mcts training kit 70 - 680 Configuring Microsoft windows 7 client phần 10 docx

Chapter 3: Lesson Review Answers Answers 793
2. Correct Answer: D
a. Incorrect: When you boot a reference client computer from a WDS capture image, the
Windows Deployment Services Image Capture Wizard enables you to capture a system
image from that computer and export it to the WDS server. It does not directly specify
the source directory in which the WIM file resides, specify whether setup or Sysprep files
are required, or move the file to the distribution share.
B. Incorrect: The SCCM 2007 Task Sequence Editor creates and modifies task sequences.
In the New Task Sequence Wizard, you can select Install An Existing Image, Build A
Reference Operating System Image, or Create A New Custom Task Sequence. However
the wizard creates task sequences. It does not directly specify the source directory in
which the WIM file resides, specify whether setup or Sysprep files are required, or move
the file to the distribution share.
c. Incorrect: You access the Create Distribution Share Wizard from the MDT 2010 Deployment
Workbench console. This wizard lets you create a distribution share that will hold the
WIM file, but it does not specify the source directory in which the WIM file resides, specify
whether setup or Sysprep files are required, or move the file to the distribution share.
D. Correct: You access the New OS Wizard from the MDT 2010 Deployment Workbench
console. This wizard lets you specify the source directory in which the WIM file resides,
specify whether setup or Sysprep files are required, and then move the file to the
distribution share.
3. Correct Answer: C
a. Incorrect: WDS deploys install images across the network. You do not need to install
them on removable bootable media.
B. Incorrect: When you boot a target computer from the network, WDS presents you with
a boot menu on the target machine that enables you to boot from a boot image. This
is delivered over the network and you do not need to install this image from bootable
removable media. Note that the choice specifies a standard boot image. Discover and
capture images are special types of boot image.
c. Correct: If your target computers are not PXE-compliant, they cannot boot from the
network. Therefore, you need to boot them from a discover image on removable,

bootable media.
D. Incorrect: If you want to capture the image of a reference computer, you boot it from
a capture image. Capture images appear on the boot menu in the same way as standard
boot images and you do not need to install them on bootable removable media.
4. Correct Answers: A, E, and F
a. Correct: The WDS server role needs to be installed on a server in an AD DS domain.
B. Incorrect: WDS can work with MDT 2010 to implement LTI, but it does not require MDT
2010 to deploy images.
c. Incorrect: SQL Server is required with SCCM 2007 and MDT 2010 to implement ZTI.
However, SQL Server is not a WDS requirement.
7 9 4 Answers
D. Incorrect: SCCM 2007 is required with SQL Server and MDT 2010 to implement ZTI.
However, SCCM 2007 is not a WDS requirement.
e. Correct: WDS typically deploys to PXE-compliant target client computers that rely on
DHCP for their IP configuration.
F. Correct: The WDS server role needs to be installed on a server in a network that contains
at least one DNS server.
5. Correct Answer: A
a. Correct: To make the image bootable, you use BCDboot from Windows PE to initialize
the BCD store and copy boot environment files to the system partition. On restart, the
target computer boots into Windows 7 Ultimate.
B. Incorrect: DISM enables you to manage and manipulate a WIM image. It does not make
an image bootable when you have installed it on a target computer.
c. Incorrect: You use BCDEdit to make media such as VHD and USB flash memory bootable.
However, it does not make an image bootable when you have installed it on a target
computer.
D. Incorrect: You used ImageX to create the WIM image on the source computer and
install it on the target computer. However, ImageX cannot make the installed image
bootable.
Chapter 3: Case Scenario Answers

Case Scenario 1: Deploying an Image with More Than
One Language Pack
1. Don requires the following:
n
A technician computer with the Windows AIK tools installed and enough available space
on the hard disk drive to both hold the master image and mount this image.
n
The Windows image (.wim file) that he wants to service.
n
The drivers (.inf files), update packages (.cab or .msu files), and the language packs (.cab
files) that he will use to service the image.
2. Don’s first task is to copy an instance of the master image to the technician computer.
Microsoft does not recommend mounting an image from a network share.
3. Don uses DISM to mount the image. He then uses DISM commands to apply the update,
add the new driver, and change the relevant settings. He checks that both language packs
are installed on the image and the correct international settings can be configured. If it
is likely that he will service the image regularly, he should create a script using the DISM
command-line options. Don uses DISM to verify that the appropriate driver and other
packages were added (or removed, if necessary) from the image. Finally, he commits and
dismounts the image.
Chapter 4: Lesson Review Answers Answers 795
Case Scenario 2: Deploying an Image
to 100 Client Computers
1. You need to ensure that all critical and recommended updates, particularly security updates,
have been installed. Also, if any new hardware devices are to be used with the new computers
that are not Plug and Play, you need to install the device drivers on the reference computer.
You need to test the installation thoroughly. Finally, you need to use the Sysprep tool to
generalize the computer configuration prior to the image capture.
2. You need to create a capture image on the WDS server.
3. You restart the reference computer and press F12 to boot from the network. On the boot

menu, select the capture image and follow the procedure to create the computer’s system
image. You transfer the resulting WIM file to the WDS server. You boot each target computer
from the network (if necessary, configuring the BIOS boot order to do so). You choose the
standard boot image (not the capture image) from the boot menu and select the install image
you created from the reference computer. The image is installed, and Setup continues normally.
Chapter 4: Lesson Review Answers
Lesson 1
1. Correct Answers: A and C
a. Correct: The device must be signed with a valid digital certificate that is recognized by
Windows 7 and is in the Trusted Publishers store. Otherwise, administrator privileges are
required to install the device.
B. Incorrect: Digital certificates are stored in the Trusted Publisher store, not device drivers.
c. Correct: The device driver must be stored in the device driver store. Otherwise,
administrator privileges are required to copy the driver to that store.
D. Incorrect: The device does not need to connect through a USB port. It could, for
example, be a PS/2 keyboard.
e. Incorrect: Although Microsoft signs many drivers, a Microsoft signature is not essential.
The digital certificate needs to be from a trusted CA. For example, in the domain
environment, it could be a self-signed certificate.
2. Correct Answer: B
a. Incorrect: You use this procedure to determine the power requirements of each device,
not the bandwidth requirements.
B. Correct: This procedure enables you to view the bandwidth requirements of each device
in the Bandwidth-Consuming Devices list on the Advanced tab.
c. Incorrect: The Details tab can give you a great deal of information (for example, the
device-type GUID) but does not indicate bandwidth requirements. Also, the devices listed
are not necessarily those on the USB hub.
D. Incorrect: IEEE 1394 bus host controllers are not USB devices. Also, the Resources tab
does not show bandwidth requirements.
7 9 6 Answers

3. Correct Answers: A and D
a. Correct: This permits non-administrators to install any device in the device setup class,
provided that the device driver is in the driver store.
B. Incorrect: This instructs Windows 7 to search for a device driver in any folder and
subfolder on the C: drive. However, administrator privileges are required to copy the
driver to the driver store and install it.
c. Incorrect: The Trusted Publisher store holds digital certificates that authenticate driver
signatures. It does not hold device drivers.
D. Correct: When a driver is staged, it is placed in the device driver store and
non-administrators can install the device, provided they have permission to install devices
in the appropriate device setup class.
4. Correct Answer: B
a. Incorrect: This prevents automatic installation of drivers downloaded from Windows
Update but does not remove the Web site from the search path.
B. Correct: This prevents Windows 7 from searching for device drivers in Windows
Update.
c. Incorrect: The DevicePath registry entry does not list the Windows Update Web site
specifically.
D. Incorrect: This installs drivers from Windows Update if Windows 7 judges they are the
best drivers based on inbuilt criteria. It does not prevent Windows 7 from searching for
device drivers in Windows Update.
5. Correct Answer: A
a. Correct: This stops the device driver and immediately disables the device.
B. Incorrect: This ensures the device is disabled the next time the computer restarts. You
would likely do this if you discovered the device was giving problems. However, it does
not stop the device immediately to allow you to investigate.
c. Incorrect: The Disable control is available for PnP devices but not for devices listed under
Non-Plug And Play Drivers. You should use the Stop control instead.
D. Incorrect: The Uninstall control is available for PnP devices but not for devices listed
under Non-Plug And Play Drivers. In any case, you want to stop the driver, not

uninstall it.
Lesson 2
1. Correct Answer: A
a. Correct: This Diskpart command converts the selected disk to a GPT disk.
B. Incorrect: This Diskpart command converts the selected disk to an MBR disk.
c. Incorrect: This Diskpart command converts a selected dynamic disk to a static disk.
D. Incorrect: This Diskpart command converts a selected static disk to a dynamic disk.
Chapter 4: Lesson Review Answers Answers 797
2. Correct Answer: C
a. Incorrect: This is a valid strategy for Windows 7 Enterprise or Ultimate edition, but you
cannot make a VHD bootable on a computer running Windows 7 Home Premium.
B. Incorrect: RAID-0 (disk striping) offers no fault tolerance and you cannot store operating
system files on a RAID-0 volume.
c. Correct: You can use a RAID-1 volume to mirror the disk that holds your operating
system and provide fault tolerance.
D. Incorrect: RAID-0 (disk striping) offers fault tolerance and failover protection. However,
you cannot store operating system files on a RAID-5 volume.
3. Correct Answer: B
a. Incorrect: Enabling this policy permits remote users to access removable storage devices
in remote sessions. It does not deny all access to all types of external storage devices.
B. Correct: Enabling this policy denies all access to all types of external storage devices. It
overrides any access rights granted by other policies.
c. Incorrect: Enabling this policy denies read access to USB removable disks, portable
media players, and cellular phones. It does not deny all access to all types of external
storage devices.
D. Incorrect: Enabling this policy denies write access to USB removable disks, portable
media players, and cellular phones. It does not deny all access to all types of external
storage devices.
4. Correct Answer: B
a. Incorrect: To create the largest possible RAID-0 (striped) volume, you omit the size

parameter. Specifying a size of zero does not do this.
B. Correct: This command creates the largest possible RAID-0 volume.
c. Incorrect: The create volume raid command creates a RAID-5 volume. Also, to specify the
largest possible volume you omit the size parameter.
D. Incorrect: This command creates the largest possible RAID-5 volume.
5. Correct Answer: D
a. Incorrect: If you had used the mountvol /n or the diskpart automount command on
Aberdeen to prevent new volumes from being added to the system, the volume would
not be mounted and would not receive a drive letter. However, the question explicitly
states that you did not do this.
B. Incorrect: When you move a basic volume to another computer, it receives the next
available drive letter on that computer. However, you are moving a dynamic volume.
c. Incorrect: The G: drive letter is neither the next available letter on Aberdeen nor the
drive letter to which the volume had been allocated on Canberra. There is no reason for
this drive letter to be allocated.
D. Correct: When moved to a new computer, dynamic volumes retain the drive letter they
had on the previous computer, in this case H:.
7 9 8 Answers
Chapter 4: Case Scenario Answers
Case Scenario 1: Enforcing a Driver Signing Policy
1. The Dxdiag tool diagnoses any problems with the video card and will tell you whether the
driver is WHQL approved.
2. The Sigverif tool scans the computer and detects any unsigned drivers.
3. The Msinfo32 tool lists the resources and tells you what driver uses what resources.
In particular, you should investigate Conflicts/Sharing under Hardware Resources.
4. Driver Verifier Monitor tests the device driver under configurable stress conditions.
Case Scenario 2: Managing Disks
1. You would create a RAID-1 (mirror) array to hold your operating system and would mirror
Drive 0 with 200 GB of the allocated space on Drive 2.
2. You would create a RAID-5 (striping with parity) volume using the unallocated space on

Drives 1 and 3 (both 200 GB) and the 200 GB unallocated space that remains on Drive 2.
A RAID-5 volume offers fault tolerance and reduced data access times. Although a RAID-0
array would provide a greater usable data storage capacity and a greater improvement in
performance, it is not fault-tolerant.
3. Three 200 GB portions of unallocated disk would result in a RAID-5 array with 400 GB of
usable storage capacity.
Chapter 5: Lesson Review Answers
Lesson 1
1. Correct Answer: A
a. Correct: You should install the Windows XP Mode feature and install the application under
Windows XP. Windows XP Mode runs a fully virtualized copy of Windows XP on a computer
that has the Windows 7 Professional, Enterprise, or Ultimate operating system installed.
Applications that work on Windows XP and that have compatibility problems that cannot
be resolved using the ACT function in Windows XP Mode.
B. Incorrect: You should not create a custom compatibility fix because the question already
indicates that you have been unsuccessful in configuring a custom compatibility mode,
which is a collection of such fixes.
c. Incorrect: A shim is the previous name for a custom compatibility fix. The question text
already indicates that you have been unsuccessful in configuring a custom compatibility
mode, which is a collection of these fixes.
D. Incorrect: You should not configure the application installer to run in Windows XP
Professional SP2 mode because you have already found that you are unable to get
Chapter 5: Lesson Review Answers Answers 799
the application working using the tools included in the ACT. The ACT provides more
compatibility mode options than those built into Windows 7. If an application functions
under the built-in Windows 7 compatibility modes, it can work under the ACT modes.
2. Correct Answer: D
a. Incorrect: Although the application may function in the Windows 98/Windows Me
compatibility mode, you only have evidence that the application functions on the
Windows 2000 operating system, so you should use this compatibility mode first and try

others only if the Windows 2000 mode is unsuccessful.
B. Incorrect: Although the application may function in the Windows NT 4.0 (Service Pack
5) compatibility mode, you only have evidence that the application functions on the
Windows 2000 operating system, so you should use this compatibility mode first and try
others only if the Windows 2000 mode is unsuccessful.
c. Incorrect: You should not configure the application to run under Windows XP (Service
Pack 2) compatibility mode because you have evidence that the application does not
function on computers running Windows XP.
D. Correct: You should configure the application to run under the Windows 2000
compatibility mode because you know that the application functions on computers with
Windows 2000 installed.
3. Correct Answer: B
a. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .cab files.
You must extract the contents of the .cab file to find the executable file that contains the
application installer.
B. Correct: The Program Compatibility troubleshooter works only with executable files.
c. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .msi installer
files. The Program Compatibility troubleshooter only works with executable files that
have the .exe extension.
D. Incorrect: You cannot use the compatibility troubleshooter to troubleshoot .zip files. You
need to extract the contents of the .zip file to find the executable file that contains the
application installer.
4. Correct Answer: C
a. Incorrect: You should not configure the application to run in Windows XP (Service
Pack 3) compatibility mode because the problem is that the application does not prompt
for elevation. The program will still be unable to prompt for elevation when running in
this compatibility mode.
B. Incorrect: You should not configure the application to run in 256-color mode. This
compatibility option should be used only when the application has display problems.
c. Correct: You should enable the Run This Program As An Administrator compatibility

option if the application is not configured to prompt for elevation when administrative
8 0 0 Answers
privileges are required. This will allow the program to run with administrative privileges
once the user responds to a User Account Control prompt.
D. Incorrect: You should not enable the Disable Desktop Composition compatibility option.
You should enable this option when you need the Aero interface disabled when the
application executes.
5. Correct Answer: B
a. Incorrect: You can use the IEAK to configure Internet Explorer. You cannot use this
toolkit to determine whether an existing Web site displays correctly for users of Internet
Explorer 8, which is the default browser of Windows 7.
B. Correct: The ACT includes the Internet Explorer Compatibility Test Tool. This tool can be
used to evaluate whether a Web site is compatible with Internet Explorer 8, which is the
default browser of Windows 7.
c. Incorrect: The Windows AIK includes tools that assist in deploying the Windows operating
system. You cannot use this toolkit to determine whether an existing Web site displays
correctly for users of Internet Explorer 8, which is the default browser of Windows 7.
D. Incorrect: The MDT is a solution accelerator that assists in the planning and deployment
of operating systems to client computers. You cannot use this toolkit to determine
whether an existing Web site displays correctly for users of Internet Explorer 8, which is
the default browser of Windows 7.
Lesson 2
1. Correct Answer: D
a. Incorrect: AppLocker cannot be used to block the execution of applications on
computers running Windows Vista or Windows 7 Professional.
B. Incorrect: AppLocker cannot be used to block the execution of applications on
computers running Windows Vista or Windows 7 Professional.
c. Incorrect: AppLocker cannot be used to block the execution of applications on
computers running Windows Vista or Windows 7 Professional.
D. Correct: Because you cannot use AppLocker to block the execution of applications on

Windows Vista or Windows 7 Professional, you should use Software Restriction Policies to
accomplish the same objective.
2. Correct Answer: A
a. Correct: Publisher rules allow you to block applications based on which software vendor
wrote the application.
B. Incorrect: Path rules do not allow you to block applications based on which software
vendor wrote the application, as the question stipulates; they allow you to block
an executable file based on its location.
c. Incorrect: Hash rules do not allow you to block applications based on which software
vendor wrote the application, as the question stipulates; they allow you to block a specific
executable file based on a hash value generated from that file.
Chapter 5: Lesson Review Answers Answers 801
3. Correct Answers: B and C
a. Incorrect: You should not create AppLocker publisher rules. Publisher rules can be
used only when the file that is the subject of the rule has been signed digitally by the
publisher.
B. Correct: You should create an AppLocker hash rule because it is not possible to create
a publisher rule due to the lack of digital signature.
c. Correct: You should configure AppLocker enforcement to audit executable rules. This
allows you to ensure that the rules relating to applications function before you enforce
them in a production environment.
D. Incorrect: You should not configure AppLocker enforcement to audit Windows Installer
rules because you are interested in the functionality of executable rules.
4. Correct Answer: C
a. Incorrect: You should not configure Group Policy to set the Application Management
service to start automatically. The Application Management service is used to process
installation, removal, and enumeration requests for software deployed through Group
Policy. The service that you want to configure to start automatically is the Application
Identity service.
B. Incorrect: As the Software Restriction Policies are functioning properly, you do not

need to modify the settings of services related to the computers running Windows 7
Professional.
c. Correct: For AppLocker policies to function properly, you need to have the Application
Identity service functioning. The default setting on Windows 7 is to have this service
disabled. Through Group Policy, you can force this service to start automatically, which
allows AppLocker policies to be enforced.
D. Incorrect: Because the Software Restriction Policies are functioning properly, you do
not need to modify the settings of services related to the computers running Windows 7
Professional.
5. Correct Answer: A
a. Correct: You need to create a new hash rule for the application. Hash rules need
to be updated whenever you apply an update to an application. This is because the
update changes the characteristics of the file so that it no longer matches the hash rule
generated for it originally.
B. Incorrect: Because the application is not signed digitally, you cannot use a publishing
rule to manage it with AppLocker.
c. Incorrect: Because other AppLocker policies are functioning, you can infer that the
Application Identity service is active and its status does not need to be modified.
D. Incorrect: The Application Management service is related to software installation,
removal, and enumeration through Group Policy. This service does not affect AppLocker
policies directly.
8 0 2 Answers
Chapter 5: Case Scenario Answers
Case Scenario 1: Configuring Application
Compatibility at Fabrikam
1. Edit the properties of application Alpha. Configure the application to run using the Windows
XP Service Pack 3 compatibility mode.
2. Edit the properties of the Beta application. On the compatibility tab, enable the Run This
Program As An Administrator option. This enables the Run As Administrator option without
having to right-click the application each time to enable this functionality.

3. You can use the ACT to configure compatibility options for Application Gamma.
Case Scenario 2: Restricting Applications at Contoso
1. Configure an AppLocker executable rule that uses a file hash of the data collection
application. You cannot use a publisher rule because the application is not digitally signed.
2. Configure this rule to apply to the Everyone group. Block the execution of the application,
but configure an exception for the Scientists group.
3. The in-house developers would need to sign the application digitally before you can create
a publisher rule for it.
Chapter 6: Lesson Review Answers
Lesson 1
1. Correct Answer: C
a. Incorrect: The Ping command is used to test connectivity. It does not display the
IP configuration of a computer’s interfaces.
B. Incorrect: The Tracert command is used to test connectivity to a device on a remote
network and return information about the intermediate hops. It does not display the
IP configuration of a computer’s interfaces.
c. Correct: The Ipconfig command displays the IP configuration of a computer’s interfaces.
D. Incorrect: The Netstat tool displays protocol statistics. It does not display the IP
configuration of a computer’s interfaces.
2. Correct Answers: B, C, and D
a. Incorrect: This accesses the Local Area Network (LAN Settings) dialog box. You can select
automatic configuration, specify an automatic configuration script, or specify a proxy
server. The dialog box does not display connection properties.
Chapter 6: Lesson Review Answers Answers 803
B. Correct: This procedure accesses the Local Area Connections Properties dialog box.
c. Correct: This is an alternative method of accessing the Local Area Connections Properties
dialog box.
D. Correct: Double-clicking the LAN connection opens the Local Area Connection
Status dialog box. Clicking Properties accesses the Local Area Connections Properties
dialog box.

3. Correct answer: D
a. Incorrect: DNS resolves computer names to IP addresses. You are pinging the computers
by their IPv4 addresses, not their computer names, and a DNS service is not required for
the commands to succeed.
B. Incorrect: All computers on the same subnet must have the same subnet mask.
c. Incorrect: The subnet is isolated and no gateway is required to send traffic to other
networks. You do not need to define a gateway to implement connectivity between two
computers within the same subnet.
D. Correct: By default Windows Firewall blocks the Ping command. You need to enable
ICMPv4 traffic at both firewalls. At an elevated command prompt on both computers,
enter netsh advfirewall firewall add rule name=”ICMPv4”.
4. Correct Answer: B
a. Incorrect: This sets a /24 subnet mask. The question specifies a /25 subnet mask
(255.255.255.128).
B. Correct: This configures a static IPv4 address 10.0.10.162 on the 10.0.10.128/25 subnet.
c. Incorrect: This specifies dynamic configuration.
D. Incorrect: The 10.0.10.128/25 subnet has an IPv4 address range 10.0.10.129 through
10.0.10.254. The IPv4 address 10.0.10.16 is not on this subnet.
5. Correct Answers: C and D
a. Incorrect: The command netsh interface ipv4 show route shows route table entries, but it
does not display IPv6 routes.
B. Incorrect: The command tracert –d traces the route of an IP packet through an
internetwork. It lists the path the packet took and the delays encountered at each hop.
The –d flag prevents the tool from resolving IPv4 addresses to host names. The command
does not display a route table.
c. Correct: The command route print displays both the IPv4 and IPv6 route tables.
D. Correct: The command netstat –r displays the same output as the route print
command.
e. Incorrect: The command netstat –a displays all active connections and the TCP and UDP
ports on which the computer is listening. It does not display a route table.

8 0 4 Answers
Lesson 2
1. Correct Answer: A
a. Correct: Typically you would use a site-local address. If every device on the subnet had
a global address, you could also use global addresses, but this option is not given in the
question.
B. Incorrect: If you use link-local addresses, you need to specify their interface IDs. Also,
link-local addresses are not dynamically registered in Windows DDNS. It is therefore
much easier to use site-local addresses and typically they are used for this purpose.
c. Incorrect: Only two special addresses exist, :: and ::1. Neither can implement IPv6
connectivity over a private network.
D. Incorrect: An anycast address is configured only on a router and cannot implement IPv6
connectivity over a private network. Also, it is not a unicast address.
2. Correct Answer: B
a. Incorrect: The address fec0:0:0:0:fffe::1 is a site-local unicast IPv6 address that identifies
a node in a site or intranet. This type of address is the equivalent of an IPv6 private
address (for example, 10.0.0.1), and is not globally routable and reachable on the IPv6
Internet.
B. Correct: The address 21cd:53::3ad:3f:af37:8d62 is a global unicast address. This type of
address is the IPv6 equivalent of an IPv4 public unicast addresses and is globally routable
and reachable on the IPv6 Internet.
c. Incorrect: The address fe80:d1ff:d166:7888:2fd6 is a link-local unicast IPv6 address
and is autoconfigured on a local subnet. It is the equivalent of an IPv4 APIPA address
(for example, 169.254.10.123), and it is not globally routable or reachable on the IPv6
Internet.
D. Incorrect: The loopback address ::1 identifies a loopback interface and is equivalent to
the IPv4 loopback address 127.0.0.1. It is not globally routable or reachable on the IPv6
Internet.
3. Correct Answer: D
a. Incorrect: ARP is a broadcast-based protocol used by IPv4 to resolve IPv4 addresses to

MAC addresses. It does not manage the interaction of neighboring nodes and resolve
IPv6 addresses to MAC addresses.
B. Incorrect: DNS is a service rather than a protocol. It resolves computer names to IP
addresses. It does not manage the interaction of neighboring nodes and resolve IPv6
addresses to MAC addresses.
c. Incorrect: DHCPv6 assigns stateful IPv6 configurations. It does not manage the
interaction of neighboring nodes and resolve IPv6 addresses to MAC addresses.
D. Correct: ND uses ICMPv6 messages to manage the interaction of neighboring nodes and
resolve IPv6 addresses to MAC addresses.
Chapter 6: Lesson Review Answers Answers 805
4. Correct Answer: A
a. Correct: This is a Teredo compatibility address. Teredo addresses start with 2001.
B. Incorrect: This is a 6to4 compatibility address. 6to4 addresses start with 2002.
c. Incorrect: This is a link-local ISATAP address. Look for 5efe followed by the hexadecimal
representation of an IPv4 address, in this case 10.0.2.143.
D. Incorrect: This is a site-local Ipv6 address. It is not an IPv4-to-IPv6 compatibility address.
5. Correct Answer: C
a. Incorrect: A PTR resource record performs a reverse lookup and resolves an IPv4 or IPv6
address (depending on the reverse lookup zone specified) to a host name.
B. Incorrect: An A (address) resource record resolves a host name to an IPv4 address.
c. Correct: An AAAA (quad-A) resource record resolves a host name to an IPv6 address.
D. Incorrect: A host resource record is another name for an A record. It resolves a host
name to an IPv4 address.
Lesson 3
1. Correct Answer: C
a. Incorrect: The user’s computer works fine in the office. There is no need to reconfigure
the office network.
B. Incorrect: The order in which the user’s computer accesses networks is not the problem.
The problem occurs when her computer is within range of two wireless networks and
switches between them.

c. Correct: The likely cause of the reported behavior is that the lounge area of the hotel
is within range of (and possibly equidistant between) two wireless networks and keeps
switching between them. You can disable this feature or tell the user how to do so. You
need to warn the user that if she moves to another part of the hotel, she might need to
reconnect to a network.
D. Incorrect: The user’s laptop is working in the office and her hotel room. There is nothing
wrong with her wireless adapter.
2. Correct Answer: A
a. Correct: The MAC address is unique to an interface and does not change. MAC ensures
that only computers whose wireless interfaces have one of the listed MAC addresses can
access a wireless network. Be aware that if a new computer needs to access the network,
or if you replace the wireless adapter in a computer, you need to register the new MAC
address in the WAP.
B. Incorrect: Most networks are configured by using DHCP so IPv4 addresses can change.
Even in networks where IPv4 addresses are statically configured, it is unlikely that the
WAP supports IPv4 address control.
806 Answers
c. Incorrect: WEP is an encryption method that ensures that third parties cannot read
messages if they intercept them. It does not determine which computers can access
a network.
D. Incorrect: Like WEP, WPA is an encryption method and does not determine which
computers can access a network.
3. Correct Answers: C, E, and F
a. Incorrect: The Network Diagnostic tool is not a system tool and can’t be accessed from
the System Tools menu.
B. Incorrect: You run the Windows Network Diagnostic tool when you have a problem. It
is not a tool that you schedule to run on a regular basis and it is not in the task scheduler
library.
c. Correct: You can run the Network Diagnostic tool from the Network And Sharing
Center.

D. Incorrect: You cannot access the Windows Network Diagnostic tool from the Adapter
Properties dialog box. This dialog box is used for configuration, not diagnosis.
e. Correct: You can run the Windows Network Diagnostic tool when you fail to connect to
a Web page.
F. Correct: You can run the Windows Network Diagnostic tool for a specific connection by
accessing the Network Connections dialog box.
4. Correct Answer: B
a. Incorrect: Windows Firewall protects Don’s computer and is enabled by default. His
neighbor is accessing his WAP, not his computer.
B. Correct: Don found the WAP setup easy because he accepted all the defaults and did not
set up any security. He needs to change his SSID from its default value. He should also
configure encryption and set up a passphrase. He should change the access password. He
should consider restricting access by MAC address.
c. Incorrect: Changing the WAP channel can solve problems related to interference from
mobile phones or microwave ovens (for example). It does not affect access to a network.
D. Incorrect: ICS enables other computers to obtain their IPv4 configuration from the ICS
computer. Unless Don has non-wireless computers connected through a wired interface
to his wireless computer, he does not need to set up ICS. Additional wireless computers
obtain their configurations directly from the WAP. This has no bearing on whether his
neighbor can access his network.
5. Correct Answer: D
a. Incorrect: This specifies LaserF2 as the default printer whatever floor Sam is on and
whatever network he is connected to. This causes problems because Sam cannot connect
to LaserF2 when he is on the third floor.
B. Incorrect: This specifies LaserF3 as the default printer whatever floor Sam is on and
whatever network he is connected to. This causes problems because Sam cannot connect
to LaserF3 when he is on the second floor.
Chapter 6: Case Scenario Answers Answers 807
c. Incorrect: This specifies LaserF3 as the default printer when Sam is on the second floor
and LaserF2 as the default printer when Sam is on the third floor. This causes problems

because LaserF3 is on a network that is not accessible from the second floor and LaserF2
is on a network that is not accessible from the third floor.
D. Correct: This specifies LaserF2 as the default printer when Sam is on the second floor and
LaserF3 as the default printer when Sam is on the third floor, which is the required scenario.
Chapter 6: Case Scenario Answers
Case Scenario 1: Implementing IPv4 Connectivity
1. Your friend needs to set up ICS on the computer that connects to his modem. He needs to
ensure that the other computers on his network obtain their IPv4 configuration automatically.
When he has configured ICS on the first computer, he should reboot the other two.
2. He should plug the WAP into his cable modem though its WLAN connection. He then should
connect the three wired desktop computers to the Ethernet ports on the WAP and configure
the WAP from one of them using its Web interface. He can connect the wireless computer
to his network through Network And Sharing Center or by clicking the Wireless icon on the
bottom left section of his screen.
Case Scenario 2: Implementing IPv6 Connectivity
1. Site-local IPv6 addresses are the direct equivalent of private IPv4 addresses and are routable
between VLANs. However, you could also consider configuring every device on your network
with an aggregatable global unicast IPv6 address. NAT and CIDR were introduced to address
a lack of IPv4 address space, and this is not a problem in IPv6. You cannot use only link-local
IPv6 addresses in this situation because they are not routable.
2. This is a Teredo address associated with a Teredo tunnel. It is used to implement compatibility
between IPv6 and IPv4.
Case Scenario 3: Using Laptop Computers Running
Windows 7 on Wireless Networks
1. Windows 7 introduces location-aware printing. The employee can use the office printer as her
default printer while at Margie’s Travel and her inkjet printer as her default printer while at
home. The switchover is seamless and automatic provided that both printers are designated
as the default printers.
2. Windows 7 introduces the Network Printer Installation Wizard. This is easier to use than the
Add Printer Wizard and users can install printers without requiring administrative privileges.

3. The employee is unfortunate because his desk is located where two wireless networks
overlap. If it is impractical to move the employee’s desk, you can disable automatic switching.
This solves the problem, but the employee should be advised that he would need to connect
to a network manually if he moves to some other areas in the building.
808 Answers
Chapter 7: Lesson Review Answers
Lesson 1
1. Correct Answer: B
a. Incorrect: Inbound rules are used to block traffic from the network to the computer. You
want to block a specific type of network traffic from the computer to the network, which
necessitates the use of outbound rules.
B. Correct: Outbound rules allow you to block and allow traffic that originates on the
computer from traveling out to the network. You should configure an outbound rule to
block students from using FTP to upload files to sites on the Internet and an outbound
rule to allow students to use SMTP to send e-mail.
c. Incorrect: Isolation rules are used to limit the hosts that a computer can communicate
with to those that meet a specific set of authentication criteria. They cannot be used to
block an outbound specific protocol.
D. Incorrect: Authentication exemption rules are used in conjunction with Isolation
rule to allow connections to be made without requiring that authentication occur.
Authentication exemption rules apply to inbound traffic rather than outbound.
2. Correct Answers: B and C
a. Incorrect: Windows Firewall does not allow you to create firewall rules for specific
network locations on the basis of port address. Windows Firewall does not allow you to
create rules that differentiate between the home and work network locations. You can
only create rules that differentiate on the basis of home and work or public network
locations.
B. Correct: You can use WFAS to create firewall rules on the basis of port address and on
the basis of network location.
c. Correct: You can use the Netsh command-line utility to create WFAS rules. WFAS rules

allow you to create firewall rules on the basis of port address and on the basis of network
location.
D. Incorrect: Netstat is a tool used to provide information about network traffic. You
cannot use Netstat to create firewall rules.
3. Correct Answer: C
a. Incorrect: The rule in the question allows traffic rather than blocks traffic.
B. Incorrect: The rule in the question applies to inbound traffic rather than outbound
t r a f fi c .
c. Correct: This rule, called CustomRule, applies in the domain profile and allows inbound TCP
traffic on port 80. You can create WFAS rules using Netsh in the advfirewall context.
D. Incorrect: The rule in the question is an inbound rule rather than an outbound rule.
Chapter 7: Lesson Review Answers Answers 809
4. Correct Answer: B
a. Incorrect: Although you can create rules based on applications using Windows Firewall,
you cannot use this tool to create rules that require that incoming connections be
authenticated.
B. Correct: WFAS allows you to create detailed rules that include the ability to allow
incoming traffic only if it is authenticated.
c. Incorrect: Credential Manager stores authentication credentials. It cannot be used to
create firewall rules that require authentication.
D. Incorrect: Authorization Manager allows you to configure roles for the delegation of
administrative privileges. You cannot use Authorization Manager to create firewall rules
that require authentication.
5. Correct Answers: A and D
a. Correct: You should configure Windows Firewall to notify you when it blocks a program in
the Home Or Work (Private) Network Location Settings area. This ensures that you receive
a message when a new program is blocked when connected to this network profile.
B. Incorrect: You should not disable the setting related to receiving a message when
a new program is blocked in the Home Or Work (Private) Network Location Settings area
because this means that you do not receive a message when a program is blocked.

c. Incorrect: You should not enable the setting related to receiving a message when a new
program is blocked in the Public Network Location Settings area because this notifies you
when a new program is blocked. The question text states that you should not be notified
when this occurs.
D. Incorrect: You should disable the setting related to receiving a message when a new
program is blocked in the Public Network Location Settings area because this ensures
that you are not notified when a program is blocked.
Lesson 2
1. Correct Answer: C
a. Incorrect: You should not enable Remote Assistance. Remote Assistance requires that
someone is logged on to the computer that you wish to manage remotely.
B. Incorrect: You should not enable the Remote Desktop: Don’t Allow Connections To This
Computer option because that blocks the ability to make Remote Desktop connections.
c. Correct: You should enable the Remote Desktop: Allow Connections From Computer
Running Any Version Of Remote Desktop setting because this allows you to connect to
a computer running Windows 7 from a computer running Windows XP with SP2.
D. Incorrect: You should not enable the Remote Desktop: Allow Connections Only From
Computers With Network Level Authentication as clients running Windows XP with
SP2 are unable to connect to clients running Windows 7 when this option is enabled.
Windows XP requires SP3 and special configuration to use Network-Level Authentication.
8 1 0 Answers
2. Correct Answer: B
a. Incorrect: You need to configure client Beta rather than client Alpha using the WinRM
Quickconfig command.
B. Correct: You need to run the command WinRM Quickconfig on client Beta before you
can manage it remotely from client Alpha using Windows PowerShell. This command
starts the WinRM service, configures a listener for the ports that send and receive
WS-Management protocol messages, and configures firewall exceptions.
c. Incorrect: It is not necessary to create a firewall rule on client Alpha.
D. Incorrect: Although it is necessary to create a firewall rule on client Beta, it is also

necessary to configure a listener for WS-Management protocol messages and to start the
WinRM service. All these tasks can be accomplished by running the WinRM quickconfig
command. Only one of these tasks can be accomplished by creating a firewall rule.
3. Correct Answer: B
a. Incorrect: The command nslookup Aberdeen provides the computer’s IP address but
does not provide the MAC address.
B. Correct: The command winrs –r:Aberdeen ipconfig /all runs the command ipconfig /all on
Aberdeen but displays the results on the computer that you are logged on to, which in
this case is computer Canberra. Ipconfig /all displays a computer’s MAC address.
c. Incorrect: You should not use the command winrs –r:Canberra ipconfig /all because this
displays computer Canberra’s IP address information, not the IP address information of
computer Aberdeen.
D. Incorrect: The command arp –a displays information about IP addresses and MAC
addresses on the same subnet but does not display MAC address information about
computers on remote subnets. To use this command to determine another computer’s
MAC address, you also have to know that computer’s IP address.
4. Correct Answer: B
a. Incorrect: The Windows PowerShell command icm Canberra {Get-Process} displays
process information from computer Canberra, not computer Aberdeen.
B. Correct: The Windows PowerShell command icm Aberdeen {Get-Process} opens a remote
Windows PowerShell session to computer Aberdeen and runs the Get-Process cmdlet,
which displays process information, including listing data about CPU and memory usage.
c. Incorrect: You cannot use WinRS to invoke a Windows PowerShell cmdlet. You must use
Windows PowerShell with the syntax icm remotehost {PowerShell Cmdlet} to use Windows
PowerShell remotely.
D. Incorrect: You cannot use WinRS to invoke a Windows PowerShell cmdlet. You must use
Windows PowerShell with the syntax icm remotehost {PowerShell Cmdlet} to use Windows
PowerShell remotely. In this example, WinRS targets computer Canberra rather than
computer Aberdeen.
Chapter 7: Case Scenario Answers Answers 811

5. Correct Answer: D
a. Incorrect: The WinRM service is required for remote use of Windows PowerShell and
Remote Shell. The WinRM service is not required for Remote Assistance.
B. Incorrect: A client does not have to be configured to accept Remote Desktop sessions
to use Remote Assistance, so this setting does not explain why the connection cannot be
made. Clients running Windows 7 always support Network Level Authentication.
c. Incorrect: The helper does not need to log on to the target computer when participating
in a Remote Assistance session, so it does not matter what groups her user account is
a member of. A Remote Assistance session allows the helper to see the desktop of the
currently logged-on user, so everything that is done within that session is done with the
currently logged-on user’s privileges.
D. Correct: If the Remote Assistance panel is closed, it stops any possible Remote Assistance
connection.
Chapter 7: Case Scenario Answers
Case Scenario 1: University Client Firewalls
1. Configure a Windows Firewall rule that allows incoming Web traffic on the local subnet. This
allows people at the conference to connect to the Web site but does not allow people from
other networks to make similar connections.
2. You should configure a port-based outbound rule to block the file sharing program in the
undergraduate computer lab. Port-based rules allow you to block specific ports and can be
useful when the programs that use those ports have different identities.
3. You could create a set of firewall rules on a reference computer and export them to a USB
flash device. You could then import the firewall rules on each of the other stand-alone
computers in the postgraduate computer laboratory.
Case Scenario 2: Antarctic Desktop Support
1. As installing the application requires the ability to elevate privileges, you need to connect to
the client running Windows 7 using Remote Desktop and log on.
2. Add the user’s account to the Remote Desktop Users group on the client running Windows 7
at the Antarctic base. If the user at the Tasmanian office is using a client running Windows
XP, ensure that the settings on the client running Windows 7 in Antarctica do not require

Network Level Authentication.
3. Before you can run Windows PowerShell scripts remotely against the clients running
Windows 7, you need to run the WinRM Quickconfig command from an elevated command
prompt on each computer.
8 1 2 Answers
Chapter 8: Lesson Review Answers
Lesson 1
1. Correct Answers: B, C, and D
a. Incorrect: You do not need to share each data folder; you can add them to a common
library and then share the library using HomeGroups.
B. Correct: You should create a new library named Sci_Data, add each instrument’s separate
data folder to the library, and then share it using the HomeGroup control panel.
c. Correct: You should create a new library named Sci_Data, add each instrument’s separate
data folder to the library, and then share it using the HomeGroup control panel.
D. Correct: You should create a new library named Sci_Data, add each instrument’s separate
data folder to the library, and then share it using the HomeGroup control panel.
2. Correct Answer: C
a. Incorrect: The Print permission allows a user to manage their documents but not the
documents of others.
B. Incorrect: Users that you assign the Manage This Printer permission are able to
reconfigure printer permissions. They are not able to manage the documents of other
users directly, though they can assign themselves the Manage Documents permission
and accomplish this task indirectly.
c. Correct: When you assign a person the Manage Documents permission, she is able to
reorder any documents in the queue and cancel them.
D. Incorrect: The Power Users group is included for backward compatibility with earlier
versions of Windows. Assigning a user to the Power Users group does not confer any
printer permissions.
3. Correct Answers: A and B
a. Correct: You can use the net share command to view share names and the folders with

which those folders are associated.
B. Correct: You can use the Computer Management console to view share names and the
folders with which those shares are associated.
c. Incorrect: Libraries allows you to configure libraries. You cannot use Libraries to
determine which shared folders a client running Windows 7 hosts because it is possible to
host shared folders that are not libraries.
D. Incorrect: You can use Network And Sharing Center to configure sharing options, but
you cannot use Network And Sharing Center to determine which shared folders a client
running Windows 7 hosts.
4. Correct Answer: B
a. Incorrect: You should not assign the Read permission. If you assign this permission, users
are unable to modify or delete files.
Chapter 8: Lesson Review Answers Answers 813
B. Correct: You should assign the Modify permission because this allows users to add,
modify, and delete files located in the accounting shared folder.
c. Incorrect: You should not assign the Full Control permission because then users have the
ability to modify shared folder permissions.
D. Incorrect: You cannot assign the Owner permission to groups. When you use basic
sharing, Windows automatically assigns this permission to the user who shares the folder.
5. Correct Answer: D
a. Incorrect: Enabling this option does not ensure that shared resources are visible to other
computers in the HomeGroup. This option allows HomeGroup readers to read and write
files in the public folder.
B. Incorrect: Enabling this option does not ensure that shared resources are visible to other
computers in the HomeGroup. This option controls the encryption level of file sharing
connections.
c. Incorrect: Password Protected Sharing restricts access to shared resources hosted on the
client. Only users with local accounts on the client are able to access shared resources
when Password Protected Sharing is enabled. Enabling this option does not ensure that
shared resources are visible to other computers in the HomeGroup.

D. Correct: Network Discovery allows the client to find other computers on the network. It also
allows other computers on the network to view resources shared by the client.
Lesson 2
1. Correct Answer: B
a. Incorrect: Jeff needs an EFS certificate for you to be able to encrypt a file that he can
access. Changing a password does not generate an EFS certificate.
B. Correct: If Jeff encrypts a file on the computer, it generates an EFS certificate. You can
then use this EFS certificate to encrypt the file to his account.
c. Incorrect: Jeff does not need write access to the file for you to be able to use EFS
to encrypt the file to his account. Jeff needs an encryption certificate, which can be
generated by having Jeff encrypt a file on the computer.
D. Incorrect: Letting Jeff take ownership of the files does not allow you to use EFS to
encrypt the file to his account. Jeff needs an encryption certificate, which can be
generated by having Jeff encrypt a file on the computer.
2. Correct Answers: A and B
a. Correct: When you apply the Read & Execute (Deny) permission, Windows also
automatically applies the List Folder Contents (Deny) and Read (Deny) permissions.
B. Correct: When you apply the Read & Execute (Deny) permission, Windows also
automatically applies the List Folder Contents (Deny) and Read (Deny) permissions.
8 1 4 Answers
c. Incorrect: Windows does not apply the Modify (Deny) permission when you apply the
Read & Execute (Deny) permission.
D. Incorrect: Windows does not apply the Write (Deny) permission when you apply the
Read & Execute (Deny) permission.
3. Correct Answer: D
a. Incorrect: Robocopy can be used to copy files and their associated NTFS permissions but
cannot be used to calculate permissions.
B. Incorrect: Icacls can be used to display permissions but cannot be used to calculate the
result of cumulative permissions.
c. Incorrect: Cipher is used to manage certificates and cannot be used to calculate the

result of cumulative permissions.
D. Correct: The Effective Permissions tool can be used to calculate the result of cumulative
permissions that accrue through multiple group memberships.
4. Correct Answers: A and D
a. Correct: Encrypted files remain encrypted when copied or moved to compressed folders.
B. Incorrect: Encrypted files remain encrypted when copied or moved to compressed
folders. Only unencrypted files become compressed when moved to compressed folders.
c. Incorrect: Files retain their original NTFS permissions only when they are moved
between folders on the same volume. If you move them between volumes, they inherit
the permissions of the destination folder. You can use Robocopy to move files and retain
their NTFS permissions, but Robocopy was not mentioned in the question text.
D. Correct: Files that are moved using Windows Explorer inherit the NTFS permissions
assigned to their destination folder.
5. Correct Answer: B
a. Incorrect: EFS can be used to limit which users can access a document by encrypting it
only to certain user accounts, but it cannot be used to track which user accounts have
been used to access files.
B. Correct: Auditing allows you to track which user accounts are used to access files and
folders. You can configure auditing to track successful and failed attempts to use any of
the special permissions.
c. Incorrect: You cannot use NTFS permissions to record which user accounts are used to
access documents; you can only use NTFS permissions to restrict which user accounts are
used to access documents.
D. Incorrect: BranchCache is used to speed up access to files across the wide area network
(WAN); it cannot be used to record which user accounts access documents in a sensitive
folder.
Chapter 8: Lesson Review Answers Answers 815
Lesson 3
1. Correct Answers: A and B
a. Correct: If you are going to use hosted cache mode, it is necessary to deploy at least one

server running Windows Server 2008 R2 with the BranchCache feature enabled in each
branch office.
B. Correct: Windows 7 Enterprise and Ultimate editions support BranchCache. You
must upgrade clients to one of these operating systems if they are going to utilize
BranchCache.
c. Incorrect: Windows 7 Professional does not support the BranchCache feature.
D. Incorrect: A Windows Server 2008 RODC is not necessary to support BranchCache.
2. Correct Answers: B and D
a. Incorrect: You can use Net share to manage shared folders on a client running
Windows 7, but you cannot use it to enable and configure BranchCache. You can use it
to enable BranchCache on a computer that hosts a shared folder, but BranchCache needs
to be enabled and configured before you can do this.
B. Correct: You can use Netsh in the BranchCache context and the Local Group Policy Editor
to configure BranchCache on a client running Windows 7.
c. Incorrect: Ipconfig provides IP address configuration information. You cannot use
Ipconfig to configure BranchCache on a client running Windows 7.
D. Correct: You can use Netsh in the BranchCache context and the Local Group Policy Editor
to configure BranchCache on a client running Windows 7.
3. Correct Answer: C
a. Incorrect: If you use the command netsh branchcache set service disabled, the content
accessed over the WAN link is not cached locally.
B. Incorrect: If you use the command netsh branchcache set service mode=distributed, it
is possible that the content will be shared with the other computer running Windows 7
Ultimate, although in a properly configured environment, file and folder permissions
would restrict access.
c. Correct: You should use the command netsh branchcache set service mode=local,
because this allows the computer running Windows 7 Ultimate to satisfy requests from
its local cache without allowing that cache to be accessible to other computers on the
network.
D. Incorrect: You should not use the command netsh branchcache set service

mode=hostedclient location=fs-alpha.contoso.internal. You can use the hostedclient mode
only if there is a server running Windows Server 2008 R2 that has BranchCache enabled
on your LAN.
8 1 6 Answers
4. Correct Answer: D
a. Incorrect: The command netsh branchcache set service mode=distributed configures
Distributed Cache mode rather than Hosted Cache mode. The question specifies that the
clients use Hosted Cache mode.
B. Incorrect: The command netsh branchcache set service mode=local sets the client to use
local caching only. The question specifies that the clients use Hosted Cache mode.
c. Incorrect: The command netsh branchcache set service mode=hostedserver
clientauthentication=domain is used to configure the host server and cannot be used to
configure a Hosted Cache mode client.
D. Correct: To configure a BranchCache client to use a particular server in Hosted Cache mode,
issue the command netsh branchcache set service mode=hostedclient location=servername.
You must specify the name of the local server running Windows Server 2008 R2 that
functions as the BranchCache host when configuring Hosted Cache mode.
5. Correct Answer: A
a. Correct: The Configure BranchCache For Network Files policy allows you to set the latency
value above which network files are cached by client computers in the branch office.
B. Incorrect: The Set Percentage Of Disk Space Used For Client Computer Cache policy
configures the cache size, it cannot be used to configure latency settings.
c. Incorrect: Configuring the Set BranchCache Distributed Cache Mode policy sets the
client to use Distributed Cache Mode. You cannot configure latency settings using this
policy.
D. Incorrect: Configuring the Set BranchCache Hosted Cache Mode policy sets the client to use
Hosted Cache Mode. You cannot configure latency settings using this policy.
Chapter 8: Case Scenario Answers
Case Scenario 1: Permissions and Encryption
1. You need to export the user’s private key from computer Waverley and import it to computer

Warrandyte.
2. Create a recovery agent certificate using Cipher.exe. Use the Local Group Policy Editor to
assign this certificate as a recovery agent.
3. You can use Robocopy.exe or Icacls.exe to move the files from one volume to another while
retaining their existing permissions. If you just move the files, the permissions will be lost.
Case Scenario 2: Configuring Contoso Branch Offices
1. You should use Distributed Caching mode in the Wangaratta branch office because you are
unable to deploy a server running Windows Server 2008 R2 to this location and Windows
Server 2008 does not support BranchCache.
Chapter 9: Lesson Review Answers Answers 817
2. You should configure the Hosted Cache mode at the Traralgon office because this ensures
that a maximum number of files are available in the centralized cache. Hosted Cache allows
the cache to remain online, unlike Distributed Cache, which requires that all clients remain
online. A server running Windows Server 2008 R2 is present at the Traralgon branch office to
support Hosted Cache mode.
3. Install the BranchCache feature on the server and configure shared folders to support
BranchCache. Run the command set service mode=hostedserver clientauthentication=domain
on the server.
Chapter 9: Lesson Review Answers
Lesson 1
1. Correct Answer: B
a. Incorrect: You should not configure the policy UAC: Behavior Of The Elevation Prompt
For Administrators In Admin Approval Mode: Elevate Without Prompting. This policy
relates to all administrator accounts except the built-in administrator account, which must
be managed with other policies.
B. Correct: You should configure the UAC: Admin Approval Mode For The Built-In
Administrator Account policy to Enabled. This ensures that the built-in administrator
account must respond to a UAC prompt when performing a task that requires elevated
privileges.
c. Incorrect: You should not configure the UAC: Admin Approval Mode For The Built-In

Administrator account policy to Disabled. This policy setting disables the UAC prompt for
the built-in administrator account.
D. Incorrect: You should not configure the policy UAC: Behavior Of The Elevation Prompt
For Administrators In Admin Approval Mode: Prompt For Consent For Non-Windows
Binaries. This policy relates to all administrator accounts except the built-in administrator
account, which must be managed with other policies.
2. Correct Answer: B
a. Incorrect: You should not configure the User Account Control: Behavior Of The Elevation
Prompt For Standard Users: Automatically Deny Elevation Requests policy. When this
policy is configured, standard users receive no prompt when they perform a task that
requires elevation, and the elevation attempt automatically fails.
B. Correct: You should configure the User Account Control: Behavior Of The Elevation
Prompt For Standard Users: Prompt For Credentials policy. This ensures that a standard
user is prompted for credentials when an attempt is made at elevation.
c. Incorrect: You should not configure the User Account Control: Behavior Of The Elevation
Prompt For Administrators In Admin Approval Mode: Prompt For Credentials because this
policy relates to approval for administrator accounts rather than standard user accounts.