IS-30A Chapter 4 Study Guide

Name:

True/False

Indicate whether the sentence or statement is true or false.

Any group that will ultimately be assigned permissions or rights must be a security group.

A group’s scope refers to the types of domain controllers present in the environment.

A domain local group can be assigned rights and permissions to any resource within the same domain only.

If an administrator needs to create or manage the properties of multiple groups simultaneously, the command-line utilities DSADD, DSMOD, etc. are not suitable for this purpose.

The functional level of a domain can be raised in Active Directory Users and Computers by right-clicking the domain and clicking Raise Domain Functional Level.

If a global group is a member of another global group, you cannot change its scope to universal.

The DSMOD GROUP command is used primarily to create new group accounts.

The DSQUERY command returns a list of distinguished names.

The DSMOVE command allows you to move objects between domains.

10.

The first steps in a general strategy for implementing groups in an environment is to create user accounts and organize them into domain local groups.

Modified True/False

Indicate whether the sentence or statement is true or false. If false, change the identified word or phrase to make the sentence or statement true.

11.

Domain local groups can only contain users, computers, and other groups that exist within the same domain. _________________________

12.

The default domain functional level when a Windows Server 2003 Active Directory is installed is Windows 2000 native. _________________________

13.

Groups created on Windows Server 2003 member servers are called local groups. _________________________

14.

Group accounts can be created in built-in or custom containers. _________________________

15.

When the Advanced Features view is enabled with Active Directory Users and Computers, two additional tabs become visible in the properties of a group account, the Object and Permissions tabs. _________________________

16.

There are no restrictions on changing a universal group to a(n) domain local group. _________________________

17.

The DSMOD GROUP command requires that you specify the UPN name of the object to be modified. _________________________

18.

The DSMOD command-line utility supports the use of the wildcard character (*). _________________________

19.

To rename an existing group account, you could use the DSMOVE account with the -newparent switch. _________________________

20.

Often users are grouped in global groups based on departments in an organization. _________________________

Multiple Choice

Identify the letter of the choice that best completes the statement or answers the question.

21.

A(n) _____ is a group defined by a Security Identifier.

a.	organizational unit	c.	global group
b.	security group	d.	distribution group

22.

Groups are similar to _____ in that both organize other objects into logical containers.

a.	user accounts	c.	functional levels
b.	computer accounts	d.	organizational units

23.

Unlike security groups, distribution groups do not have a(n) _____ associated with them.

a.	SID	c.	domain functional level
b.	global group	d.	schema

24.

The _____ of an environment is determined by the operating systems of the domain controllers in the environment.

a.	discretionary access control list	c.	domain functional level
b.	group membership	d.	distribution group

25.

There are _____ possible group scopes.

a.	2	c.	4
b.	3	d.	5

26.

When a domain is configured to the Windows 2000 mixed domain functional level, which of the following is true for global groups?

a.	they can be added to domain local groups in any domain
b.	they can be added to universal groups in the forest
c.	they can contain global groups from any domain
d.	they can contain domain local groups from the same domain

27.

Which of the following refers to a type of group that is typically created for the purpose of aggregating users or groups in different domains throughout an Active Directory forest?

a.	distribution group	c.	domain local group
b.	universal group	d.	security group

28.

Which of the following is the primary graphical tool used for creating and managing group accounts?

a.	DSADD	c.	Group Wizard
b.	Discretionary Access Control Lists	d.	Active Directory Users and Computers

29.

To create a group using Active Directory Users and Computers, you should right-click the particular container or OU, select _____, and then click Group.

a.	General	c.	New
b.	Create	d.	Members

30.

Under which of the following tabs in a properties dialog box for a group account in Active Directory Users and Computers could you add or remove this group from other groups?

a.	General	c.	Members
b.	Managed By	d.	Member Of

31.

You can change the type of a group from the _____ tab of the properties of the group account in Active Directory Users and Computers.

a.	General	c.	Member Of
b.	Members	d.	Managed By

32.

In order to change the scope of a group, the domain functional level must be at least at the _____ level.

a.	Windows 2000 mixed	c.	Windows Server 2003
b.	Windows 2000 native	d.	Windows NT 4.0

33.

It is possible to change the scope of Group A to universal unless Group A has a(n) _____ scope and it has a domain local group as a member.

a.	local	c.	domain local
b.	global	d.	universal

34.

Changing the scope of a group account can be done from the _____ tab of the properties of the account in Active Directory Users and Computers.

a.	General	c.	Member Of
b.	Members	d.	Managed By

35.

Which of the following command-line utilities can be used to create a new group account?

a.	DSQUERY	c.	DSADD
b.	DSRM	d.	DSMOVE

36.

What is the required argument for the DSADD GROUP command-line utility?

a.	scope	c.	members
b.	distinguished name	d.	member of

37.

Which of the following is a switch that would commonly be used with the DSADD command-line utility?

a.	-noprompt	c.	-newparent
b.	-newname	d.	-members

38.

The command

dsadd group “cn=XXX” -scope g

would create a group account with a(n) _____ scope.

a.	local	c.	domain local
b.	global	d.	universal

39.

One way to get a list of options and switches available for the DSADD GROUP command would be to type _____ at the command line.

a.	DSADD ? GROUP	c.	DSADD GROUP HELP
b.	HELP DSADD GROUP	d.	DSADD GROUP /?

40.

The DSMOD GROUP command requires that you specify values for at least _____ switch(es).

a.	0	c.	2
b.	1	d.	3

41.

To remove a member from a group account using the DSMOD GROUP command, you specify the member to remove with the _____ switch.

a.	-memberof	c.	-rmmbr
b.	-desc	d.	-members

42.

The term _____ refers to directing the output of one command to the input of a second command.

a.	piping	c.	reflecting
b.	moving	d.	querying

43.

If you wish to move an existing group account into a new container, you could use the DSMOVE command with the _____ switch.

a.	-newname	c.	-rmmbr
b.	-member	d.	-newparent

44.

Which of the following is a utility that allows you to move objects between domains?

a.	DSMOVE	c.	DSGET
b.	DSRM	d.	MOVETREE

45.

Which of the following command-line utilities can be used to delete group accounts?

a.	DSMOVE	c.	DSGET
b.	DSRM	d.	DSMOD

46.

Which of the following is the last step in the A G U DL P strategy?

a.	create user accounts
b.	create universal groups
c.	assign permissions to domain local groups
d.	add global groups to domain local groups

47.

The easiest method of determining the groups that a user belongs to is via the _____ tab in the properties of their user account.

a.	General	c.	Member Of
b.	Advanced	d.	Profile

48.

The _____ command-line utility provides a method of determining a user’s group membership.

a.	DSGET	c.	DSRM
b.	DSQUERY	d.	DSMOD

49.

Which of the following switches would return information about all of the members of a group when used with the DSGET GROUP command-line utility?

a.	-members	c.	-desc
b.	-memberof	d.	-rmmbr

50.

Which of the following features do built-in local security groups have?

a.	universal scope	c.	administrative scope
b.	customized organizational units	d.	pre-assigned rights

51.

Which of the following built-in containers holds built-in groups that are created automatically when Active Directory is installed?

a.	Users	c.	Admins
b.	Groups	d.	Guests

52.

The Builtin Container holds a number of _____ group accounts that are allocated specific user rights.

a.	global	c.	domain local
b.	local	d.	universal

53.

The Users container contains a number of different domain local and _____ group accounts.

a.	global	c.	local
b.	universal	d.	security

54.

Which of the following built-in groups in the Users container is able to administer DNS server settings and configuration?

a.	Schema Admins	c.	DnsUpdateProxy
b.	DnsAdmins	d.	Domain Users

55.

What tool could you use to change the settings of an existing computer account?

a.	DSRM COMPUTER	c.	DSGET COMPUTER
b.	DSADD COMPUTER	d.	DSMOD COMPUTER

Yes/No

Indicate whether you agree with the sentence or statement.

56.

Can security groups be used as e-mail entities?

57.

Does the Windows 2000 native domain functional level support domain controllers running Windows NT 4.0, Windows 2000 Server, and Windows Server 2003?

58.

Are universal groups supported at the Windows 2000 mixed domain functional level?

59.

Must a universal group be stored on a domain controller configured as a global catalog server?

60.

Can the members of a group be changed from the General tab in the properties dialog box for a group account?

61.

When creating new Active Directory groups, is it important to select the appropriate group type based on how the group will be used?

62.

Can the DSMOD GROUP command be used to add a user to a particular group?

63.

Can you view the complete list of switches and options available for the DSQUERY command in the Windows Server 2003 Help and Support Center?

64.

Does the P in the acronym A G U DL P stand for Permissions?

65.

In the A G U DL P strategy, should you create global and universal groups first and then create domain local groups and add the global and universal groups to them?