Chapter 5-8 Knowledge Assessment

Lesson 5 Configuring Routing and Remote Access (RRAS) and Wireless Networking
Learning Objectives
Students will learn to: Configure routing Configure remote access Configure wireless access

Certification Skill Number

Configure routing Configure remote access Configure wireless access 1.3 3.1 3.4

Lesson Summary Lecture Notes

Begin this lesson with an overview of layer one, two, and three and the associated devices. This should lead into an overview of routing and what it is. List the different routing protocols, and explain the differences in each. Provide different examples of routing. Demonstrate the process involved in configuring routing on Windows Server 2008. Provide a detailed explanation of routing tables. Demonstrate how to read a routing table and decipher all of the information presented. Discuss the route command-line utility, and provide examples of its various options. Explain Demand-Dial routing. Explain why remote access is so important to a network. Provide a brief overview of DUN and VPN remote access methods. Demonstrate how to set up Dial Up Remote Access.

Chapter 5-8 Knowledge Assessment Lead a detailed discussion about VPN, the different types of VPNs, and the components necessary to a successful VPN implementation. Explain the concept of NAT, and step through the NAT process. Provide an overview of NPS, and demonstrate how to configure NPS policies. List the different authentication protocols available, and discuss when you can appropriately use each one. Begin a discussion on wireless networking. Explain the different components involved in a secure wireless network implementation. Step through the secure wireless process.

Key Terms
authenticator supplicants. 802.1X component that requests authentication credentials from 802.1X component that verifies the supplicants

Authorization Server (AS) authentication credentials. bits

Binary sequences of 0s and 1s used to encode traffic onto physical network media.

default route Routing table entry that indicates the route that will be used if no other defined routes match a particular destination. Dial-Up Networking (DUN) Creates a physical connection to a remote network by using a dial-up device such, as a POTS modem or a demand-dial ISDN modem. directly attached network routes in question is directly attached. Routes to destination networks for which the router

EAP-Logoff 802.1X packet sent from a supplicant to an authenticator, instructing the supplicant to place the port back in an unauthenticated state. frames Data at Layer 2 of the OSI model (the Data Link Layer) is organized into frames for processing by higher levels of the OSI model. host routes Routing table entry that defines a route to a particular destination host rather than a destination network. hub Network device that operates at the Physical Layer (Layer 1) of the OSI model. See router. Layer 3 device

limited broadcast address Reserved IP address (255.255.255.255) used as the broadcast address for all networks and routers. loopback address testing. Reserved IP address (127.0.0.1) used for troubleshooting and

metric Column in a routing table that indicates the cost of using one route instead of another.

Chapter 5-8 Knowledge Assessment network access control Standard for allowing or disallowing network access based on administrator-specified criteria. Network Policy Server (NPS) Windows Server 2008 implementation of RADIUS. Open Shortest Path First (OSPF) Routing protocol in which individual routers maintain a database of all reachable networks that it is aware of and share this database with neighboring routers. packets Data at Layer 3 of the OSI model (the Network Layer) is organized into packets for transmission to local or remote networks. Physical Layer Layer 1 of the OSI model, where bits of data interface with the physical network media. remote network routes not directly attached to. router Routes to destination networks that the router in question is

Layer 3 network device that transmits data between local and remote networks.

routing protocols Used in lieu of static routes in more complex network environments to simplify the administration of network routing. Set by Caller Callback option that allows the user to specify the callback number at the time the connection is made. software-based router Router running on a computer running an operating system, such as Windows Server 2008, that can also be used for other functions. Strongest Encryption (MPPE 128-bit) 128-bit encryption used for VPN connections. supplicant 802.1X device that is seeking access to the network, such as a laptop attempting to access a wireless access point. switch Layer 2 network device that examines the source and destination MAC address of the network data to determine where the data should be sent. Virtual Private Network (VPN) Creates a secured logical connection to a remote network over a non-secure network, such as the Internet. Knowledge Assessment Matching
Match the term in Column 1 to its description in Column 2.

1. 2. 3. 4.

Column 1 This type of router is well-suited for a small organization with low levels of network traffic utilization. __i__ Network data at the Data Link Layer is organized into these. __b__ This is used as the Windows Server 2008 implementation of a RADIUS server. __f__ This routing protocol was supported in Windows Server 2003 but is no longer available with the Routing and Remote Access server role in Windows Server 2008. __g__

Chapter 5-8 Knowledge Assessment

5. This address corresponds to the 127.0.0.1 address used for TCP/IP diagnostics and troubleshooting. __d__ 6. This is the 802.1X component that sends an EAP-Request message to any clients attempting to gain network access. __a__ 7. Network hubs operate at this layer of the OSI model. __h__ 8. This is the strongest level of encryption that you can configure as part of an NPS Network Policy setting. __j__ 9. This is another term to describe a network router. __c__ 10.802.1X is used to configure this for both wired and wireless network connections. __e__
Column 2 a. authenticator

b. frames c. Layer 3 device d. loopback address e. network access control f. Network Policy Server (NPS) g. Open Shortest Path First (OSPF) h. Physical Layer i. software-based router j. Strongest Encryption (MPPE 128-bit)

Multiple Choice
Select all answers that apply for the following questions.

1.

The IP address 255.255.255.255 represents ___________ in the IP Routing table. a. Loopback address b. Limited broadcast address c. Directly-attached network route d. Default route
The limited broadcast address is configured on all networks and routers using the 255.255.255.255 route.

2.

To allow users to specify a call-back number when they connect to a remote access server via modem, you will enable the following setting: a. No Callback b. Set by Caller c. Always Callback To d. Verify Caller ID
The Set by Caller callback ID will allow each user to specify a callback number for the RRAS server, which can be useful in situations in which remote users travel from one location to another.

Chapter 5-8 Knowledge Assessment

3. Routing Information Protocol v2 (RIPv2) is an example of a: a. Routing table b. Routing prompt c. Routing chart d. Routing protocol
RIPv2 is a routing protocol similar to RIP and OSPF.

4.

Windows Server 2008 can provide remote access services through a Virtual Private Network (VPN) or through: a. Dial-Up Networking (DUN) b. Remote Callback c. Demand-Dial Routing d. X.25
Windows Server 2008 can provide remote access connectivity using either VPN or DialUp Networking technologies.

5.

When a workstation ends a session with an 802.1X-secured network port, it sends the following to inform the network access server to set the port back to an Unauthorized status: a. EAP-Inform b. EAP-Discover c. EAP-Logoff d. EAP-Request
EAP-Logoff places the port in the unauthorized state, which is the same state that an 802.1X port is set to when a new supplicant is detected so that only 802.1X traffic can be passed.

6.

If an IP Routing Table contains two routes to the same destination network, the route with the lowest __________ will be selected first. a. Weight b. Metric c. GUID d. Priority
IP routing uses routing metrics to determine which route should be used if multiple routes exist to the same location. If the lower-metric route is not available, the router will fall back to one with a higher metric.

7.

Network information at the Network Layer of the OSI model is organized into: a. Bits b. Frames c. Datagrams d. Packets
Information at the Network Layer of the OSI model is organized into packets.

Chapter 5-8 Knowledge Assessment

8. In an 802.1X infrastructure, an NPS or RADIUS server performs the role of the: a. Applicant b. Supplicant c. Authorization Server (AS) d. Authenticator
An NPS or RADIUS server acts as an Authentication Server (AS); the wireless access point (WAP) serves as an authenticator.

9.

The following RRAS service allows multiple computers on an internal network to share a single public IP address to access the Internet: a. Network Access Control b. Network Address Translation (NAT) c. Network Access Protection d. Network Address Control
Network Address Translation (NAT) has prolonged the useful lifespan of IPv4 by conserving the number of remaining IPv4 IP addresses that are available.

10. The following route is used by a computers default gateway to send traffic to remote networks: a. Default route b. Limited broadcast address c. Broadcast address d. Default interface
The default route is used when no more specific route is available to a given destination network.

Chapter 5-8 Knowledge Assessment

Lesson 6 Configuring File Services

Learning Objectives
Students will learn to: Configure a file server Use the Distributed File System

Certification Skill Number

Configure a file server Configure Distributed File System (DFS) 4.1 4.2

Lesson Summary Lecture Notes

Begin this lesson with a discussion about the points you should consider when planning a file server deployment. Discuss the storage limitation of Windows Server 2008. Explain the considerations for adding new storage to a Windows Server 2008 machine. Discuss different disk and volume types, listing the advantages and disadvantages of each. Talk about the advantages of using the Disk Management snap-in. List its capabilities and limitations. Lead a detailed discussion about creating a file-sharing strategy. Demonstrate the process involved in creating a file share. This should lead into a discussion on file permissions and how to configure them. Make sure and stress the difference between share permissions and NTFS permissions. Demonstrate how to set share permissions. List and discuss all of the role services associated with the File Services role. Place special emphasis on discussion of the server service. Explain DFS, and discuss its benefits. Explain the different components of DFS and how to configure it. Show the process of creating a DFS namespace and adding folders to it.

Chapter 5-8 Knowledge Assessment Discuss DFS replication and how it works.

Key Terms
client failback DFS feature that allows clients to be referred to alternate servers if one server is not available and then be referred back to the most appropriate server when it comes back online. Distributed File System (DFS) Windows Server 2008 role that allows for a unified file namespace across multiple physical servers, as well as file replication between servers. extended partition Partition that can host data, but not the computer operating system. full mesh topology Replication model in which each member server replicates data with every other member server. hub/spoke topology Replication model in which a small number of central servers maintain connections with remote servers, but remote servers do not replicate directly with one another. member Single server within a DFS replication group. multiple master replication Replication model that can accept data writes from multiple servers, not just a single primary server. namespace Virtual view of shared folders on different servers as provided by the Distributed File System service. namespace server namespace. primary partition referral Remote Differential Compression (RDC) Windows Server 2008. replication group Replication protocol used by DFS in DFS server that stores the configuration of a particular DFS Partition that can host the computers operating system.

Collection of DFS servers that replicate data between each other.

Server service Windows service that allows computers to share files with other network users and computers. single master replication single primary server. targets Replication model that can only accept data writes from a

Physical servers that host data represented within a DFS namespace.

Chapter 5-8 Knowledge Assessment

Knowledge Assessment Fill in the Blank

Complete the following sentences by writing the correct word or words in the blanks provided.

1. The DFS Replication engine uses a form of replication called _multiple master replication_. 2. In the Distributed File System, the actual shared folders referred to by the virtual folders in the namespace are known as _targets_. 3. DFS Replication relies on a protocol called _Remote Differential Compression (RDC)_ for file replication. 4. A DFS replication topology in which every server replicates with every other server is called a(n) _full mesh_ topology. 5. The basic file-sharing capabilities of a Windows server are provided by the _Server_ service. 6. To keep a DFS folders multiple targets synchronized, you must create a(n) _replication group_. 7. The __Distributed File Service (DFS)__ allows you to simplify the view of file shares located across multiple servers as they appear to your user base. 8. A(n) __primary partition__ appears to the operating system as though it is a physically separate disk and can host an operating system 9. A(n) __hub/spoke topology__ enables you to limit DFS replication traffic to specific pairs of members. 10. A DFS __namespace__ enables you to create a single directory tree that contains references to shared folders located on multiple separate file servers.

Multiple Choice
Select all answers that apply for the following questions.

1.

An alternative to the multimaster replication model used in DFS is: a. b. c. d. Unilateral replication Single master replication Flat namespace replication Hierarchical namespace replication

In a single master replication model, only one data source is writeable, and this data source replicates information to multiple read-only copies.

2.

A server in a replication group is referred to as a: a. Namespace b. Namespace server c. Member d. Root target

Chapter 5-8 Knowledge Assessment

Client failback allows workstations to revert back to a local DFS member server if the local server has become unavailable and the client has switched over to a remote server to obtain DFS information.

3.

This refers to the ability of DFS clients to revert back to folder targets that have been unavailable due to server or network outages. a. b. c. d. Client failback Server failback Namespace failback Target failback

Each replication group can have multiple members, each of which will replicate information to one another.

4. A disk partition that can hold data but not an operating system is called a(n): a. Primary partition b. Boot partition c. System partition d. Extended partition
A primary partition can hold both data and a Windows operating system; an extended partition can hold only data.

5.

This DFS component is responsible for maintaining a list of DFS shared folders and responding to user requests for those folders. a. Folder target b. Member server c. Namespace server d. Root server
The DFS namespace server forwards user access requests to the server that actually stores the data.

6.

A DFS __________ contains a virtual representation of the shared folders on all DFS target servers. a. Directory b. Namespace c. Target d. Member
A DFS namespace is stored in the Active Directory database in the case of a domainbased namespace or in the local registry in the case of a standalone namespace.

7.

The Distributed File System uses the following replication model to keep servers in a replication group up to date: a. Multiple Master Replication b. Single Master Replication

Chapter 5-8 Knowledge Assessment c. Root Master Replication d. Distributed Master Replication
The multiple master replication model allows file writes to originate from any member of the DFS namespace.

8.

In this topology, every member of a DFS replication group replicates with every other member, for full replication connectivity. a. Hub and spoke replication b. Complete replication c. Direct replication d. Full mesh replication
In a full mesh replication topology, every DFS member replicates with every other member, which creates n * (n-1) replication connections.

9.

The following service is required on a Windows Server 2008 server in order to enable file sharing: a. Workstation Service b. SMB Service c. IIS Service d. Server Service
The Server service is enabled by default on all Windows Server 2008 computers.

10. To enable replication for a DFS folder with multiple folder targets, you must create the following: a. b. c. d. Replication group Replication target Replication folders Replication servers
A replication group is a collection of servers, each of which contains a target for a particular DFS folder.

Chapter 5-8 Knowledge Assessment

Lesson 7 Configuring Print Services

Learning Objectives
Students will learn to: Deploy a print server

Certification Skill Number

Configure and monitor print services 4.6

Lesson Summary Lecture Notes

Begin by explaining the four main components of Windows printing. Stress the differences in each. Explain the EMS and XPS printing format. Explain the intricacies of using a network-attached printing device. Discuss printing sharing. Show the process involved in sharing a printer. Show how to assign and modify permissions on a printer. Explain the capabilities that specific printing permissions allow and restrict. List the different document management functions that can be performed and what they do. Step through the processes of setting printer priority, configuring a printer schedule, and setting up a printer pool. Explain the role services associate with the Print Services role. List the advantages of using the print management console. Demonstrate how to add a print server to the print management console. Demonstrate how to create a custom filter in the print management console. Discuss printer deployment via Group Policy, and demonstrate how to perform this process.

Chapter 5-8 Knowledge Assessment

Key Terms
custom filters the console. Contains views of all of the printers hosted by the print servers listed in

Enhanced Metafile (EMF) Default print format used by Windows 2000, Windows XP, and Windows Server 2003. Everyone Special identity group that includes all users of a Windows computer, including anonymous users. Internet Printing Protocol (IPP) printers via an IIS server. local print device Protocol that allows users to send print jobs to

Print device that is directly attached to a physical computer.

locally attached print device Print device that is directly attached to a physical computer, such as through a parallel port or USB port. Manage Documents documents. Printer permission that allows users to manage all users

Manage Printers Printer permission that allows users to manage user documents as well as manage the configuration of printers. network interface print device Network (LAN). network-attached print devices network. Print print device print media. Print device that is connected directly to a Local Area Print device that is connected directly to a TCP/IP

Printer permission that allows users to print and manage their own documents. Printer hardware that produces hard copy documents on paper or other

print server Device that receives print jobs from clients and sends them to print devices that are either locally attached or connected to the network. printer device. Software interface through which a computer communicates with a print

printer driver Piece of software that converts the print jobs generated by applications into an appropriate string of commands for a specific print device. printer pool Single logical printer connected to multiple physical printers to increase the output of the logical printer. XML Paper Specification (XPS) Vista and Windows Server 2008. New, XML-based print format used by Windows

Chapter 5-8 Knowledge Assessment Knowledge Assessment Fill in the Blank

Complete the following sentences by writing the correct word or words in the blanks provided. 1. A(n) _printer_ is the software interface through which a computer communicates with a print device. 2. When you connect a single print server to multiple print devices, you create what is called a(n) _printer pool_. 3. By default, all printers assign the Allow Print permission to the _Everyone_ special identity, which enables all users to access the printer and manage their own documents. 4. Users with the _Manage Printers_ permission can go beyond just manipulating queued documents; they can reconfigure the printer itself. 5. The __Enhanced Metafile Format (EMF)__ is the default print format used by the Windows 2000, Windows XP, and Windows Server 2003 operating systems. 6. A(n) __printer driver__ is a device driver that converts the print jobs generated by applications into an appropriate string of commands for a specific print device. 7. The __Internet Printing Protocol (IPP)__ allows clients to print documents using HTTP traffic over an intranet or the World Wide Web. 8. Users with the __Print__ permission to a printer have the ability to pause, resume, restart, and cancel their own documents, but not documents created by any other user. 9. A(n) __locally attached print device__ print architecture consists of one print device connected to one computer. 10. __Custom filters__ such as Printer Not Ready are a useful way for administrators to determine what printers need attention throughout a Windows Server 2008 network.

Multiple Choice
Select all answers that apply for the following questions. 1. Which printer permission allows users to pause, resume, restart and cancel all users' documents, and to control job settings for all documents? a. c. Print Manage Printers b. Manage Documents d. Full Control The Manage Printers permission also allows users to share printers, delete printers, and modify printer properties. 2. What document format is a new, platform-independent format included with Windows Vista and Windows Server 2008? a. b. c. d. XML Paper Specification (XPS) Rich Text Format (RTF) Extensible Markup Language (XML) Directory Services Markup Language (DSML)

In XPS, print job files use a single format rather than being converted from EMF to PCL.

Chapter 5-8 Knowledge Assessment

3. What kind of device receives print jobs from clients and sends them to either locallyattached or network-attached printer devices? a. c. Print device Print server b. Print queue d. Print driver A print server can be either a computer or a standalone device. 4. What kind of print device is connected to a TCP/IP network, either directly or through another computer? a. b. c. d. Print server Local print device Network-attached print device Print queue

When printing to a network-attached print device, print jobs are spooled on the print server rather than being sent straight to the physical printer. 5. What can you create to connect a single print server to multiple print devices? a. c. Print server Network printer b. Print queue d. Printer pool Creating a printer pool can increase the printing capacity of a single print server by allowing the server to submit jobs to multiple physical printers. 6. What permission allows a user to share a printer, delete a printer, and change a printer's properties? a. c. Print Manage Printers b. Manage Documents d. Read Printers Unlike the Manage Documents permission, the Manage Printers permission also implicitly includes the Print permission. 7. What kind of printer is directly attached to a single computer, regardless of the interface it uses to connect? a. c. Network-attached printer Serial printer b. Local printer d. Parallel printer A local printer can be attached to a computer via any local port such as a parallel port, USB port, or a FireWire port. 8. What protocol allows users to print documents through an IIS server? a. HTTP b. HTTPS

Chapter 5-8 Knowledge Assessment

c. FireWire

d. IPP The Internet Printing Protocol (IPP) allows users to submit print jobs via a Web browser using an IIS Web server. 9. What describes the actual hardware that produces hard copy documents on paper or other print media? a. c. Print queue Print server b. Print device d. Printer pool The print device corresponds to the physical printer that is either network attached or locally attached to an individual workstation or server. 10. What permission allows users to pause, manage and cancel only those printer documents that they have created? a. c. Manage Printers Print b. Manage Documents d. Full Control The Print permission is the minimum permission required to send documents to a Windows printer.

Chapter 5-8 Knowledge Assessment

Lesson 8 Maintaining and Updating Windows Server 2008

Learning Objectives
Students will learn to: Use the Performance Monitor Use the Windows Event Viewer Use Network Monitor to gather network data Configure Windows Server Update Services (WSUS)

Certification Skill Number

Configure Windows Server Update Services server settings Capture performance data Monitor event logs Gather network data 5.1 5.2 5.3 5.4

Lesson Summary Lecture Notes

Open this lesson by discussing the Reliability and Performance Monitor. Discuss the Performance Monitor. Show how to access it and use its full functionality. Explain data collector sets and how to work with them. Show the Windows Event Viewer. List the different types of event logs and what type of events can be found in each one. Explain the usefulness of Network Monitor. Demonstrate how to use it to gather network data. Define WSUS and how it is beneficial to a network. List its different components and requirements. Step through the process of installing WSUS. List the important WSUS management activities, and demonstrate how to do these. Explain considerations involved in managing WSUS clients.

Lesson 6

Key Terms
Administrative Events Built-in custom view in the Windows Server 2008 Event Viewer that collects Critical, Error, and Warning events from all logs on the server. Automatic Updates Enables you to obtain critical software updates by automatically interacting with the Windows Update Web site. Background Intelligent Transfer Service (BITS) downloads by using idle network bandwidth. Windows service that optimizes network

Capture Filter Feature of Network Monitor that will capture only the specific network traffic that you specify. collector initiated Subscription in which the destination computer polls the source computers to pull the relevant information. configuration information Specific configuration data used to determine how a server is configured and whether changes to that configuration are affecting its performance. Content Synchronization Service Server-side component on your organizations intranet that retrieves the latest critical updates from the Windows Update Web site. Data Collector Set Configuration item that allows you to organize a set of performance counters, event traces, and system configuration data into a single object that you can reuse on one or more Windows Server 2008 servers. Display Filter Feature of Network Monitor that will display only the specific network traffic that you specify. event trace data Data is collected over time to provide a real-time view into the behavior and performance of the server operating systems and any applications that it is running. perfmon CLI command used to launch the Performance Monitor MMC snap-in. performance counters Specific processes or events that you want to track within the Reliability and Performance Monitor. Performance Log Users Security group that has all the rights of the Performance Monitor Users group, plus the ability to create and modify data collector sets. Performance Monitor View that provides a visual display of performance counters within Reliability and Performance data. Performance Monitor Users Security group that allows users to view real-time and historical performance and reliability data. promiscuous mode Version of Network Monitor that can capture 100 percent of the network traffic available to the network interface. Reliability and Performance Monitor Tool located within the Administrative Tools folder that combines features that had previously been spread across a number of tools: Performance Logs and Alerts, Server Performance Advisor, and System Monitor.

6-18

Lesson 6

Reliability Monitor View within Reliability and Performance Monitor that provides information about system events that can affect a servers stability. Resource View Default view within Reliability and Performance Monitor. source computer initiated Subscription in which each source computer must be configured to push the relevant information to the server that has been configured as the repository. Windows Event Collector Service Allows you to configure a single server as a repository of Event Viewer information for multiple computers. Windows Server Update Services (WSUS) Windows service that allows you to centralize the management of critical software updates on a Windows network. WS-Management protocol Protocol used by the Windows Event Collector Service to manage subscriptions and forwarded events.

Knowledge Assessment Matching

Match the term in Column 1 to its description in Column 2.

1. 2. 3. 4. 5. 6. 7. 8.
9.

Column 1 __d__ This controls what types of traffic will be recorded by Network Monitor when you press F10. h__ This right must be granted to Performance Log Users to allow them to create and manage Data Collector Sets. a__ This custom view in the Event Viewer collects Critical, Error, and Warning events from all logs on a particular server. __j__ This capture mode enables Network Monitor to listen to all traffic that is being passed on a particular network segment. __c__ This service is used by WSUS to optimize network traffic while downloading updates. __e__ This type of forwarded event is initiated by the server acting as the event repository. __i__ This is the command-line method of launching the Performance Monitor MMC snap-in. __b__ This log provides a view of events related to software that has been installed on a Windows server computer.
__g__ This is collected to provide a real-time view into the behavior and performance of a server and its applications.

10. __f__ This allows you to organize a set of performance counters, event traces, and system configuration data into a single reusable configuration item. Column 2 a. Administrative Events b. Application Log c. Background Intelligent Transfer Service (BITS)
6-19

Lesson 6

d. Capture Filter e. collector initiated f. Data Collector Set g. event trace data h. Log on as a batch user i. j. perfmon promiscuous mode

Multiple Choice
Select all answers that apply for the following questions.

1. This feature will automatically check for software updates that are published on a WSUS server. a. b. c. d. Windows Update Automatic Updates Windows Catalog Automatic Patching

Automatic Updates runs on desktops and servers and can be set up to check for updates from the Windows Update Web site or a WSUS server.

2. This view of the Windows Event Viewer allows you to configure a Windows Server 2008 computer to act as a repository for Event Viewer entries from one or more remote computers. a. WSUS b. Windows Catalog c. Network Monitor d. Forwarded Events
Forwarded Events is a new feature in Windows Server 2008 and Windows Vista.

3. The following user group can view both real-time and historical data within the Performance Monitor console, but cannot create or modify Data Collector Sets: a. Performance Monitor Users b. Performance Log Users c. Power Users d. Users
Members of the Performance Monitor Users group can view real-time and historical data within the Performance Monitor console and can use the Reliability Monitor

4. In order to collect events from remote computers that match the criteria of one or more event filters that you define, you will create one or more of the following: a. Custom View b. Subscription c. Forwarded Event d. Event Viewer
Subscriptions are created and managed by the Event Collector Service.

5. What protocol does the Windows Event Viewer use to configure event forwarding?
6-20

Lesson 6

a. ARP b. RPC over IP c. WS-DirectoryServices d. WS-Management

The WS-Management protocol is used to communicate with remote computers and transfer event log information from an event source to the local event log service.

6. This is a new Event Log in Windows Server 2008, used to capture information regarding operating system and application installations and un-installations. a. Application Log b. System Log c. Setup Log d. Administrative Events
The Setup log records events associated with server installation, adding and removing server roles, installing applications, and so on.

7. The following service allows you to configure a single server as a repository of Event Viewer information for multiple computers: a. Windows Server Update Service b. Windows Event Collector Service c. Windows Event Viewer d. Windows Event Forwarder
The Event Collector Service creates and manages subscriptions used by Event Forwarding.

8. The following allows you to display only those packets matching a particular set of criterion among a larger set of packets that have been captured by Network Monitor: a. Capture Filter b. Event Filter c. Custom View d. Display Filter
A Display Filter will show the user a subset of those records that have been captured by Network Monitor. This is unlike a Capture Filter, which will actually restrict the amount of data that was captured to begin with.

9. The following user group can view both real-time and historical data within the Performance Monitor console, and can also create and modify Data Collector Sets: a. Performance Monitor Users b. Performance Log Users c. Power Users d. Users
Performance Log Users must be assigned the Log on as a batch user right in order to create and modify Data Collector Sets.

6-21

Lesson 6

10. The following is a server-side component within WSUS that retrieves the latest critical updates from the Windows Update Web site: a. Content Synchronization Service b. Microsoft Update c. Performance Monitor d. Event Forwarder
As new updates are added to Windows Update, the WSUS server automatically downloads them using the Content Synchronization Service.

6-22