CCNA Implement and Manage On-Prem and Hybrid Networking Questions

Multi-Selectmedium

You are troubleshooting a Windows Server DNS environment where stale resource records are not being removed, leading to name resolution errors. Which THREE conditions must be met for DNS scavenging to successfully delete a stale record?

Select 3 answers

A.Scavenging must be enabled at the DNS server level.

B.Scavenging and aging must be enabled at the specific zone level.

C.The record must be a static record with a zero timestamp.

D.The record must have existed past the sum of the No-refresh and Refresh intervals.

E.The DNS server must be a member of the Schema Admins group.

AnswersA, B, D

Even if individual zones are configured for scavenging, the master switch at the DNS server level must be turned on. This setting tells the DNS service to periodically run the scavenging algorithm and check all hosted zones for records that have exceeded their aging and refresh intervals.

Why this answer

DNS scavenging is a multi-step process that requires specific configurations at both the server and zone levels. If any of these components are misconfigured, the scavenging engine will not process the records, leading to an accumulation of outdated data that can interfere with network operations and IP management.

Practice this question →

MCQhard

You need to provide a secure method for on-premises administrators to manage Azure SQL databases without exposing the database to the public internet. You want to ensure that traffic from the on-premises network stays within the private network space. Which solution should you implement?

A.Azure Service Endpoints

B.Azure Private Link with a Private Endpoint

C.Azure Bastion

D.Azure Front Door

AnswerB

Private Link maps a private IP address from your VNet to the Azure SQL instance. By using a VPN or ExpressRoute, on-premises administrators can reach this private IP address directly. This configuration keeps all management traffic off the public internet and within the organization's private address space.

Why this answer

Azure Private Link allows you to access Azure PaaS services over a private endpoint in your virtual network. When combined with a VPN or ExpressRoute, this extends the private connectivity to your on-premises environment. This setup ensures that traffic never traverses the public internet, satisfying strict security and compliance requirements.

Practice this question →

MCQmedium

Refer to the exhibit displaying the status of a DHCP failover relationship. A network administrator notices the 'CommunicationInterrupted' state. What is the immediate impact on DHCP clients that attempt to renew their leases while the server is in this state?

A.Clients cannot renew leases and will lose connectivity immediately.

B.The server will grant new leases for the full scope duration.

C.The server continues to renew leases for the duration of the MCLT.

D.The partner server automatically takes over all active leases.

AnswerC

When communication is interrupted, the server will continue to renew leases for its clients but only for the duration specified by the Max Client Lead Time (MCLT). This safety mechanism ensures clients stay connected while preventing the server from permanently exhausting the IP pool without partner confirmation.

Why this answer

In a DHCP failover configuration, the 'CommunicationInterrupted' state indicates that the two servers can no longer talk to each other. This state is designed to ensure continuity of service. Understanding how the Max Client Lead Time (MCLT) and server roles function during this interruption is critical for maintaining network availability.

Practice this question →

MCQmedium

You are deploying a Windows Server 2022-based Gateway server for a hybrid network. The gateway must perform Network Address Translation (NAT) for a private subnet. Which feature should you enable?

A.DHCP Server role

B.Routing and Remote Access (RRAS)

C.Network Policy Server (NPS)

D.Hyper-V Network Virtualization

AnswerB

RRAS is the Windows Server service that provides NAT, VPN, and traditional routing capabilities. It allows the server to act as a gateway that performs address translation for internal private networks, translating private IP addresses to a public address for outbound traffic, thus providing the required internet access and security.

Why this answer

The Remote Access role in Windows Server 2022 includes the NAT functionality required to route traffic from a private network to a public one. By enabling NAT within the Routing and Remote Access Service (RRAS), the server masks the private IP addresses of the internal clients, allowing them to access the internet through a single public IP address assigned to the gateway's external interface.

Practice this question →

MCQmedium

You are deploying IP Address Management (IPAM) on a Windows Server 2022 instance to manage your hybrid environment. You choose the Group Policy-based provisioning method. Which requirement must be met for the IPAM server to successfully manage the domain controllers and DHCP servers?

A.The IPAM server must be a Domain Controller.

B.The GPOs must be manually linked to each individual server object.

C.Invoke-IpamGpoProvisioning must be run with a unique GPO prefix.

D.The IPAM server must have the Web Server (IIS) role removed.

AnswerC

The PowerShell cmdlet Invoke-IpamGpoProvisioning creates the necessary Group Policy Objects with a specified prefix. This prefix is used by the IPAM server to identify and apply settings to managed servers. This step is essential for establishing the security permissions and firewall exceptions required for centralized IP address management.

Why this answer

IPAM requires specific permissions and firewall rules to collect data from managed servers. When using GPO-based provisioning, the IPAM server uses the GPOs to automate the configuration of these settings across the domain. Without the correct GPO prefix and security filtering, the managed servers will not allow the IPAM server to access their data.

Practice this question →

MCQmedium

An organization uses an on-premises Active Directory Domain Services (AD DS) environment and an Azure subscription. The IT team needs to ensure that on-premises clients can resolve names for resources hosted in an Azure Private DNS zone. Which component should be implemented to facilitate this specific name resolution path without deploying custom DNS servers in Azure?

A.Azure Private Link

B.Azure DNS Private Resolver Inbound Endpoint

C.A standard Azure Public DNS Zone

D.Azure Application Gateway

AnswerB

The Inbound Endpoint acts as a local entry point within an Azure Virtual Network for DNS queries originating from on-premises. By configuring on-premises DNS servers to use this endpoint as a conditional forwarder, clients can seamlessly resolve records stored in Azure Private DNS zones while maintaining centralized management.

Why this answer

Hybrid name resolution requires a bridge between on-premises DNS servers and Azure Private DNS zones. The Azure DNS Private Resolver provides a managed service that allows on-premises DNS queries to be forwarded to an inbound endpoint. This architecture eliminates the need for maintaining custom-built DNS forwarders on virtual machines, improving reliability and simplifying the administrative overhead for hybrid connectivity.

Practice this question →

MCQmedium

You are configuring a Windows Server 2022 instance to act as a router between two subnets. You have enabled IP forwarding, but traffic is not passing between the subnets. Which PowerShell cmdlet should you use to verify if the routing table is correctly identifying the local interface routes?

A.Get-NetIPAddress

B.Test-NetConnection

C.Get-NetRoute

D.Get-NetAdapter

AnswerC

This cmdlet retrieves the current routing table entries. It is the primary tool for verifying that the operating system recognizes the destination subnets and maps them to the appropriate network interfaces. If a route is missing or pointing to the wrong interface, this cmdlet will clearly highlight the discrepancy.

Why this answer

The Get-NetRoute cmdlet is essential for inspecting the IPv4 and IPv6 routing tables on Windows Server. It allows administrators to verify that the destination network is reachable via the correct interface and gateway. Misconfigured routes are a primary cause of packet loss in multi-homed server environments, and this tool provides the granular visibility needed to troubleshoot connectivity issues between internal subnets.

Practice this question →

MCQmedium

You are managing a Windows Server 2022 DNS server. You need to implement DNS policies to ensure that queries for 'www.contoso.com' are resolved to different IP addresses based on the client's subnet. Which DNS policy component should you create first to define the client groupings?

A.DNS Server Zone Scope

B.DNS Server Client Subnet

C.DNS Server Recursion Scope

D.DNS Server Query Resolution Policy

AnswerB

The Client Subnet object defines the IP address ranges for various locations or groups. By creating these objects first, you allow the DNS server to categorize incoming queries based on the source IP address, which is the prerequisite for applying policies that direct users to specific zone scopes.

Why this answer

DNS policies in Windows Server allow for intelligent traffic management by tailoring responses based on various criteria. To achieve location-based or subnet-based resolution, the server must first be able to identify which subnet a client belongs to. This is the foundational step before any resolution logic or policies can be applied.

Practice this question →

Multi-Selecteasy

You are configuring DHCP failover between two Windows Server 2022 nodes named Server1 and Server2 to ensure high availability for a critical subnet. Which TWO failover modes are available for selection during the configuration wizard?

Select 2 answers

A.Load Balance

B.Hot Standby

C.Active-Passive Cluster

D.Split-Scope

E.Distributed Relay

AnswersA, B

Load Balance mode is the default configuration where both DHCP servers actively serve IP addresses to clients on the same subnet. This mode distributes the client load between the two servers based on a configurable percentage, providing both redundancy and performance improvements for high-density networking environments requiring constant availability.

Why this answer

Windows Server DHCP failover provides two distinct modes to ensure that IP address leasing remains operational if one server fails. Choosing the correct mode depends on whether the administrator wants both servers to actively lease addresses simultaneously or have one server remain idle until a failure event occurs within the network environment.

Practice this question →

MCQmedium

You are managing a Windows Server 2022 server that needs to access a storage array on a different subnet. You notice the server is not reaching the storage controller. Which PowerShell command should you use to add a permanent persistent route to the storage network?

A.Add-NetNeighbor

B.New-NetRoute

C.Set-NetIPInterface

D.New-NetIPAddress

AnswerB

New-NetRoute is the correct cmdlet for creating new entries in the routing table. It allows administrators to define the destination subnet and the gateway (next hop) for the traffic. Using the appropriate flags, it ensures the route remains active even after the server is restarted or the network stack resets.

Why this answer

The New-NetRoute cmdlet is the standard PowerShell method to add routes to the Windows routing table. By specifying the -DestinationPrefix and the -NextHop, you instruct the OS on how to route traffic to the storage network. Using the -PolicyStore command ensures that the route is persistent across system reboots, which is critical for storage connectivity stability.

Practice this question →

Multi-Selecthard

You are tasked with securing network traffic in a Windows Server 2022 environment using Windows Firewall with Advanced Security. Which TWO actions are required to allow traffic only from a specific trusted application while blocking all other incoming connections?

Select 2 answers

A.Create an inbound rule that allows connections for the specific application executable.

B.Configure the firewall to drop all outbound traffic by default.

C.Modify the default inbound policy to block all connections.

D.Enable IPsec encryption for the specific application rule.

E.Disable the Windows Firewall and use a third-party appliance.

AnswersA, C

Creating an inbound rule tied to the application executable allows the firewall to whitelist traffic only for that specific process. This provides granular control, ensuring that only the intended service can listen for and receive incoming network requests, effectively shielding the system from unauthorized connection attempts on other ports.

Why this answer

Securing a server involves both positive and negative enforcement. By creating a specific inbound rule for the trusted application, you permit necessary traffic, while a default deny policy ensures that no other unsolicited traffic reaches the server. This combination effectively implements the principle of least privilege, reducing the attack surface by ensuring that only authorized communication flows are allowed through the firewall boundaries.

Practice this question →

MCQmedium

You are monitoring network utilization on a Windows Server 2022 node. You notice consistently high CPU usage when transferring large amounts of data over the network. Which feature can you enable to offload this processing and improve performance?

A.Receive Side Scaling (RSS)

B.Virtual Machine Queue (VMQ)

C.IPsec Task Offloading

D.Network Load Balancing (NLB)

AnswerA

RSS enables the parallel processing of incoming network traffic across multiple CPU cores. By spreading the load, it prevents a single core from becoming a bottleneck during high-volume transfers, effectively improving overall system performance and throughput for data-intensive applications running on the Windows Server host.

Why this answer

Receive Side Scaling (RSS) is a technology that allows the network stack to distribute incoming network traffic processing across multiple CPU cores. By offloading this task, the server can handle higher network throughput without overloading a single core, which is critical for high-traffic servers. This reduces CPU bottlenecks and ensures that the server can scale its networking capabilities to meet increasing demand efficiently.

Practice this question →

MCQmedium

You are managing a hybrid cloud environment and need to connect an on-premises Windows Server 2022 to an Azure Virtual Network. Which service should you implement to provide a secure, persistent, and encrypted tunnel over the public internet?

A.Azure ExpressRoute

B.Azure Site-to-Site VPN

C.Remote Access Server (RAS) Gateway

D.Azure Point-to-Site VPN

AnswerB

This service creates an IPsec/IKE VPN tunnel between your on-premises VPN gateway and an Azure Virtual Network gateway. It is designed specifically for persistent, secure connectivity over the public internet, making it the ideal choice for hybrid networking when a private fiber connection is not required or available.

Why this answer

A Site-to-Site VPN is the standard solution for connecting on-premises infrastructure to Azure over the internet using an IPsec/IKE tunnel. It provides a secure, encrypted path for traffic, ensuring that data moving between the local data center and the cloud remains protected. This is the most common deployment scenario for hybrid connectivity where a dedicated line like ExpressRoute is not financially feasible.

Practice this question →