Active Directory Objects and Schema Quiz

1.What defines what attributes a user object can or must hold in Active Directory?

• The domain controller that created the object
• The object class defined in the schema
• The organizational unit the object is placed in
• Whatever attributes an administrator manually types in when creating the object

2.Why is schema modification so tightly restricted compared to ordinary object changes?

• Because schema changes are technically difficult to perform
• Because the schema is a forest-wide singleton, so a change applies to every domain in the forest at once
• Because only Domain Admins in the forest root are allowed to log into any domain controller
• Because schema changes require rebuilding the global catalog from scratch

3.A colleague says a global catalog search returned no results for an object you know exists. What is the most likely explanation?

• The object was deleted right before the search ran
• The search was looking for an attribute that is not part of the partial attribute set the global catalog replicates
• The global catalog only stores objects created in the last 24 hours
• Global catalog searches only work for computer objects, not user objects

4.Why can two domain controllers briefly show different data for the same object right after a change?

• Because one of the domain controllers is misconfigured and needs to be rebuilt
• Because replication takes a short amount of time to propagate a change from the domain controller that accepted the write to every other domain controller
• Because only one domain controller in a domain is allowed to accept writes
• Because the global catalog and the domain controller are out of sync with each other

5.How does querying a global catalog port (3268/3269) differ from querying a standard LDAP port (389/636) in a multi-domain forest?

• There is no difference; both ports return identical results
• The global catalog port searches forest-wide with a partial attribute set; the standard LDAP port searches a single domain with the full attribute set
• The global catalog port only works for read operations, while the LDAP port only works for writes
• The standard LDAP port requires Schema Admin rights, while the global catalog port does not

6.Which statement best captures why understanding objects and the schema matters when explaining an AD assessment finding?

• It lets you name-drop technical terms to sound more credible
• Almost every technique in an AD assessment touches an object, so precisely describing what an attacker changed or accessed depends on understanding what an object actually is
• It is only relevant for people who plan to become Schema Admins themselves
• It mainly helps with writing faster PowerShell scripts