Implement and Manage On-Prem and Hybrid Networking practice questions

Install the Hyper-V role on the Network Controller virtual machine.

Why wrong: The Network Controller is a management component that communicates with Hyper-V hosts, but it does not need to run the Hyper-V role itself. Installing unnecessary roles increases the attack surface and introduces potential resource contention on the management plane, which can degrade the performance of the SDN control plane.

Configure an iSCSI target for the Controller's virtual disk storage.

Why wrong: While storage is necessary for any virtual machine, an iSCSI target is not a specific prerequisite for the Network Controller deployment process. The controller relies on local storage or standard cluster-shared volumes, and requiring dedicated iSCSI targets adds unnecessary complexity that does not influence the SDN functional requirements.

Disable IPsec on all nodes managed by the Network Controller.

Why wrong: Disabling IPsec is a security risk and is not a requirement for SDN. The SDN infrastructure is designed to operate within secured environments. Removing encryption protocols like IPsec would leave management traffic vulnerable to interception and tampering, violating standard organizational security policies and compliance requirements for software-defined data centers.

The network adapter is currently running in half-duplex mode.

Why wrong: While half-duplex mode could cause collisions and drops, the current statistics alone do not confirm this. Modern server adapters default to full-duplex, and packet discards are more commonly associated with buffer overflows or queue starvation rather than duplex mismatches, which would typically show CRC errors in other statistics.

The server has reached its maximum transmission unit (MTU) limit.

Why wrong: MTU issues typically result in fragmented packets or silently dropped oversized frames, but they would manifest differently in performance counters. While an MTU mismatch is a potential networking problem, packet discards at the adapter level are statistically more indicative of resource congestion rather than protocol-level frame size limitations.

The network cable is faulty and causing physical layer interference.

Why wrong: Physical layer issues usually result in CRC errors or alignment errors rather than pure packet discards. While a bad cable can cause issues, the specific counter for discarded packets points toward a software or buffer management issue within the host's networking stack rather than a simple cable fault.

Enable the iSCSI target role on the server.

Why wrong: Enabling the iSCSI target role allows the server to act as a storage provider, but it does not automatically configure or leverage RDMA for network acceleration. RDMA is a transport optimization, whereas iSCSI is a storage protocol; they are distinct technologies that require separate configuration to work together effectively.

Configure the network adapter to use the RoCEv2 protocol.

Why wrong: Since the adapter displays RoCEv2 as a capability, you should enable and configure this protocol to enable low-latency, high-throughput network transfers. RoCEv2 is highly efficient for data center networking and is the preferred RDMA protocol for modern Windows Server environments to maximize IOPS and minimize processing latency.

Update the network adapter firmware to the latest version.

Why wrong: Updating firmware is a good practice for stability, but it is not the configuration step required to actually enable the RDMA feature on the OS level. The system already reports the capability is present, so the task at hand is administrative activation, not a hardware-level update or patching.

Virtual Subnet ID

Why wrong: The Virtual Subnet ID is a component of Network Virtualization (NVGRE or VXLAN) that provides logical isolation for virtual machines. It allows for multi-tenant isolation within a virtualized data center, enabling VMs to be moved across hosts without changing their IP addressing or reconfiguring the physical network infrastructure.

MAC address spoofing protection

Why wrong: MAC address spoofing protection is a security feature that prevents a VM from sending traffic with a MAC address that does not belong to it. While this is important for security, it is not a mechanism for network isolation or logical segregation between different virtual machine subnets.

Hyper-V virtual switch extension

Why wrong: Virtual switch extensions add functionality like packet inspection or traffic mirroring, but they are not the primary mechanism for network isolation. While some advanced extensions might provide firewalling, the native, supported way to achieve logical subnet isolation in Hyper-V is through virtual subnets and network virtualization policies.

The server has an incorrect subnet mask.

Why wrong: The subnet mask is 255.255.255.0, which is correct for a /24 network. This allows the server to correctly identify local versus remote traffic. If the mask were incorrect, local connectivity would be intermittent or nonexistent, which contradicts the stated ability to reach devices on the local subnet.

The default gateway route is missing.

Why wrong: The output explicitly shows the default route 0.0.0.0 with a gateway of 10.10.10.1. The routing table is configured correctly for outbound internet traffic. The problem is not the absence of a route, but rather the inability of the gateway to actually forward the traffic to the internet.

The DNS server is unreachable.

Why wrong: While an unreachable DNS server would prevent hostname resolution (like google.com), it would not prevent connectivity to an IP address. Since the question describes an inability to reach the 'internet' rather than specifically mentioning name resolution errors, the gateway issue is a more fundamental and likely cause for total connection failure.

Both servers must have an identical DHCP scope configuration.

Why wrong: The scopes must be identical on both partners so that the standby server can take over the exact same address range if the primary server fails. If the scope ranges differ, the failover server would not know how to handle existing leases or assign new addresses for the subnet.

The servers must be configured to use Load Balance mode.

Why wrong: Load Balance is only one of two supported modes for DHCP Failover. Hot Standby is also a valid and fully supported configuration. Forcing a choice between the two is incorrect, as both modes serve valid architectural purposes depending on whether you prioritize active-active or active-passive operational models.

Network Load Balancing (NLB) cluster

Why wrong: While NLB can provide load balancing, it is not the recommended or optimized solution for the Routing and Remote Access (RRAS) gateway role. Gateway clusters provide a more native and feature-rich integration for multi-tenancy, including advanced tunnel management that NLB does not natively support in the same configuration context.

Gateway Cluster

Why wrong: A Gateway Cluster provides high availability for the RRAS service, allowing multiple nodes to share the workload and fail over automatically. This feature is specifically built for multi-tenant scenarios, ensuring that site-to-site VPN tunnels and NAT services remain accessible even if one of the physical gateway nodes experiences hardware failure.

Distributed File System (DFS) Replication

Why wrong: DFS Replication is used to synchronize file data between servers. It has absolutely no functionality related to network routing, gateway services, or providing high availability for VPN tunnels. Including it as a solution for gateway redundancy indicates a fundamental misunderstanding of the roles and responsibilities of Windows Server network services.

A Private Virtual Switch

Why wrong: A Private Virtual Switch only allows communication between virtual machines on the same host. It does not provide connectivity to the physical network or the internet. Therefore, it is not the correct configuration when the requirement is to enable network access for the VM beyond the local host environment.

An Internal Virtual Switch

Why wrong: An Internal Virtual Switch allows communication between the virtual machines and the host operating system, but not the physical network. It fails to provide the necessary external network connectivity required for the VM to communicate with other servers or services outside the host, which is the primary goal stated.

Network Adapter Teaming

Why wrong: Teaming combines multiple physical adapters to increase throughput or provide redundancy. While useful, it is not a mechanism for connecting a virtual machine to the network. The virtual machine must connect to a switch, and the switch itself can be bound to a team, but teaming alone is not the solution.

Configure a Root Hint pointing to the 10.0.0.4 IP address.

Why wrong: Root hints are used by DNS servers to find authoritative servers for the top-level domains of the entire Internet namespace. Pointing root hints to a private Azure IP address would break external name resolution for the entire organization and is an incorrect use of the root hints configuration mechanism.

Enable DNSSEC validation for the 10.0.0.4 IP address.

Why wrong: While DNSSEC provides security through cryptographic signatures, enabling it does not facilitate the routing of queries to the Azure resolver. DNSSEC validation is a security measure that would likely fail if the underlying connectivity and forwarding rules are not first established to allow the DNS traffic flow.

Add 10.0.0.4 as a secondary DNS server in the client IP settings.

Why wrong: Adding a remote Azure IP as a secondary DNS server on local clients is inefficient and unreliable due to potential latency and timeout issues. It bypasses the centralized on-premises DNS infrastructure, making it difficult to manage internal records and potentially causing intermittent resolution failures for users in the office.

An Azure Virtual Network Gateway with the Basic SKU.

Why wrong: The Basic SKU for Azure Virtual Network Gateways does not support the advanced features or performance metrics required for sophisticated hybrid networking solutions like Extended Networks. Higher SKUs are necessary to provide the throughput and specific protocol support required for maintaining a stable Layer 2 extension across a wide area network.

An Azure ExpressRoute circuit with Global Reach enabled.

Why wrong: While ExpressRoute provides high-speed connectivity, Global Reach is specifically used for connecting two different ExpressRoute circuits together across regions. It is not a requirement for the Azure Extended Network tool, which can operate over standard Site-to-Site VPN connections or standard ExpressRoute circuits without the Global Reach add-on.

A public IP address assigned to every migrated VM.

Why wrong: The primary purpose of stretching a Layer 2 network is to maintain internal private IP addresses, not to assign public IPs. Assigning public IPs to every migrated VM would negate the benefits of the extended network and create significant security vulnerabilities by exposing internal resources directly to the public internet.

Get-NetIPAddress

Why wrong: This cmdlet displays IP address configuration including prefixes and interface indices, but it does not show the actual routing logic or path decisions taken by the Windows networking stack. It is useful for verifying interface assignments rather than validating the destination reachability or hop-by-hop packet forwarding behavior.

Test-NetConnection

Why wrong: While this tool is excellent for testing end-to-end connectivity and port availability, it simulates a connection attempt rather than providing a diagnostic view of the local server's routing table. It cannot confirm if the internal routing logic is configured to handle traffic between two locally attached interfaces.

Get-NetAdapter

Why wrong: This cmdlet provides information about physical or virtual network adapters such as status, speed, and hardware properties. It does not provide insight into Layer 3 routing configuration or the logic the kernel uses to decide which interface should handle traffic destined for a specific remote IP address.

Azure ExpressRoute

Why wrong: ExpressRoute provides a private, dedicated connection to Azure that does not traverse the public internet. It is a high-performance solution, but it is not a VPN tunnel and does not use standard public internet encryption in the same way a Site-to-Site VPN does for smaller scale requirements.

Remote Access Server (RAS) Gateway

Why wrong: While a RAS Gateway is a Windows role that can host VPN connections, it is an on-premises component. It does not natively provide the cloud-side gateway functionality required to interface with Azure's Virtual Network infrastructure without additional configuration and an Azure-side gateway service to terminate the tunnel connection.

Azure Point-to-Site VPN

Why wrong: Point-to-Site VPN is intended for individual clients or devices connecting to an Azure Virtual Network, rather than connecting an entire local data center subnet. Scaling this to support a persistent, site-wide hybrid connection is inefficient and does not meet the requirements for enterprise-grade site-to-site network integration.

Configure the firewall to drop all outbound traffic by default.

Why wrong: Blocking all outbound traffic by default is an extreme measure that can break critical server functions like Windows Update, DNS resolution, and NTP time synchronization. Unless the server is in an air-gapped environment, this strategy is generally impractical and detrimental to the standard operation of the Windows operating system.

Enable IPsec encryption for the specific application rule.

Why wrong: While IPsec provides encryption, it is not required to simply allow or block traffic for a specific application. Enabling IPsec adds unnecessary overhead and complexity to the firewall configuration unless the business requirement specifically dictates that the traffic must be encrypted for security or compliance reasons within the network.

Disable the Windows Firewall and use a third-party appliance.

Why wrong: Disabling the Windows Firewall removes a critical layer of defense-in-depth on the host itself. Relying solely on a perimeter appliance leaves the server vulnerable to lateral movement if an attacker gains access to the local network segment. Host-based firewalls are a mandatory component of a secure infrastructure.

Add-NetNeighbor

Why wrong: The Add-NetNeighbor cmdlet is used to manually add an ARP or neighbor discovery entry for a specific IP address. It is intended for Layer 2 address resolution, not for adding Layer 3 routing table entries required to reach a remote network destination across a gateway device.

Set-NetIPInterface

Why wrong: Set-NetIPInterface is used to configure properties of an IP interface, such as enabling DHCP or setting the interface metric. It does not provide the functionality to define static routes to external networks. Modifying interface settings will not solve a routing problem where the destination network is unknown.

New-NetIPAddress

Why wrong: New-NetIPAddress is used to assign an IP address to a network interface. It creates the local interface configuration, but it does not define the path to remote networks. Adding an IP address is a prerequisite, but it does not replace the requirement for a specific route to the destination.

DHCP Server role

Why wrong: While a DHCP server is often present on the same network, it is not responsible for NAT. DHCP provides IP addressing, whereas NAT handles address translation for traffic moving between different network segments. Enabling DHCP does not provide the necessary routing and translation services for internal clients to reach the internet.

Network Policy Server (NPS)

Why wrong: NPS is used for RADIUS authentication and network access control. It manages policies for who can connect to the network and what levels of access they are granted, but it does not perform packet translation or routing functions required for Network Address Translation to function on the gateway.

Hyper-V Network Virtualization

Why wrong: Network Virtualization is used to create isolated virtual networks within a cloud environment. It is not designed to perform standard NAT for small-scale private network access to the internet. It operates at a different layer and serves a different purpose than the traditional NAT functionality required for a gateway.

Virtual Machine Queue (VMQ)

Why wrong: VMQ is designed to offload packet processing for virtual machines to the physical network adapter. While it helps performance in virtualized environments, it is not the primary mechanism for optimizing general host-level network stack processing when high CPU usage is observed during large data transfers on the server itself.

IPsec Task Offloading

Why wrong: IPsec Task Offloading moves the cryptographic processing from the CPU to the network interface card. While it reduces CPU usage during encrypted transfers, it does not address the performance overhead associated with standard, non-encrypted network stack processing. It is specifically for reducing the load of IPsec encryption/decryption tasks.

Network Load Balancing (NLB)

Why wrong: NLB is a clustering technology that distributes traffic across multiple servers. It does not optimize the CPU processing of a single server's network stack. Enabling NLB would increase the number of servers, but it does not address the CPU efficiency of an individual server handling a high network load.

Azure Private Link

Why wrong: Azure Private Link provides private access to services but does not inherently handle DNS resolution for entire zones from on-premises environments. It maps specific IP addresses to services, which is insufficient for broad name resolution across a complex hybrid network infrastructure that requires recursive lookups or conditional forwarding.

A standard Azure Public DNS Zone

Why wrong: Public DNS zones are designed for internet-facing records and are visible to any client globally. Using a public zone for internal infrastructure resolution introduces significant security risks and does not provide the necessary integration with Azure Virtual Networks required for resolving private IP addresses of internal cloud resources.

Azure Application Gateway

Why wrong: Application Gateway is a Layer 7 load balancer that handles web traffic and SSL termination rather than DNS name resolution services. While it can assist with routing traffic to back-end pools, it lacks the specialized functionality required to process and respond to DNS queries from on-premises DNS servers.

Active-Passive Cluster

Why wrong: Active-Passive clustering is a general high-availability concept used in Failover Clustering but is not a specific named mode within the DHCP Failover feature itself. DHCP Failover was specifically designed to provide redundancy without the complexity and shared storage requirements typically associated with traditional Windows Server Failover Clustering.

Split-Scope

Why wrong: Split-Scope is a legacy method of providing DHCP redundancy by manually dividing an IP range between two independent servers. While still functional, it is not a selection within the modern DHCP Failover wizard and lacks the synchronization capabilities that allow servers to share lease information in real-time.

Distributed Relay

Why wrong: Distributed Relay refers to the placement of DHCP relay agents across multiple routers or switches to forward discovery packets to a central server. This is a network routing configuration rather than a high-availability mode for the DHCP service itself, and it does not provide database synchronization between server nodes.

The IPAM server must be a Domain Controller.

Why wrong: The IPAM feature should never be installed on a Domain Controller as it requires different security contexts and can lead to resource contention. Microsoft recommends installing IPAM on a standalone member server within the domain to ensure proper isolation of management functions and to adhere to security best practices.

The GPOs must be manually linked to each individual server object.

Why wrong: GPOs are typically linked at the domain level or to specific Organizational Units (OUs) rather than individual server objects. The IPAM provisioning process handles the creation and linking of these policies, and manual linking to individual objects is an inefficient administrative task that contradicts the automation benefits of using IPAM.

The IPAM server must have the Web Server (IIS) role removed.

Why wrong: IPAM actually requires several web-related components and internal Windows services to provide its management console and data collection capabilities. Removing the web components would break the IPAM functionality, as the management infrastructure relies on standard web protocols and services for communication between the management console and the underlying database.

DNS Server Zone Scope

Why wrong: A zone scope is a subset of a DNS zone that contains its own set of resource records. While necessary for providing different answers, you cannot effectively apply a policy to a scope until you have defined the criteria (such as client subnets) that determine which scope should be used for a query.

DNS Server Recursion Scope

Why wrong: Recursion scopes are used to control how the DNS server performs recursive lookups for external names, rather than how it responds to queries for records it is authoritative for. This component is unrelated to the requirement of providing different internal IP addresses for a local host record.

DNS Server Query Resolution Policy

Why wrong: The Query Resolution Policy is the final step that ties the client subnets and zone scopes together. You cannot create a functional policy without first having the constituent parts, like client subnets, already defined in the server's configuration to act as the matching criteria for the incoming DNS traffic.