nerdexam
Microsoft

AZ-800 · Question #53

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was…

The correct answer is C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT). Deploying an NRPT rule via Group Policy is the correct method to enforce DNSSEC validation for a specific namespace across all domain member servers.

Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments

Question

Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC. You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace. What should you do?

Options

  • AOn Server1, run the Add-DnsServerTrustAnchor cmdlet.
  • BOn each member server, run the Add-DnsServerTrustAnchor cmdlet.
  • CFrom a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).
  • DFrom a Group Policy Object (GPO), modify the Network List Manager policies.

How the community answered

(37 responses)
  • A
    8% (3)
  • B
    5% (2)
  • C
    84% (31)
  • D
    3% (1)

Why each option

Deploying an NRPT rule via Group Policy is the correct method to enforce DNSSEC validation for a specific namespace across all domain member servers.

AOn Server1, run the Add-DnsServerTrustAnchor cmdlet.

Running Add-DnsServerTrustAnchor on Server1 adds the trust anchor to the DNS server's trust anchor store, which affects server-side validation only and does not configure member server DNS clients to perform DNSSEC validation.

BOn each member server, run the Add-DnsServerTrustAnchor cmdlet.

Running Add-DnsServerTrustAnchor on each member server is incorrect because member servers are DNS clients, not DNS servers; DNSSEC validation for clients is controlled via NRPT, not server-side trust anchor cmdlets.

CFrom a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT).Correct

The Name Resolution Policy Table (NRPT) is the Windows mechanism that instructs DNS clients to require DNSSEC validation for specified namespaces. Configuring an NRPT rule in a GPO and linking it to the domain ensures all member servers automatically enforce DNSSEC validation for fabrikam.com without per-server manual steps.

DFrom a Group Policy Object (GPO), modify the Network List Manager policies.

Network List Manager policies manage network profile names and connectivity settings, and have no effect on DNS resolution behavior or DNSSEC validation enforcement.

Concept tested: DNSSEC client validation enforcement using NRPT via GPO

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593685(v=ws.11)

Topics

#DNSSEC#Name Resolution Policy Table (NRPT)#Group Policy#DNS client validation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-800 Practice