Research & Evidence-Based Practice Flashcards

When researching unexplained IP address conflicts on a Windows Server 2008 network, which DHCP server feature generates logged evidence of detected conflicts?

Answer: Conflict detection attempts configured to 1 or more

Enabling DHCP conflict detection causes the server to ping addresses before leasing them and log any conflicts detected, providing evidence of address conflicts.

An engineer needs to verify that a Windows Server 2008 DNS server is using forwarders and not root hints for external resolution. Which DNS server property tab provides this evidence?

Answer: Forwarders tab showing configured forwarder IP addresses

The Forwarders tab displays configured forwarder IP addresses; if forwarders are listed and 'Use root hints if no forwarders are available' is unchecked, forwarding is enforced.

A research-oriented network audit requires verifying that IPsec policies are applied consistently across multiple servers. Which tool provides centralized evidence of policy application?

Answer: Group Policy Results (gpresult) showing applied IPsec policy

Running gpresult on each server shows which Group Policy Objects applied, including IPsec policies, providing centralized evidence of consistent policy deployment.

Which Windows Server 2008 command-line tool provides evidence of all established, listening, and time-wait TCP connections along with their associated process IDs?

Answer: netstat -ano

The 'netstat -ano' command displays all TCP/UDP connections with their state and the owning process ID, enabling identification of which processes hold connections.

To provide evidence that a Windows Server 2008 system is receiving time synchronization from a reliable NTP source, which command should be run?

Answer: w32tm /query /status

The 'w32tm /query /status' command displays the current time source, leap indicator, stratum, and synchronization state, providing evidence of NTP operation.

A network policy requires that only authenticated computers receive DHCP leases. Which combined technology provides cryptographic evidence of machine identity during the DHCP process?

Answer: NAP with 802.1X enforcement and machine certificates

NAP with 802.1X enforcement requires machine certificates for authentication before network access is granted, providing cryptographic identity evidence at the port level.

When documenting evidence that a Windows Server 2008 DNS zone is Active Directory-integrated, which DNS console indicator confirms this configuration?

Answer: The zone type displays 'Active Directory-Integrated' and replication scope is shown

An Active Directory-integrated zone shows its type as 'Active Directory-Integrated' in DNS Manager and displays the replication scope, confirming data is stored in AD rather than a flat file.