Module Assessment

1.

An administrator plans to add an attribute to the schema in the sales domain only, leaving other domains in the contoso.com forest unchanged. How should you respond?

Proceed, because schema changes made on any domain controller stay local until you choose to replicate them.

Proceed, because each domain in a forest has its own schema that you change independently.

Explain that there's one schema per forest; the change would affect every domain and must be made on the schema master.

2.

You must inspect the schema on the correct server without assuming the forest-root distinguished name. Which approach is safest?

Read RootDSE for schemaNamingContext, get the schema master from Get-ADForest, and target that server with -Server.

Build the schema distinguished name from the current user's domain and query the nearest domain controller.

Connect ADSI Edit to the schema and edit values to confirm they're writable.

3.

An application must find person-category objects in a large directory. Why can filtering on objectCategory=person be more efficient than filtering only on objectClass=person?

Because objectCategory is a multivalued inheritance chain that expands the search automatically.

Because objectCategory is single-valued and commonly indexed, making the category search more efficient than filtering the multivalued objectClass.

Because objectCategory changes objectClassCategory on the class definition to reduce matches.

4.

A vendor's schema extension reuses another product's object identifier (OID) arc to save registration effort. What is the correct assessment?

Acceptable, because lDAPDisplayName uniqueness is all that AD DS enforces.

Acceptable, because OIDs are advisory and only GUIDs must be unique.

Reject it; extensions must use a registered enterprise OID arc with a central allocation record, and must not reuse another organization's arc.

5.

A team wants to mark a new attribute confidential so that only authorized staff can read it, and they describe this as encrypting the value. How should you correct them?

The confidential searchFlags bit encrypts the attribute at rest, so no further controls are needed.

The confidential bit adds an authorization check but isn't encryption; combine it with proper ACLs, and keep true secrets out of the directory.

Add the attribute to the RODC filtered attribute set instead, which encrypts it on all domain controllers.

6.

Creating a new object type succeeds on the schema master but fails on a second domain controller with a schema-related error. Both report the same objectVersion. What is the best first conclusion?

The definition likely hasn't fully replicated or the second server's schema cache is stale; verify the object's replication metadata and let convergence complete before escalating.

The schema is corrupt on the second domain controller and must be rolled back by restoring that server.

Delete the new definition and recreate it with a new OID to force replication.

Check your knowledge

Feedback