AZ-800 · Question #171
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table. You need to ensure that if an attacker compromises…
The correct answer is D. schema. Attribute confidentiality is configured in the schema partition. Each attribute in AD DS has a searchFlags property. Setting bit 7 (value 128) of searchFlags marks an attribute as confidential, which prevents it from being replicated to RODCs and also restricts read access to…
Question
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table. You need to ensure that if an attacker compromises the computer account of RODC1, the attacker cannot view the Employee-Number AD DS attribute. Which partition should you modify?
Exhibit
Options
- Aconfiguration
- Bglobal catalog
- Cdomain
- Dschema
How the community answered
(28 responses)- A11% (3)
- B4% (1)
- C4% (1)
- D82% (23)
Explanation
Attribute confidentiality is configured in the schema partition. Each attribute in AD DS has a searchFlags property. Setting bit 7 (value 128) of searchFlags marks an attribute as confidential, which prevents it from being replicated to RODCs and also restricts read access to only members of specific privileged groups. To protect the Employee-Number attribute from being cached on or readable from a compromised RODC, you modify the attribute's searchFlags in the schema partition. The domain partition contains actual object instances (users, groups, etc.) but not attribute definitions. The configuration partition stores forest-wide configuration (sites, services, replication). The global catalog partition stores a partial replica of domain objects but does not control replication confidentiality.
Topics
Community Discussion
No community discussion yet for this question.