nerdexam
CompTIA

CAS-002 · Question #888

A company is trying to decide how to manage hosts in a branch location connected via a slow WAN link. The company desires to provide the same level of performance and functionality to the branch…

The correct answer is B. Deploy a corporate Read-Only Domain Controller to the branch location. For a branch with a slow WAN link and weak physical security, a Read-Only Domain Controller deployed locally balances performance and protection by caching credentials locally while preventing writable AD exposure.

Technical Integration of Enterprise Components

Question

A company is trying to decide how to manage hosts in a branch location connected via a slow WAN link. The company desires to provide the same level of performance and functionality to the branch office as it provides to the main campus. The company uses Active Directory for its directory service and host configuration management. The branch location does not have a datacenter, and the physical security posture of the building is weak. Which of the following designs is MOST appropriate for this scenario?

Options

  • ADeploy a branch location Read-Only Domain Controller in the DMZ at the main campus with a
  • BDeploy a corporate Read-Only Domain Controller to the branch location.
  • CDeploy a corporate Domain Controller in the DMZ at the main campus.
  • DDeploy a branch location Read-Only Domain Controller to the branch office location with a one-
  • EDeploy a corporate Domain Controller to the branch location.
  • FDeploy a branch location Domain Controller to the branch location with a one-way trust.

How the community answered

(38 responses)
  • A
    11% (4)
  • B
    58% (22)
  • C
    5% (2)
  • D
    21% (8)
  • E
    3% (1)
  • F
    3% (1)

Why each option

For a branch with a slow WAN link and weak physical security, a Read-Only Domain Controller deployed locally balances performance and protection by caching credentials locally while preventing writable AD exposure.

ADeploy a branch location Read-Only Domain Controller in the DMZ at the main campus with a

Placing the RODC at the main campus DMZ forces all branch authentication traffic over the slow WAN link, doing nothing to improve branch performance.

BDeploy a corporate Read-Only Domain Controller to the branch location.Correct

A Read-Only Domain Controller (RODC) deployed at the branch resolves WAN latency by authenticating users locally without requiring round-trips to the main campus. Because the RODC stores only a filtered, read-only copy of the AD database, a stolen or compromised device cannot be used to modify directory data or extract full credential stores, directly addressing the weak physical security posture. Being a full corporate domain member - rather than a one-way trust - ensures users receive the same Group Policy application and functionality as the main campus.

CDeploy a corporate Domain Controller in the DMZ at the main campus.

A full writable DC in the main campus DMZ exposes the entire AD database to perimeter risks and still does not reduce latency for branch users.

DDeploy a branch location Read-Only Domain Controller to the branch office location with a one-

A one-way trust restricts what corporate resources branch users can access, failing the requirement to provide equivalent functionality to the main campus.

EDeploy a corporate Domain Controller to the branch location.

A full writable DC at the physically insecure branch allows an attacker who obtains the hardware to extract all AD credentials and make arbitrary directory changes.

FDeploy a branch location Domain Controller to the branch location with a one-way trust.

A writable branch DC with a one-way trust combines the worst of both problems: full credential exposure at an insecure site and reduced functionality due to the limited trust.

Concept tested: Read-Only Domain Controller deployment for branch offices

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/read-only-domain-controller-planning

Topics

#Read-Only Domain Controller#Active Directory#branch office security#WAN design

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice