Question 1

In a Windows 2000–based Active Directory environment with Windows 2000 servers and clients, how can you enforce a policy that prevents any unsigned drivers from being installed on any computer in the domain?

Accepted Answer

Introduction / Context:Windows 2000 introduced Group Policy for centralized configuration. Driver signing policies determine whether unsigned kernel-mode drivers can be installed. To uniformly prevent unsigned drivers across the entire network, you must target a scope that includes all computers where enforcement is required, not just domain controllers.Given Data / Assumptions:All machines (servers and clients) are joined to the domain.Goal: block any unsigned driver installation.Admins can apply Group Policy Objects (GPOs) at domain or OU scopes.Concept / Approach:Driver signing policy is a computer configuration setting. To affect every computer, link a GPO at the domain level (or at a parent OU that contains all computers) that sets “Devices: Unsigned driver installation behavior” to “Do not allow.” Applying only to the Default Domain Controllers OU affects domain controllers only and leaves clients/servers unprotected. Configuring each machine manually is error-prone and inconsistent.Step-by-Step Solution:Create a GPO linked to the domain.Navigate to Computer Configuration → Administrative Templates → System → Driver Installation.Set the policy to block unsigned drivers (e.g., “Code signing for device drivers” to “Do not allow installation”).Ensure all computers are within the policy scope and that security filtering allows application.Verification / Alternative check:Attempting to install an unsigned driver on a client subject to the domain GPO should fail with a policy-based block, confirming effective enforcement.Why Other Options Are Wrong:Default Domain Controllers OU: Affects only DCs, not all computers.Manual per-machine settings: Not centralized; prone to drift.Do nothing: Not the default; Windows 2000 permits unsigned drivers unless policy is set.None of above: Incorrect because a domain-linked GPO is the right method.Common Pitfalls:Forgetting to use computer configuration (not user); mis-scoping the GPO to a subset of machines.Final Answer:Configure a Group Policy for the domain that blocks all unsigned drivers

Question 2

Windows 2000 Group Policy design: An OU-level GPO denies “My Network Places” and “System” (Control Panel) to users. Managers (a Domain Local group) should regain access to My Network Places but still be blocked from System. What is the best configur…

Accepted Answer

Introduction / Context:When multiple GPOs apply to the same OU, Windows processes them by link order (lowest number wins last). You can fine-tune targeting via the GPO security filter (ACL). Here, the base GPO blocks both “My Network Places” and “System.” Managers need an exception for only My Network Places while still inheriting the System block.Given Data / Assumptions:GPO-A (original) blocks My Network Places and blocks System.Managers need My Network Places allowed; System must remain blocked.Managers are a Domain Local group in the same domain.Authenticated Users currently receive GPO-A.Concept / Approach:Use an additional GPO (GPO-B) scoped only to Managers that flips just the My Network Places setting to “Enabled/Allow,” leaving System untouched. Ensure GPO-A has higher precedence (processed later) only for settings we still want enforced. Because we want the exception to win for My Network Places, set the link order so GPO-B is processed later than GPO-A for Managers only. Achieve scoping by removing or disabling Authenticated Users Apply permission on GPO-B and granting Managers Apply/Read.Step-by-Step Solution:Create GPO-B at the same OU.In GPO-B, configure “Allow access to My Network Places” (or remove the restriction).On GPO-B ACL, allow Managers Read/Apply; remove/disable Authenticated Users Read/Apply.Set link order so that for Managers, GPO-B applies and overrides the My Network Places setting; do not configure System here, so GPO-A’s System block still applies.Verification / Alternative check:Use Resultant Set of Policy (RSoP) or gpresult to confirm Managers see My Network Places enabled while the System CPL restriction persists.Why Other Options Are Wrong:Explicit deny Read/Apply (option B) blocks the GPO entirely for Managers, preventing exceptions.Option A does not create an exception; it simply disables processing.Option C misconfigures the new GPO to deny System again, complicating precedence unnecessarily.None: A clear solution exists (option D).Common Pitfalls:Using Deny instead of removing Apply, which overrides all; forgetting to verify link order and security filtering with RSoP.Final Answer:Create a second GPO for the OU; grant Managers Apply/Read, disable Authenticated Users Apply/Read, configure the new GPO to allow My Network Places; set the original GPO to higher priority

Question 3

A Windows 2000 Server has a non–Plug and Play ISA modem fixed at IRQ 5. After adding a PCI modem and rebooting, Device Manager shows an IRQ 5 conflict (both modems want IRQ 5). What is the correct way to resolve this resource conflict?

Accepted Answer

Introduction / Context:Legacy ISA devices often require fixed, jumper-set resources. PCI devices typically use Plug and Play to auto-assign interrupts—unless the BIOS allows that line to be reserved for legacy ISA hardware. Here, an ISA modem already occupies IRQ 5, but the new PCI modem grabbed the same IRQ, producing a conflict.Given Data / Assumptions:ISA modem is non-PnP and hard-set to IRQ 5.PCI modem is PnP and can use alternative IRQs.Windows reports both devices on IRQ 5.Concept / Approach:The proper fix is to prevent the PCI enumerator from using IRQ 5 at all, by marking it “Reserved for ISA/Legacy” in BIOS/CMOS. Then, on the next boot, the PCI bus will reassign the PCI modem to a different, available interrupt (for example, IRQ 10 or 11), while the ISA device legitimately keeps IRQ 5. Changing the ISA modem via Device Manager is ineffective because it is not Plug and Play.Step-by-Step Solution:Enter BIOS/CMOS setup.Locate “PnP/PCI Configuration” or similar menu.Set IRQ 5 to “Legacy ISA/Reserved.”Save and reboot; verify that the PCI modem now uses a different IRQ and the conflict is cleared.Verification / Alternative check:After reserving IRQ 5 for legacy devices, Device Manager should display the PCI modem on another IRQ. Test dial-up to confirm stable operation and no sharing conflicts.Why Other Options Are Wrong:Changing the ISA modem's IRQ in Device Manager is not possible for non-PnP hardware.Reserving IRQ 10 for legacy does not protect the ISA device on IRQ 5 and can cause further conflicts.None: An appropriate BIOS reservation fix exists.Common Pitfalls:Attempting to force PCI device IRQs manually in Windows; moving the PCI card to another slot can work, but BIOS reservation is the reliable method.Final Answer:Edit the BIOS/CMOS to reserve IRQ 5 for non–Plug and Play devices so the PCI modem selects another IRQ

Question 4

RRAS dial-up client receives 169.254.x.x (APIPA) on a private network (192.168.0.0). Connection succeeds, but no resources are reachable (pings time out). What server-side action resolves the addressing issue so dial-in clients receive valid IPs?

Accepted Answer

Introduction / Context:When Routing and Remote Access Service (RRAS) assigns an Automatic Private IP Addressing (APIPA) address (169.254.x.x) to dial-in clients, it indicates the server could not obtain a valid lease to hand out. Without a valid IP on the client, routing and resource access will fail, hence the timeouts.Given Data / Assumptions:Private network uses 192.168.0.0 addressing.RRAS is installed; dial-up connects but lacks usable IP configuration.ipconfig on the client shows 169.254.75.182 (APIPA).Concept / Approach:RRAS can deliver IPs to remote clients either from a static address pool or by acting as a DHCP proxy (obtaining leases from a DHCP server on behalf of clients). If RRAS cannot contact a DHCP server with an active scope, clients fall back to APIPA. Therefore, the remedy is to guarantee DHCP reachability and a valid scope that matches the RRAS server’s subnet, or alternatively configure a static pool directly on RRAS.Step-by-Step Solution:Verify that a DHCP server exists and has an active scope for the RRAS subnet.Ensure Layer-3 connectivity between RRAS and DHCP (no filters blocking UDP 67/68).In RRAS IP assignment settings, select DHCP and confirm leases are obtained.Reconnect a client and confirm it receives a valid 192.168.x.x address and can reach resources.Verification / Alternative check:As an alternative to DHCP dependency, configure a static address pool on RRAS and confirm clients receive those addresses successfully.Why Other Options Are Wrong:Merely “configuring the server with the address of a DHCP server” or “authorizing” without actual reachability and an active scope does not solve the root problem.DHCP Relay Agent is used to forward client DHCP broadcasts across routers; RRAS already proxies for remote clients and primarily needs a reachable DHCP scope.None: A direct, correct action exists.Common Pitfalls:Forgetting to create a scope or isolating RRAS from DHCP by firewall; misinterpreting APIPA as a client-side modem or authentication issue.Final Answer:Ensure the remote access server can reach a DHCP server that has an active scope for its subnet

Question 5

IIS permissions scenario: The Administration group is nested in the Security group and has Full Control on the Sales virtual directory; the Intern group is nested in the Nonsecurity group. Nate (an Intern) must update files under Sales. What should …

Accepted Answer

Introduction / Context:Effective access in Windows/IIS depends on group memberships and the resulting NTFS/IIS permissions. Here, Full Control is granted to the Security group on the Sales virtual directory. Nate, an Intern, needs update rights. The cleanest approach is to adjust group membership so that Nate inherits the required permissions without broadening access for all interns or exposing content anonymously.Given Data / Assumptions:Administration → Security → Full Control on Sales (via group nesting).Interns → Nonsecurity (no write permissions on Sales).Nate alone needs write/update capability.Concept / Approach:Group-based authorization is preferred over per-user ACE sprawl. Adding Nate to the Security group grants him the same Full Control that Administration has, satisfying the update requirement. Enabling anonymous access would bypass authentication/authorization and is insecure. Removing Nate from Interns does not grant rights by itself. Adjusting only Nate’s membership avoids changing other Interns’ privileges.Step-by-Step Solution:Confirm that Security has the necessary permissions on Sales.Add Nate to the Security group (direct membership or via a suitable intermediate group).Have Nate reauthenticate or log off/on to refresh tokens.Verify write/update operations on the Sales directory.Verification / Alternative check:A targeted per-user ACE on Sales could work but contradicts least-administration principles. The group-membership approach scales better and maintains consistent permissions.Why Other Options Are Wrong:Anonymous access (site or directory): Grants access to everyone, not just Nate, and typically removes auditing of identities.Remove Nate from Interns: Does not provide access unless he joins a group with rights.None: A clear, minimal-change fix exists.Common Pitfalls:Granting NTFS write directly to the user rather than using groups; forgetting token refresh after membership changes.Final Answer:Make Nate a member of the Security group

Question 6

Windows 2000 storage optimization: An app writes many small temporary files. You add three 100-GB SCSI disks dedicated to these temp files and want a single drive letter using all 300 GB with the highest write performance. How should you configure t…

Accepted Answer

Introduction / Context:Windows 2000 dynamic disks support several volume types: simple, spanned, striped (RAID 0), mirrored (RAID 1), and RAID-5. For high write throughput with temporary, noncritical data, striping across multiple disks maximizes aggregate bandwidth by parallelizing I/O operations across all spindles.Given Data / Assumptions:Three new 100-GB disks dedicated to temporary files.Goal: one drive letter totaling 300 GB.Priority: fastest writes; data resiliency is not a requirement (temporary files).Concept / Approach:Striped volumes (RAID 0) distribute blocks across disks, improving throughput and IOPS for both sequential and random small-file activity. Spanned volumes aggregate capacity but do not stripe; performance is similar to a single disk. RAID-5 adds parity, improving resiliency but penalizing small writes due to read-modify-write overhead, which is counterproductive for peak write speed on temp data.Step-by-Step Solution:Convert the three disks to dynamic disks.Create a single striped volume (RAID 0) across all three disks.Format with NTFS and assign one drive letter for the 300-GB volume.Point the application’s temp directory to this drive to exploit parallelism.Verification / Alternative check:Benchmark tools (e.g., diskperf) will show higher throughput on striped volumes versus spanned or single-disk volumes, especially with many small writes.Why Other Options Are Wrong:RAID-5: Introduces parity write penalty; not optimal for fastest writes.Mount points (option C): Provide a single namespace but not combined capacity under one drive letter unless using mount points properly; performance is not improved by striping.Spanned volume: Aggregates space without parallel I/O across disks; less performant than RAID 0.None: A correct high-performance option exists.Common Pitfalls:Choosing RAID-5 for temp data; ignoring the lack of fault tolerance in RAID 0 (acceptable here because data is disposable).Final Answer:Convert all three disks to dynamic disks and create a striped volume

Question 7

A Windows 2000 server has five disks; four 100-GB disks currently form a single striped (RAID 0) volume. You want to reconfigure so the volume is fault-tolerant while preserving as much usable space as possible, using only existing hardware. What is…

Accepted Answer

Introduction / Context:RAID-0 (striping) offers performance but no redundancy: a single disk failure destroys the volume. To add fault tolerance while maximizing capacity across four equal-sized disks, RAID-5 (striping with distributed parity) is the typical choice on Windows 2000 dynamic disks, sacrificing the capacity of one disk for parity.Given Data / Assumptions:Four 100-GB disks currently in a non-fault-tolerant stripe.Goal: introduce fault tolerance using existing disks.Also maximize usable space.Concept / Approach:Windows cannot convert a live RAID-0 directly to RAID-5. The supported path is: back up data, delete the RAID-0, create a new RAID-5 across the four disks, restore data. RAID-5 usable capacity = (N − 1) * size = (4 − 1) * 100 GB = 300 GB, providing single-disk fault tolerance. A mirror (RAID-1) would use pairs and yield only 200 GB across four disks (two mirrors), which is less capacity.Step-by-Step Solution:Perform a full backup of the striped volume.Delete the existing RAID-0 volume in Disk Management.Create a new RAID-5 volume spanning the four disks (dynamic disks).Restore the data and validate integrity.Verification / Alternative check:After creation, Disk Management will report a healthy RAID-5 volume with 300 GB usable and parity distributed. Simulate a disk failure (pull one disk in a lab) to verify continued access and rebuild capability.Why Other Options Are Wrong:Option A: Incomplete and does not create fault tolerance.Option C: Mirroring reduces capacity to 200 GB; not “as much as possible.”Option D: Stops short of specifying the new, fault-tolerant configuration.None: A clear, supported approach exists (RAID-5).Common Pitfalls:Expecting in-place conversion; underestimating rebuild time and ensuring verified backups before destructive changes.Final Answer:Back up the data, delete the stripe, create a RAID-5 volume across the four disks, then restore the data

Question 8

Windows 2000 printing with UNIX LPR: Users must print to a high-capacity device attached to a UNIX server (IP 10.1.1.99, LPR queue name ‘‘GIANT’’) via a Windows 2000 Server print server named PrintServ. What configuration enables Windows clients to …

Accepted Answer

Introduction / Context:In mixed Windows–UNIX environments, a common pattern is to expose a UNIX print queue (LPR/LPD) to Windows clients through a centralized Windows print server. Windows 2000 Server can create a local printer that targets an LPR queue and then share that logical printer to clients, providing a consistent share name, driver distribution, and security auditing.Given Data / Assumptions:UNIX host IP: 10.1.1.99, LPR queue name: GIANT.Windows 2000 Server print server: PrintServ.All clients run Windows 2000 Professional using TCP/IP only and should connect using a Windows share.Goal: simple client connection and centralized driver management.Concept / Approach:Use the Windows 2000 TCP/IP Printing (Standard TCP/IP Port) to create an LPR port that points to the UNIX LPD service. Bind a Windows printer object to that port and share it from PrintServ. Clients connect to \PrintServ\ and automatically download drivers, avoiding per-client LPR setup.Step-by-Step Solution:On PrintServ, Add Printer > Local printer > Create a new port: Standard TCP/IP Port.Specify IP 10.1.1.99, choose LPR, enter queue name GIANT.Install the correct Windows driver for the device; set share name and permissions.On clients, connect to \PrintServ\.Verification / Alternative check:Print a test page from a client and confirm it appears in the GIANT queue on the UNIX host. Review PrintServ’s event logs and queue status for errors.Why Other Options Are Wrong:Installing Print Services for Unix on clients or using an LPR URL on clients bypasses centralized driver distribution.Using \16.1.1.99\GIANT is invalid (wrong IP and Windows share syntax for a UNIX LPD queue).‘‘None of the above’’ is incorrect because the local LPR-port printer on PrintServ is the standard method.Common Pitfalls:Forgetting to select LPR (not RAW) on the Standard TCP/IP Port, mistyping the queue name, or not sharing the printer on PrintServ will prevent client connections.Final Answer:Create a local printer on PrintServ and add a Standard TCP/IP LPR port to 10.1.1.99 with queue GIANT; share this printer and have users connect to it

Question 9

Windows 2000 Server with Gateway Service for NetWare cannot reach NetWare 4.0 servers. Which configuration change typically resolves frame-type mismatches on Ethernet?

Accepted Answer

Introduction / Context:In Novell NetWare environments, IPX/SPX networking over Ethernet can use multiple frame types (Ethernet_802.2, Ethernet_II, Ethernet_802.3, Ethernet_SNAP). For Windows 2000's Gateway Service for NetWare (GSNW) and Client Services for NetWare (CSNW) to interoperate with NetWare 4.x servers, the frame type configured on Windows must match what the NetWare servers and routers use on that segment.Given Data / Assumptions:Windows 2000 Server recently added with GSNW cannot connect to NetWare servers.Other Windows and NetWare nodes communicate successfully.Ethernet media is in use; IPX is the transport protocol.Concept / Approach:A frame-type mismatch prevents IPX traffic from being recognized on the wire because Windows may be listening/transmitting on a different IEEE encapsulation. Configuring NWLink IPX/SPX to the correct frame type (or to auto-detect correctly) resolves adjacency and Service Advertising Protocol (SAP) visibility to NetWare servers.Step-by-Step Solution:Open the network adapter's NWLink IPX/SPX properties.Set Frame Type to the value used by NetWare servers (commonly Ethernet_802.2), or enable Auto with correct detection.Ensure the correct internal and external IPX network numbers are set if required.Test access to NetWare servers by browsing or mapping a volume.Verification / Alternative check:Use IPX/SPX diagnostic tools (for example, ipxroute, slist) to verify SAP advertisements from NetWare servers are visible on the Windows host.Why Other Options Are Wrong:NWLink NetBIOS is optional and unrelated to the frame type mismatch.RIP for IPX and SAP Agent are routing/advertisement components; they do not fix a local L2 encapsulation mismatch.‘‘None of above’’ is incorrect because correcting the frame type is the standard fix.Common Pitfalls:Using Auto-detect on multi-frame segments can still fail; explicitly setting the frame type often stabilizes connectivity.Final Answer:Configure NWLink IPX/SPX/NetBIOS Compatible Transport to use the correct Ethernet frame type

Question 10

After adding a second PnP NIC (IRQ 5) to a Windows 2000 print server, printing to a non-PnP LPT2 adapter stops working. How should you ensure the legacy LPT2 IRQ remains available?

Accepted Answer

Introduction / Context:Legacy parallel ports typically use hardware interrupts: LPT1 often uses IRQ 7 and LPT2 often uses IRQ 5. Non-PnP adapters cannot negotiate for interrupts; they simply expect the traditional IRQ. When a new Plug-and-Play NIC consumes the same IRQ as a legacy device, the legacy device appears to ‘‘fail’’ because its interrupts are stolen by the PnP device.Given Data / Assumptions:Second NIC uses IRQ 5.Non-PnP LPT2 historically uses IRQ 5.Printing stops only after installing the second NIC.Concept / Approach:Reserve the conflicting IRQ in BIOS/CMOS for non-PnP/ISA devices so the PnP resource allocator avoids assigning IRQ 5 to the NIC. This preserves IRQ 5 for LPT2. Device Manager changes typically do not apply to non-PnP hardware, and moving LPT2 to IRQ 7 would conflict with LPT1’s conventional assignment.Step-by-Step Solution:Enter BIOS/CMOS setup during boot.Mark IRQ 5 as ‘‘Reserved for ISA/Legacy (non-PnP)’’.Save and reboot so the PnP OS/hardware reassigns the NIC to a different IRQ.Verify that LPT2 interrupts are now functioning and prints complete.Verification / Alternative check:Use Device Manager and hardware diagnostics to confirm the NIC no longer uses IRQ 5 and that the parallel port driver registers its expected IRQ.Why Other Options Are Wrong:Changing LPT1/LPT2 IRQs in Device Manager rarely fixes non-PnP conflicts and can introduce new conflicts.Reserving IRQ 7 addresses LPT1, not LPT2.‘‘None of above’’ is incorrect because reserving IRQ 5 is the targeted fix.Common Pitfalls:Overlooking BIOS ‘‘PnP OS’’ settings and IRQ reservations; always protect legacy resources before adding PnP adapters.Final Answer:Edit the server BIOS/CMOS to reserve IRQ 5 for non-PnP devices

Question 11

IIS 5.0 with host headers: If the Sales web site is stopped, what response will a user receive when requesting the Sales host-header URL?

Accepted Answer

Introduction / Context:Internet Information Services (IIS) 5.0 can run multiple sites on the same IP/port using host headers. When a specific site is stopped, IIS no longer serves content for that host header. Understanding the HTTP status returned in this condition helps troubleshoot user reports and confirms whether the site state, permissions, or content is at fault.Given Data / Assumptions:Two sites exist (HR and Sales) configured with host headers.The Sales site has been stopped for maintenance.Users access by the Sales host name; no alternate bindings exist.Concept / Approach:When IIS receives a request for a host header that maps to a stopped site, IIS cannot route the request to an active application context. Rather than redirecting, IIS returns an error indicating the requested resource cannot be found. In IIS 5, this typically surfaces as HTTP 404 for that host header request, differentiating it from permission errors (403.x) or application errors (500.x).Step-by-Step Solution:User sends HTTP GET to the Sales host header on port 80.IIS evaluates site bindings and finds the matching site is stopped.IIS returns a 404 (resource not found) for that host header, since the site is inactive.When the site is started again, the same URL resolves normally.Verification / Alternative check:Use IIS Manager to confirm site state. Start/stop the site and repeat the request; observe 404 when stopped and 200 OK when running.Why Other Options Are Wrong:IIS does not auto-redirect to another site or an alternate page when a site is stopped.403.2 indicates read access denied on an active site, not a stopped one.Common Pitfalls:Confusing a 404 due to a stopped site with a 404 due to missing files; always check site state first.Final Answer:The user receives a 404 – File Not Found error

Question 12

Windows 2000 print sharing across mixed clients: NT 4.0 workstations should auto-download the correct HP LaserJet 4L driver from a Windows 2000 print server. What should you configure?

Accepted Answer

Introduction / Context:Windows print servers can host multiple platform-specific drivers for a single shared printer so that clients automatically download the correct driver on first connection. This is crucial in mixed environments (Windows 2000 and Windows NT 4.0) to avoid manual driver installation and reduce help-desk load.Given Data / Assumptions:Printer: HP LaserJet 4L shared from Windows 2000 Server.Win2K clients print successfully, NT 4.0 clients prompt for drivers.Goal: NT 4.0 clients should auto-download drivers from the server.Concept / Approach:Use the printer’s Sharing tab > Additional Drivers… to add Windows NT 4.0 (x86) drivers to the server’s driver store for that printer object. When an NT 4.0 client connects, the spooler downloads the matching driver automatically from the server.Step-by-Step Solution:Open printer properties on the Windows 2000 print server.On the Sharing tab, click ‘‘Additional Drivers…’’ and check ‘‘Windows NT 4.0’’ (x86).Provide the NT 4.0 driver files when prompted (from vendor media or CAB).Clients reconnect; the correct driver auto-installs from the server.Verification / Alternative check:Connect from an NT 4.0 workstation; confirm that the server supplies the driver and printing succeeds without manual driver selection.Why Other Options Are Wrong:Copying drivers to NETLOGON or random folders does not integrate them with the printer object for point-and-print.The server’s generic driver directory alone does not trigger client download unless tied to the printer via ‘‘Additional Drivers’’.Common Pitfalls:Installing mismatched PCL/PS variants or different models causes unexpected output; ensure the driver exactly matches the device.Final Answer:On the printer share, install additional drivers for Windows NT 4.0/Windows 2000

Question 13

Windows 2000 spanned volume failure recovery: One disk in a three-disk spanned volume failed and has been replaced. How do you recover the volume and its data from backup most efficiently?

Accepted Answer

Introduction / Context:Windows 2000 spanned volumes provide capacity aggregation but no fault tolerance. If any disk in a spanned set fails, the entire volume becomes unreadable. Recovery relies on replacing failed hardware and restoring from a valid backup. Understanding the correct rebuild procedure avoids wasted steps and speeds restoration.Given Data / Assumptions:Three-disk spanned volume; one disk failed and was replaced.Hot-swap is supported; regular full backups exist.Goal: recover volume and data as soon as possible.Concept / Approach:Because a span lacks redundancy, the logical volume is lost after a member failure. The proper procedure is to recreate the spanned volume layout and then restore data from backup. Attempting to extend or rescan an already broken span does not reconstruct missing blocks. Formatting and restoring ensures a consistent file system.Step-by-Step Solution:Rescan disks so Disk Management detects the replacement drive.Delete the failed spanned volume (it is unusable).Create a new spanned volume across the intended disks with the same or desired size.Format the new volume and run Windows Backup to restore the latest full (and differential/incremental if applicable).Verification / Alternative check:After restore, run chkdsk and validate application data integrity. Compare sizes/hashes for key data sets.Why Other Options Are Wrong:Extending or rescanning does not reconstruct lost span data.Rebooting does not change the fundamental loss condition.Formatting an invalid span without recreating it properly may fail or still leave an inconsistent layout.Common Pitfalls:Believing a span provides protection like RAID; only RAID 1/5/6/10 provide fault tolerance. Always maintain reliable backups for spanned volumes.Final Answer:Rescan disks, delete the failed spanned volume and create a new spanned volume including the new disk; format it, then restore data with Windows Backup

Question 14

A registry tweak on Windows 2000 Server (TCPWindowSize added; a key removed) causes the system to hang before logon. Which recovery option safely restores the previous working control set?

Accepted Answer

Introduction / Context:Windows 2000 maintains multiple registry control sets and records the last configuration that successfully reached the logon screen. If an update to system settings (including registry edits that affect drivers/services or networking) prevents a successful boot, using Last Known Good Configuration can revert to the previously working ControlSet quickly without manual registry surgery.Given Data / Assumptions:Registry was edited (TCPWindowSize added; an unused key removed).System now hangs before the logon UI appears.No file system damage is indicated; the problem is configuration-based.Concept / Approach:LKGC restores the ControlSet that was active on the last successful logon. Because the failure occurs before logon, LKGC still points to the earlier, good configuration and will overwrite the current failed ControlSet with that known-good one. This is faster and safer than Recovery Console for registry-level mistakes.Step-by-Step Solution:Press F8 during boot to open Advanced Options.Choose ‘‘Last Known Good Configuration’’.Allow Windows to boot using the previous ControlSet.After recovery, carefully re-apply needed changes or avoid risky registry edits.Verification / Alternative check:Confirm the system reaches the logon screen and services load normally. Review System event logs for driver/service issues tied to the prior edit.Why Other Options Are Wrong:Safe Mode still uses the current ControlSet and may not undo a bad registry change.FIXBOOT repairs boot sectors, unrelated to registry configuration errors.Changing winlogon service state is irrelevant and risky.Common Pitfalls:Booting once successfully (even briefly) after the bad change will update LKGC; use it immediately after failure.Final Answer:Boot using Last Known Good Configuration (LKGC)

Question 15

Windows 2000 DNS: From a Windows 2000 client, how do you trigger dynamic DNS to recreate the reverse (PTR) record for the host?

Accepted Answer

Introduction / Context:Windows 2000 introduces dynamic DNS updates for both forward (A) and reverse (PTR) records. When a client's IP or name changes—or if DNS records are missing—you can request an immediate re-registration instead of waiting for periodic refresh. This is especially useful after restoring DNS zones or changing DHCP scopes.Given Data / Assumptions:Client is Windows 2000 and participates in dynamic DNS.DNS zones allow secure or non-secure dynamic updates as configured.PTR records need to be recreated on the DNS server.Concept / Approach:Running ipconfig /registerdns on the client forces the DNS Client service to send dynamic update requests for the host's A and PTR records to its configured DNS server. No special server-side command is required beyond permitting updates on the zone.Step-by-Step Solution:Open an elevated command prompt on the Windows 2000 client.Execute: ipconfig /registerdnsWait briefly and verify the forward and reverse records in the DNS MMC or by nslookup/dig.If updates fail, confirm zone settings and client credentials for secure updates.Verification / Alternative check:Use nslookup and nslookup to confirm A and PTR records now resolve correctly. Check the DNS server's event log for update entries.Why Other Options Are Wrong:‘‘ipconfig all /registerdns’’ is not a valid syntax and running it on the server is unnecessary.No ‘‘DNS Dynamic’’ service exists on clients.HOSTS files do not create PTR records in DNS and have no #DYNAMIC directive.Common Pitfalls:Zones set to ‘‘none’’ for dynamic updates will ignore the client's request; ensure ‘‘nonsecure and secure’’ or ‘‘secure only’’ is appropriate for your environment.Final Answer:Run ipconfig /registerdns from the client

Question 16

Active Directory rollback after bad script: To revert AD to yesterday’s state when incorrect changes replicated to all domain controllers, what is the correct authoritative restore procedure?

Accepted Answer

Introduction / Context:When erroneous directory changes replicate to all domain controllers (DCs), a simple non-authoritative restore will be overwritten by newer, bad data. An authoritative restore is required so the restored DC's directory data is treated as the newest and is replicated out to other DCs, effectively rolling back the domain to the prior backup state.Given Data / Assumptions:There are three DCs in the domain.Yesterday's full backup of System State exists for at least one DC.A script made incorrect modifications that have already replicated.Concept / Approach:An authoritative restore consists of: 1) booting into Directory Services Restore Mode (DSRM) so AD is offline, 2) restoring System State (which contains ntds.dit, SYSVOL, registry), and 3) using ntdsutil to mark the restored directory data authoritative (update version numbers/USNs). On reboot, the restored DC's data replicates to the others, undoing the unwanted changes.Step-by-Step Solution:On a chosen DC, press F8 > Directory Services Restore Mode and log on with the DSRM password.Run Windows Backup and restore the previous day's System State.Launch ntdsutil > authoritative restore, and mark the needed objects/containers or entire database authoritative.Restart normally to allow replication to propagate the authoritative data to other DCs.Verification / Alternative check:Inspect event logs for replication status and validate corrected user accounts/attributes. Use repadmin to confirm healthy replication.Why Other Options Are Wrong:Restoring System State and rebooting without marking authoritative results in non-authoritative restore; bad data overwrites the restore.Recovery Console cannot perform AD authoritative restores.Restoring only SYSVOL does not fix AD database contents.Common Pitfalls:Forgetting to restore the correct backup set or not isolating the DC during restore can re-import bad changes; ensure you use DSRM and authoritative flags.Final Answer:Boot one DC into Directory Services Restore Mode, restore System State with Windows Backup, run NTDSUTIL to mark objects authoritative, then restart

Question 17

Branch offices on Windows 2000 Server need automatic notifications when new Microsoft updates (including drivers) are available upon admin logon. What should you install/configure to provide these alerts?

Accepted Answer

Introduction / Context:In the Windows 2000 era, Microsoft provided an optional component called Critical Update Notification to alert administrators when new updates from Microsoft were available. This was a precursor to later services like Automatic Updates and WSUS and could notify at logon so admins in branch offices were prompted to obtain and apply relevant updates.Given Data / Assumptions:Each branch has a Windows 2000 Server but no dedicated network administrator.Admins log on locally and should be notified automatically when new updates exist.Goal: prompt awareness without manual polling of Microsoft sites.Concept / Approach:The Critical Update Notification tool periodically checks Microsoft's update catalog and prompts users at logon or on a schedule when critical updates and certain drivers are available. Installing it on each branch server ensures that local technical staff receive timely prompts to download and apply updates, closing security and reliability gaps.Step-by-Step Solution:Install the Windows Critical Update Notification tool on each branch server.Configure its schedule/behavior so that notifications appear on admin logon.Educate branch staff to follow the prompt to review and install updates.Optionally, later migrate to centralized update services (for example, SUS/WSUS) for enterprise control.Verification / Alternative check:Log on after installation and confirm that update notifications appear when new items are available; check the tool’s configuration for last check time and status.Why Other Options Are Wrong:The Resource Kit contains utilities but does not provide update notifications.System File Checker and Windows File Protection monitor protected system files locally; they do not poll Microsoft for new updates or drivers.Common Pitfalls:Assuming this tool automatically installs updates; it only notifies. Ensure administrative procedures handle testing and deployment appropriately.Final Answer:Install Windows Critical Update Notification

Question 18

Windows 2000 Server high availability on a single subnet: you add a second network adapter to the same IP subnet and want the first adapter to carry all traffic, with the second acting only as a failover so that connectivity continues if the first a…

Accepted Answer

Introduction / Context:In Windows 2000 networking, outbound traffic selection between multiple interfaces on the same Internet Protocol (IP) subnet is controlled by routing metrics (route cost) rather than binding order. The goal here is to keep all production traffic on the primary network adapter while having an automatic fallback on the secondary adapter if the primary goes down, thereby preserving continuous connectivity for a critical file and print server.Given Data / Assumptions:Two network interface cards (NICs) connected to the same IP subnet.Desire: prefer NIC1 for all traffic; use NIC2 only upon NIC1 failure.Operating system: Windows 2000 Server (no native NIC teaming/bonding).Fallback must be automatic; no administrative action during failure.Concept / Approach:The Windows IP stack chooses routes by lowest metric. For two identical default routes, the interface metric (or per-route metric) determines preference: lower metric wins. A true failover design requires either vendor NIC teaming (not part of stock Windows 2000) or a manual metric configuration where NIC1 has a lower metric and NIC2 has a higher metric so that NIC2 is used only if the route via NIC1 disappears. None of the listed options actually implements the correct lower-on-primary/higher-on-secondary metric pairing.Step-by-Step Solution:Identify the required setting: set a lower interface/route metric on the primary NIC and a higher metric on the secondary.Review the options: they either disable the backup, make the primary less preferred (high metric), make the secondary more preferred (low metric), or change binding order which does not govern routing.Conclude that none of the provided choices configures the intended failover behavior.Verification / Alternative check:You can verify by running 'route print' and observing the selected interface. Proper configuration shows two default routes with different metrics; the lower one is chosen. Pull the primary cable to see the route removed and the higher-metric route take over.Why Other Options Are Wrong:Disabled backup: no failover exists.Primary metric = 100: makes the primary less preferred, not more.Secondary metric = 25: makes the backup more preferred, not less.Binding order: affects provider order, not IP route selection.Common Pitfalls:Assuming binding order controls routing; not configuring asymmetric metrics; expecting native teaming in Windows 2000 without vendor drivers.Final Answer:None of the above

Question 19

Providing Internet access with NAT: an L2TP/IPsec VPN from behind your Windows 2000 Network Address Translation (NAT) gateway cannot connect to a remote Windows 2000 host, although L2TP works between two internal computers. What is the most likely r…

Accepted Answer

Introduction / Context:Windows 2000-era Layer 2 Tunneling Protocol (L2TP) relies on IP Security (IPsec) Encapsulating Security Payload (ESP) for confidentiality and integrity. Traditional Network Address Translation (NAT) modifies IP headers and ports, which breaks ESP integrity because ESP protects the payload and has no ports to translate. NAT traversal (NAT-T) was not generally available in initial Windows 2000 deployments.Given Data / Assumptions:Clients are behind a NAT gateway providing Internet access.Attempting L2TP/IPsec to a remote Windows 2000 host fails.L2TP works between internal hosts without NAT in the path.Concept / Approach:IPsec ESP uses protocol number 50 and protects inner headers; classic NAT expects to translate TCP/UDP ports, not ESP. When NAT changes IP addresses, the integrity check value (ICV) fails on the remote end, causing tunnel setup to fail. Without NAT-T encapsulating IPsec in UDP (e.g., UDP/4500), an L2TP/IPsec session through NAT is not feasible in this scenario.Step-by-Step Solution:Recognize that the failure occurs only when NAT is on the path.Recall that IPsec ESP cannot be port-translated; NAT breaks the protected headers.Conclude that NAT-induced packet alteration corrupts the IPsec integrity check, preventing L2TP setup.Remedies include placing the client outside NAT, using PPTP, or enabling NAT-T on supported later platforms.Verification / Alternative check:Packet traces show IKE negotiation attempts followed by failed ESP packets when passing the NAT boundary. Removing NAT or switching to PPTP allows the connection, confirming the cause.Why Other Options Are Wrong:NAT does allow remote networking (e.g., web, PPTP, SSH).L2TP works with Windows 2000 when not behind NAT.“Configure NAT to translate IPsec” is not viable without NAT-T; ESP is not translatable in classic NAT.None: A specific, well-known limitation exists.Common Pitfalls:Confusing L2TP with PPTP (which can pass classic NAT). Assuming any VPN type will survive NAT without NAT-T support.Final Answer:You cannot establish an L2TP connection from behind a NAT gateway because the IPsec packets are altered by NAT and fail integrity checks

Question 20

Active Directory Group Policy precedence: you have delegated administration of the Michigan and Florida OUs, but you want your Default Domain Policy settings to remain authoritative so OU admins cannot override them with conflicting GPOs. What shoul…

Accepted Answer

Introduction / Context:Group Policy Objects (GPOs) apply in the order: Local → Site → Domain → OU (child last). Child GPOs can normally override parent settings, unless the parent link is marked No Override (called Enforced in newer tools). The requirement is to ensure domain-level settings remain effective even when OU administrators create their own GPOs.Given Data / Assumptions:Default Domain Policy holds the authoritative settings.Michigan and Florida OUs have delegated admin rights.You need to prevent overrides of domain policy within those OUs.Concept / Approach:Setting No Override (Enforced) on the domain-linked GPO ensures its settings cannot be superseded by child OU GPOs. Blocking inheritance at the OU would do the opposite (it would block domain policies), which is not desired. Applying No Override at the OU level does not affect parent policies.Step-by-Step Solution:Open Group Policy Management (or AD Users and Computers in Windows 2000 with GPMC add-ons later).Select the domain-level GPO link for Default Domain Policy.Set the link option to No Override (Enforced).Verify Resultant Set of Policy (RSoP) that OU policies cannot override domain settings.Verification / Alternative check:Create a conflicting setting in an OU-level test GPO; RSoP should show the domain enforced setting winning.Why Other Options Are Wrong:OU No Override: Does not protect domain GPOs from being overridden.Block inheritance at domain: Not a valid concept; inheritance blocks are set on child containers.Block inheritance at OUs: Would block the domain policy rather than protect it.None: A definite correct configuration exists.Common Pitfalls:Confusing Block Inheritance with No Override; misplacing the Enforced flag on the wrong link.Final Answer:In the contoso.local domain, set the GPO link option to No Override (Enforced)

Windows 2000 Server Questions

Questions

Practice smarter