The DHCP server will configure local client computers to have the appropriate IP settings, including the address of a local DNS server. All users accessing the internal network must receive their IP configurations from one of these DHCP servers. 
• An external DNS server will be required to perform only name resolution for the namespace treyresearch.com. It will not be allowed to resolve any other name for external users, including names of other Internet based hosts. 

TestKing.com (14 Questions) 

QUESTION NO: 1 

You need to identify the features that will be available immediately after the domain migration to the new environment is complete. Which feature or features will be available? (Choose all that apply) 

A. Global group nesting. 

B. Universal group nesting. 

C. Domain local group nesting. 

D. Universal security groups. 

E. Sid history attributes. 

QUESTION NO: 2 

You are designing a NetBIOS naming strategy for the internal domain. What are two possible NetBIOS domain names you can use to achieve your goal? (Each correct answer presents a complete solution.) (Choose two) 

A. ad 

B. dallas 

C. internal 

D. external 

E. Research 

QUESTION NO: 3 

You are designing a strategy for performing the migration of the internal network. You need to identify the actions that you should perform to achieve this goal. What should you do? 

To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the appropriate order. (Use only actions that apply.) 

QUESTION NO: 4 

You are designing the site topology for the internal domain. Which action or actions should you perform? (Choose all that apply.) 

A. Create a Single Site. 

B. Create a site for each physical location. 

C. Set the replication interval on the default IP site link to 60 Minutes. 

D. Configure the schedule of the default IP site link to only allow replication between the hours of 9:00 P.M and 5:00 A.M 

E. Configure the schedule of the default IP site link to only allow replication between the hours of 3:00 A.M and 11:00 A.M 

QUESTION NO: 5 

You are designing the DNS name resolution strategy for the internal network. What should you do? 

A. Configure all internal DNS servers to use the default root hints. 

B. Disable recursion on the DNS server in Seattle. Configure the Seattle DNS to use Dallas DNS server as a forwarder. 

C. Create a root zone on the DNS server in Dallas. Configure the Seattle DNS server to use the Dallas DNS server as a forwarder. 

D. Create a root zone on the DNS server in both Dallas and Seattle. 

QUESTION NO: 6 

You are designing a strategy to allow users to gain VPN access to the internal network. What should you do? 

A. Allow all inbound VPN traffic to pass through the internal firewall and the perimeter firewall. 

B. Allow all inbound VPN traffic to pass through the perimeter firewall only. 

C. Allow all VPN traffic from the source IP address of 131.107.1.14 to pass through the internal firewall. 

D. Allow all VPN traffic from the source IP address of 191.168.1.0/24 to pass through the perimeter firewall. 

QUESTION NO: 7 

You are designing a strategy to allow internal users in Dallas to resolve domain names. What are three possible ways to achieve the goal? (Each correct answer presents a complete solution. Choose three) 

A. Configure the internal DNS server to have a root zone. 

B. Configure the Dallas DNS server to use the default root hints. 

C. Configure the Dallas DNS server to forward all request for the external namespace to the external DNS server. 

D. Create a caching-only DNS server on the perimeter network. 

E. Create a stub zone for the external namespace on the Dallas DNS server. 

QUESTION NO: 8 

You are designing the IP address assignment strategy for the VPN users. Which two actions should you perform.(Each correct answer presents part of the solution. (Choose two) 

A. Configure VPN1 as a DHCP Relay Agent. 

B. Configure VPN1 to assign IP Address by using DHCP server. 

C. Configure VPN1 to have a static pool of IP Address from the network address of 131.107.1.0/24. 

D. Configure VPN1 to have a static pool of IP Address from the network address of 192.168.1.0/24. 

E. Configure the perimeter firewall to allow inbound DHCP traffic to be passed to VPN1. 

F. Configure the interval firewall to allow DHCP broadcasts to be forwarded from the external network to the internal network. 

QUESTION NO: 9 

You are designing the configuration of the external DNS server to meet the business and technical requirements. What should you do? 

A. Configure a root zone on the external DNS server. 

B. Configure a stub zone for.com on the external dns server. 

C. Configure the external DNS server to use the default root hints. 

D. Configure the External DNS server to use the ISP'S DNS server as a forwarder. 

QUESTION NO: 10 

You need to identify the types of inbound traffic that should pass through the perimeter firewall while maintaining the security of the network. Which inbound traffic should be allowed? (Choose all that apply?) 

A. VPN Traffic 

B. DNS Traffic 

C. LDAP Traffic 

D. HTTP Traffic 

E. HTTPS Traffic 

F. Traffic from the network address of 192.168.10/24 

QUESTION NO: 11 

You are designing a strategy to ensure that VPN users are able to access all internal resources. What should you do? 

A. Specify a static routing table entry on VPN1 for the Dallas network. 

B. Specify a static routing table entry on VPN1 for the Seattle network. 

C. Implement Internet Authentication Service (IAS) on VPN1. 

D. Define a User Class option for Routing & Remote Access Clients on the DHCP Server. 

QUESTION NO: 12 

You are designing a strategy to migrate user accounts. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) 

A. Change the functional level. 

B. Create an external trust relationship. 

C. Run adprep to prepare the research.com forest. 

D. Run adprep to prepare the research.com domain. 

QUESTION NO: 13 

You are designing a naming strategy for the new internal and external domains. You need to identify the appropriate domain name for each domain. What should you do? 

To answer, drag the appropriate domain name or names to the correct location or locations in the work area. 

QUESTION NO: 14 

You are designing the top-level OU structure for the external domain. On which factor/s should you base the top-level OU structure? 

A. Physical locations 

B. External partners and universities 

C. The company’s internal departments 

D. The company’s software deployment needs 

Case Study: Litware, Inc

Overview 

Litware, Inc., is a corporate management company that manages the internal operations for its business customers. 

Internal operations include sales, accounting, and payroll. 

Physical Locations 

Litware, Inc., has two main offices in the following locations: 

• New York 
  
• Chicago 
  

Each office has approximately 300 users. 

The New York office has a branch office in Boston. The Boston office has approximately 100 users. 

Staff in the Boston exclusively office work on projects for customers in the New York office. The Boston office has no customers of its own. 

Planned Changes 

As part of its initiative to streamline the IT environment and increase network security, the company has decided to implement a Windows Server 2003 Active Directory environment. 

The New York office is currently in negotiations to secure Contoso, Ltd., as a new customer. 

Business Processes 

Litware, Inc., manages the business operations for eight business customers. For each customer, Litware, Inc. has a dedicated staff that works exclusively with that customer. 

Users require access only to project data for the customers to which they have been directly assigned. The New York and Chicago offices are responsible for their own customers and maintain them separately.Each individual customer project is listed in the following table. 

The chief information officer is the only person who is authorized to implement any changes that will impact the entire company. Roles and responsibilities in the IT department are shown in the following table. 

Directory Services 

Currently, Litware, Inc., has two Windows NT 4.0 domains configured a shown in the Existing Domain Model exhibit. 

The New York domain contains user and computer accounts for both the New York and Boston offices. The Chicago domain contains user and computer accounts for the Chicago office. 

Litware, Inc., users require access only to project data for the customers to which they have been directly assigned. They also require access to internal company resources, such as a time-building application that is hosted in the New York office. 

Accounting auditors and executives require access to data from all customer projects to perform 

quarterly reports, account reviews, and billing verifications. Account auditors and executives are located in both New York and Chicago offices, and frequently travel between offices. 

Network Infrastructure 

The existing network infrastructure is shown in the Existing Network Infrastructure exhibit. 

All Internet access is provided through a proxy server located in the New York office. The proxy server provides Internet name resolution on behalf of the client computers. 

Currently, all servers run Windows NT Server 4.0 with the latest service pack installed. A time-billing application is installed on a Microsoft SQL Server computer named SQL1. SQL1 is managed by the network administrators in the New York office, and is accessed by all Litware, Inc., users. 

The company’s servers, including their domain membership, physical locations, and network functions, are shown in the following table. 

Most required network resources are available locally. 

All client computers in the company run Windows 2000 Professional. 

Problem Statements 

The following business problems must be considered: 

• Contoso, Ltd., requires that the new Active Directory infrastructure is completely in place prior to obtaining the contract. 
• Administrative authority for network administrators in the New York and Chicago offices must remain equal. 

Chief Executive Officer 

The addition of Contoso, Ltd., as a customer will likely increase annual revenue by 50 percent. 

Additional funds and resources have been allocated to secure this contract. All efforts should be made to demonstrate to the Contoso, Ltd., representatives that we will address all of their security concerns. This will be done on part though a migration to the Windows Server 2003 Active Directory environment. 

Any short-term costs associated with a technology deployment are acceptable if they allow for growth and flexibility in the future. 

Chief Information Officer 

A Web-based interface for the time-billing application will be implemented in the near future. The current network administrators in the New York and Chicago offices perform their jobs well. 

To reduce the burden on IT staff, trusted individuals within the organization should be identified to help reduce the IT administrative burden. 

Office Worker 

We want to be able to access the internal network from our home computers. 

Business Drivers 

The following business requirements must be considered: 

• The company wants access to the network to remain easy and intuitive. A company policy now states that user logon names and e-mail addresses should be identical. Currently, each user has an e-mail address made up of that user’s first initial and last name, and an additional domain name indicating the region that manages that user’s account. For example, the user Nicole Caron from the New York office has the e-mail address of ncaron@ny.litwareinc.com. The user Luis Bonifaz from Chicago has the e-mail address of lbonifaz@chi.litwareinc.com. 
• The domain name litwareinc.com has been registered. 
  
• To ensure reliability in the event of a single WAN link failure, users should continue to authenticate on the network. Additionally, all domains should be fault tolerant in the event of a single domain controller failure. 
• VPN access will be provided to enable user access to customer data outside of regular business hours. VPN connections will be assigned through the New York office. 

Organizational Goals 

The following organizational requirements must be considered: 

• As part of the negotiations between Contoso, Ltd., and the New York office, Litware, Inc., has agreed to ensure that all users who require access to Contoso, Ltd., data must have complex passwords that are a minimum of 10 characters in length. 
• The company has also agreed that management of Contoso, Ltd., data must be completely isolated from all other Litware, Inc., data. This included the ability to manage security of Contoso, Ltd., resources. There will be no exceptions. 
• Planning for other aspects of how Contoso, Ltd., will integrate with the Litware, Inc., environment is premature at this point. However, a quick migration solution for the existing environment must be identified to allow for this anticipated growth. 
• Litware, Inc., account auditors and executives from the New York and Chicago offices will require limited access to Contoso, Ltd., data. 

Security 

The following security requirements must be considered: 

• A new Web-based interface will be implemented for the time-billing application running on SQL1. This application will use IIS, and will require the use of IP filtering that uses computer host names for security purposes. 
  
• Only authorized computers within the internal Litware, Inc., network will be given access to the time-billing application. 

Active Directory 

The following Active Directory requirements must be considered: 

• The network administrators in the Chicago and New York offices will retain their current responsibilities, such as the management of user accounts, servers, and domain controllers for their regions. There should be no overlap between their administrative authority. 
• There is a need to allow trusted individuals responsible for each customer project to manage user account information. Responsibilities will include the ability to reset passwords and define personal user information on user accounts, such as phone numbers and addresses. The trusted individuals will be allowed to manage only user accounts within the customer project to which they have been assigned. 

Network Infrastructure 

The following infrastructure requirements must be considered: 

• Users in the Chicago office access Internet-based resources frequently. This Internet-related traffic accounts for most of the bandwidth used between the Chicago and New York offices. Bandwidth utilization between these two offices is currently a cause for concern. Network traffic between the Chicago and New York offices must be minimized whenever possible. 
• Because of the Boston office’s data access requirements, a high level of availability and reduced latency between the New York and Boston offices is required. Bandwidth utilization between the Boston and New York offices is minimal and is not a concern in the foreseeable future. 
• A Windows Server 2003 computer will provide VPN access to the network by using both L2TP and PPTP. Usage statistics will be gathered over time to identify which users establish VPN connections to the network, and the duration of their connections. These usage statistics will help the company track trends and plan for future growth. 
• The network administrator in Chicago has extensive knowledge of DNS, and will manage the implementation of the DNS infrastructure for the Litware. Inc., network. 
• The DNS structure must be secured against any unauthorized modifications, but also must be easy to maintain and manage. 

 Litware, Inc. (9 Questions) 

QUESTION NO: 1 

You are designing a forest and domain structure to address the concerns of Contoso, Ltd., and to meet the business and technical requirements. You want to use the minimum number of domains and forests that are required. 

Which domain structure should you use? 

A. One forest and two domains. 

B. One forest and three domains. 

C. One forest and four domains. 

D. Two forests and three domains. 

E. Two forests and four domains. 

QUESTION NO: 2 

You are designing the top-level organization unit (OU) structure to meet the administrative 

requirements. What should you do? 

A. Create a top-level OU named New York. Place all user and computer accounts from New York in the New York OU. 

B. Create a top-level OU named Chicago. Place all user and computer accounts from Chicago in the Chicago OU. 

C. Create a top-level OU named Coho. Place all user and computer accounts that are assigned to the Coho Vineyard customer project in the Coho OU. 

D. Create a top-level OU named Sales. Place all user and computer accounts from the sales department in the Sales OU. 

QUESTION NO: 3 

You are designing a security group strategy to meet the business and technical requirements. 

What should you do? 

A. Create one global group named G_Executives. 

Make all executives user accounts members of that group. 

B. Create two global groups named G_Executives and one universal group named U_Executives.

Make the two global members of U_Executives. 

Make the executive user accounts members of the appropriate global group. 

C. Create three global groups named G_NY_Executives and G_Chi_Executives and G_Executives. 

Make G_NY_Executives and G_Chi_Executives members of G_Executives. 

Make the executive user accounts members of the appropriate global group. 

D. Create one domain local group named DL_Executives. 

Make all executive user accounts members of that group. 

QUESTION NO: 4 

You are designing an Active Directory implementation strategy to present to executives from your company and from Contoso, Ltd. 

Which implementation strategy should you use? 

A. Upgrade the New York domain. 

Upgrade the Chicago domain. 

Create a pristine forest for Contoso, Ltd. 

B. Create a pristine forest. 

Upgrade the New York domain. 

Upgrade the Chicago domain. 

Do nothing further. 

C. Create pristine forest. 

Upgrade the New York domain. 

Upgrade the Chicago domain. 

Create a pristine forest for Contoso, Ltd. 

D. Create a pristine forest. 

Upgrade the New York domain. 

Upgrade the Chicago domain. 

QUESTION NO: 5 

You are designing the DNS infrastructure to meet the business and technical requirements. 

What should you do? 

A. Create an Active Directory-integrated zone on DC4. 

Set the replication scope to all DNS servers in the domain. 

B. Create an Active Directory-integrated zone on DC5. 

Set the replications scope to all DNS servers in the forest. 

C. Create an Active Directory-integrated zone on any domain controller in the forest root domain. 

Set the replication scope to all domain controllers in the domain. 

D. Create a standard primary zone on DC4 

E. Create a standard primary zone on any domain controller in the forest root domain. 

QUESTION NO: 6 

You are designing a DNS implementation strategy for the network. 

Which two zone types should you use? (Each correct answer presents part of the solution. Choose two) 

A. Reverse lookup zones 

B. Standard primary zones 

C. Standard secondary zones 

D. Active Directory-integrated zones 

QUESTION NO: 7 

You are designing a strategy to upgrade the DHCP servers after the new Active Directory structure is in place. 

Who can authorize the DHCP servers? (Choose all that apply) 

A. Chief information officer 

B. IT support staff in Boston 

C. IT support staff in New York 

D. Network administrator in Chicago 

E. Network administrator in New York 

QUESTION NO: 8 

You are designing the placement of the global catalog servers. You want to use the minimum number of global catalog servers that are required. 

A. One global catalog server in New York. 

B. Two global catalog servers in New York. 

C. One global catalog server in Chicago and one global catalog server in New York. 

D. Two global catalog servers in Chicago and two global catalog servers in New York. 

E. One global catalog server in Chicago, one global catalog server in New York, and one global catalog server in Boston. 

QUESTION NO: 9 

You are designing an IP addressing strategy for your VPN solution. 

How many public addresses should you use? 

A. 1 

B. 25 

C. 50 

D. 255