Exam 70-741 topic 1 question 50 discussion

Actual exam question from Microsoft's 70-741

Question #: 50
Topic #: 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution. Determine whether the solution meets the stated goals.
Your network contains an Active Directory domain named contoso.com. The domain contains a DNS server named Server1. All client computers run Windows 10.
On Server1, you have the following zone configuration.

You need to ensure that all of the client computers in the domain perform DNSSEC validation for the fabrikam.com namespace.
Solution: From Windows PowerShell on Server1, you run the Add-DnsServerTrustAnchor cmdlet.
Does this meet the goal?

A. yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️
The Add-DnsServerTrustAnchor command adds a trust anchor to a DNS server. A trust anchor (or trust "point") is a public cryptographic key for a signed zone.
Trust anchors must be configured on every nonauthoritative DNS server that will attempt to validate DNS data. Trust Anchors have no direct relation to DSSEC validation.
References:
https://technet.microsoft.com/en-us/library/jj649932.aspx
https://technet.microsoft.com/en-us/library/dn593672(v=ws.11).aspx

by dritter at Feb. 25, 2019, 7:57 a.m.

Comments

Submit Cancel

coleman

Highly Voted 5 years, 1 month ago

Solution must : From a Group Policy object (GPO) in the domain, you add a rule to the Name Resolution Policy Table (NRPT).

upvoted 5 times

...

alexnt

Highly Voted 4 years, 4 months ago

Another variant: Solution: From Windows PowerShell on Server1, you run the Export-DnsServerDnsSecPublicKey cmdlet. Does this meet the goal? A. Yes B. No Offered Answer: B References: https://docs.microsoft.com/en-us/powershell/module/dnsserver/export-dnsserverdnssecpublickey?view=win10-ps

upvoted 5 times

...

dritter

Most Recent 5 years, 9 months ago

I do agree with the explanation. But only after I realized, that the question only asks to ensure, Clients are asking to be validated. Not to ensure that DNSSEC is fully functional. Without TrustAnchors it would be though. But that's not the question here.

upvoted 2 times

Dave_Holden

4 years, 11 months ago

The fabricam.com zone is also already signed

upvoted 1 times

...

panda

3 years, 11 months ago

I agree with dritter.