A company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2.
The company plans to add a large number of members to the Account Operators group. You create a new organizational unit (OU), move the Account Operators group to the new OU, and delegate control of the OU to a server operator.
The server operator is unable make changes to the Account Operators group.
You need to ensure that the server operator can manage the Account Operators group.
What should you recommend? (More than one answer choice may achieve the goal. Select the BEST answer.)

• A. Manually alter the access control lists (ACLs) on the Account Operators group to allow the server operator control.
• B. Make the server operator a Domain Administrator.
• C. Set the dsHeuristic flag to exclude the Account Operators group from the AdminSDHolder protection.
• D. Set the dsHeuristic flag to include the Account Operators group in the AdminSDHolder protection.

You need to recommend an IP addressing solution that meets the company's technical requirements.
Which IPv6 prefix should you include in the recommendation?

• A. FF00::/10
• B. FC00::/10
• C. FE80::/10
• D. 2001::/10

Your network consists of one Active Directory domain that contains two servers named Server1 and
Server2 that run Windows Server 2008.
Server1 runs Active Directory Certificate Services (AD CS) and is configured as an enterprise root
certification authority (CA).
Server1 is only accessible from the internal network.
Server1 issues certificates to both internal and external client computers that run Windows Vista.
Server2 is configured as a Web server. Server2 is located in the perimeter network and is only accessible
through HTTP.
The network is configured as shown in the following diagram: You need to recommend an e-mail security solution for all Windows Vista client computers that meets the following requirements:

-Users must only request status information for individual certificates.
-Users must be notified when they attempt to send a secure e-mail message to a user that has an expired certificate.
What should you recommend?

• A. Configure a root CA on Server2.
• B. Configure a certification revocation list (CRL) distribution point on Server2.
• C. Configure the Online Responder service on Server2.
• D. Configure a subordinate CA on Server2.

Your network contains servers that run Windows Server 2008 R2 and client computers that run Windows 7.
All network routers support IPsec connections. Client computers and servers use IPsec to connect through network routers.
You have two servers named Server1 and Server2. Server1 has Active Directory Certificate Services (AD CS) installed and is configured as a certification authority (CA). Server2 runs Internet Information Services (IIS).
You need to recommend a certificate solution for the network routers. The solution must meet the following requirements: Use the Simple Certificate Enrollment Protocol (SCEP).
Enable the routers to automatically request certificates.
What should you recommend implementing?

• A. Network Device Enrollment Service on Server2
• B. Certification authority Web enrollment services on Server2
• C. Online Responder service on Server1
• D. Subordinate CA on Server1

Your network consists of one Active Directory domain. The domain contains servers that run Windows Server 2008 R2. The relevant servers are configured as shown in the following table.

All client computers run Windows 7.
Remote users connect to the network from the Internet by using virtual private network (VPN) connections.
You plan to enable remote users to run RemoteApp applications on Server2.
You need to prepare the environment to provide users access to the applications. The solution must provide
a custom Web page that contains shortcuts to authorized applications for each user.
What should you do?

• A. On Server2, install the Terminal Services server role that has the Terminal Services Gateway (TS Gateway) role service.
• B. On Server2, install the Web Server (IIS) server role.
• C. On Server3, install the Terminal Services server role that has the Terminal Services Web Access (TS Web Access) role service.
• D. On Server2 and Server3, install the Terminal Services server role that has the Terminal Services Session Broker (TS Session Broker) role service.