This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
A writable domain controller fails, but two healthy writable replication partners remain. Which action is normally least disruptive?
Rebuild the failed server, clean stale metadata if necessary, then promote it as a new domain controller.
Restore every domain controller from the newest snapshot.
Start forest recovery.
Which backup is the strongest last-known-safe candidate after suspected privileged compromise?
The newest backup, regardless of incident timing.
A tested writable-domain-controller backup taken before the earliest plausible compromise, supported by health, replication, catalog, key, and change evidence.
A recent read-only domain controller backup.
During forest recovery, what is the correct SYSVOL authority design for each recovered domain?
Make every restored domain controller nonauthoritative.
Make every restored domain controller authoritative.
Make the first restored writable domain controller authoritative, then synchronize later domain controllers nonauthoritatively or promote them cleanly.
A child domain has widespread object corruption. Schema and configuration partitions remain trustworthy. Healthy forest-root services remain available. What should responders do first?
Evaluate a domain-scoped recovery with isolation, trusted backup selection, DNS, and trust dependency controls.
Always recover the entire forest.
Reconnect the affected domain controllers and wait for convergence.
Which operations master action is valid on the selected first writable domain controller in a domain other than the Active Directory root domain?
Seize all five roles, including Schema Master and Domain Naming Master.
Seize the PDC Emulator, RID Master, and Infrastructure Master roles for that domain.
Transfer roles back immediately to former holders.
A snapshot containing a suspended virtualized domain controller is restored on a supported VM-Generation ID hypervisor. What special action can be required?
Disable VM-Generation ID.
Restore the same snapshot to a second connected virtual machine.
Restart Active Directory Domain Services to trigger a new RID pool request, then validate invocation identity and replication.
What does successful forest recovery prove after identity compromise?
The directory has a selected trusted state, but attacker eviction and persistence remediation still require separate evidence.
Resetting the forest-root krbtgt account removes every attacker foothold.
All certificates, federation systems, endpoints, and backup infrastructure are trusted automatically.
Which validation result is sufficient to reconnect recovered identity services?
A successful server boot.
Passing replication, SYSVOL, DNS, time, authentication, security, trust, application, and incident gates with obsolete controllers blocked.
One successful user sign-in.
You must answer all questions before checking your work.
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?