Final Flashcards
(138 cards)
T/F An organizational unit is a logical subgroup within Active Directory that you can
employ to locate resources used by a single workgroup, section, or department in a
company and apply policies that apply to only these resources.
True—An easily managed OU structure reflects some aspects of your company’s
internal organization.
T/F The main purpose of a security group is to create a distribution list for email
purposes. These groups have security information, such as unique security identifiers
(SIDs).
False—A distribution group is used to create a distribution list. These groups do
not possess SIDs and cannot be assigned permission to resources
T/F When you assign a single user or group full control of the entire domain, of a single
OU, or limited rights to a set of OUs, the permissions are not inheritable.
False—When you delegate control, the default behavior of AD DS is to make
such permissions inheritable.
T/F Account operators, server operators, print operators, and backup operators are built-in
security groups that enable members to perform limited administrative capabilities
within the domain in which they are located.
True—AD DS provides several built-in security groups. You can add members to
these groups when their defined rights match the administrative capabilities you
want to confer to these users.
T/F Some machine-local groups are similar in usage and membership to domain local
groups. These types of local groups do not exist in AD DS and grant users access to
resources on the local computer only.
True–For access to resources located on more than one computer in the domain,
always use domain local groups.
T/F To create an OU, you must be a member of the Account Operators group.
False–To create an OU, you must be a member of the Account Operators,
Domain Admins, or Enterprise Admins groups by default.
T/F There is a GUI version of the Active Directory Recycle Bin feature. By default, the
Recycle Bin is disabled, but you can enable it from within AD Administrative Center.
After the recycle bin is enabled, you cannot disable it.
True– When enabled, you have the ability to restore recently deleted items from
Active Directory.
T/F You have the capability to assign a single user or group full control of the entire
domain, of a single OU, or limited rights to a set of OUs.
True–When you delegate control, keep in mind that the default behavior of AD
DS is to make such permissions inheritable.
T/F If you run the Delegation of Control Wizard multiple times, permissions granted for
the OU are replaced each time with the new permissions.
False—Permissions are cumulative rather than having the wizard replace prior
permissions each time you run it.
T/F In Active Directory Users and Computers to view the effective OU permissions
granted to a user or group, the Effective Permissions tab shows all granted
permissions, including inherited permissions.
True–This includes all permissions inherited through membership in other
Groups.
Which of the following is not one of the three types of user accounts present in an AD
DS network?
Enterprise user accounts
User accounts embody specific information pertinent to a user, such
as username, password, and specific logon limitations. User accounts can be
either built-in accounts or self-generated. Each user account has a comprehensive
set of configurable properties associated with it. Among these are group
memberships, logon scripts, logon hours, account expiration, user profile, and
dial-in permission.
Which Windows Server 2012 R2 group scope can be used to include users, computers,
and groups from any domain in the forest but cannot be employed to grant permissions to
any resource in the forest?
Domain local
Domain local groups can include users, computers, and groups from
any domain in the forest. They are most often utilized to grant permissions for
resources and can be used to provide access to any resource in the domain in
which they are located. It is thus logical for a domain local group to include
global groups that contain all users with a common need for a given resource.
You can organize your domain into logical subgroups called ________that enable you
to collect users, computers, and other resources for simplified local administration
according to your company’s organizational chart of departments, sections, work units,
and so on.
Organizational units
You can change this grouping of OUs easily if your company
reorganizes; such a task is much easier than attempting to re-create child domains
according to a new corporate structure.
A(n) _______ is used to collect a set of users who need to share a particular set of
permissions to a resource, such as a file, folder, or printer.
Group
. The available membership depends on the group scope.
A recommended group nesting strategy is ________________.
None of the above
Microsoft continues to recommend the same strategy for nesting
groups that it has supported since Windows NT 4.0. Place accounts (A) into
global groups (G). Add the global groups to domain local groups (DL). Assign
permissions (P) to the domain local groups. In short, this strategy is known as
AGDLP (Accounts to Global groups to Domain Local groups to Permissions).
Which of these is a built-in security group designed to enable members to perform
limited administrative tasks within the domain in which they are located?
Backup operators
AD DS provides several built-in security groups that enable members
to perform limited administrative capabilities within the domain in which they are
located. These include account operators, server operators, print operators, and
backup operators. You can add members to these groups when their defined rights
match the administrative capabilities you want to confer to these users.
A ________ group can include users and groups from any domain in the AD DS forest
and can be employed to grant permissions to any resource in the forest.
universal.
A universal group can include users, computers, and global groups
from any domain in the forest.
The Window Server 2012 R2 security group that is granted full rights to manage the
entire domain is the ________ group.
Domain Admins.
This group is automatically made a member of each member
server’s, member computer’s, and domain controller’s Administrators local groups
The Windows Server 2012 R2 security group that has full rights to manage the domain
controllers but not the entire domain is the ________group.
Administrators
This group is in the Built-in container
The group scope that can include users, computers, and other global groups from the
same domain is ________.
universal.
You can use universal groups to organize users who have similar
functions and therefore similar requirements on the network.
Windows Server 2012 R2 includes the ________ feature, which provides guaranteed
message delivery, efficient routing, security, and priority-based messaging between
applications, including those that run on different operating systems.
Message Queuing.
You can install Message Queuing from the Add Roles and
Features Wizard in Server Manager.
In determining a nesting strategy in a ________-domain forest, you do not need to use
universal groups.
single.
Use the AGDLP strategy only with a single-domain forest.
The command-line command to add an OU to your domain would begin with
________.
dsadd.
In addition to the traditional tools, Windows Server 2012 R2 enables
you to perform this task from the Active Directory Administrative Center.
The __________ Wizard enables you to delegate administrative tasks.
Delegation of Control.
You access the wizard either through Active Directory
Users and Computers or Active Directory Administrative Center.