Domain Controllers and Their Role Quiz

1.What best describes the core function of a domain controller in a Windows domain?

• It stores nightly backups of every workstation's local files
• It acts as the central authority for authentication, authorization, and policy
• It provides internet access and DHCP addressing for domain-joined machines
• It is a workstation that every employee logs into directly instead of their own computer

2.What does NTDS.dit hold, and why does that make it especially sensitive?

• A log of every file accessed on the network, which could reveal user browsing habits
• The authoritative copy of every account, group membership, and policy in the domain, including password hashes
• A cached copy of each user's most recently opened documents
• A list of IP addresses currently assigned to domain-joined computers

3.A colleague says password hashes are only at risk if someone gets physical access to the domain controller. What is the flaw in that reasoning?

• There is no flaw; physical access is the only way to reach NTDS.dit's contents
• NTDS.dit is also exposed through replication protocols that a sufficiently privileged account can abuse remotely
• NTDS.dit does not actually contain password hashes, so the concern is misplaced either way
• Password hashes are stored on every workstation individually, so the domain controller itself is not a target

4.A production domain runs three domain controllers for redundancy. An attacker compromises only one of them. What is the practical impact?

• None; the other two domain controllers keep the domain secure since only one was breached
• The attacker gains access to the full authoritative database, because every domain controller holds the complete, replicated copy
• The attacker only gains partial data, since each domain controller stores a different third of the database
• The domain automatically fails over to a backup authentication system until the compromised domain controller is rebuilt

5.During a scan, you see ports 53, 88, 389, 445, and 464 open together on a host. What does that combination most strongly suggest?

• A file server that also happens to run a local DNS cache
• The host is very likely a domain controller, based on its service fingerprint
• A misconfigured workstation with unnecessary services enabled
• A web application server that has been recently patched

6.Why does it matter that domain controllers are frequently also the DNS servers for the environment?

• It does not matter; DNS and domain controller functions are entirely unrelated services running on the same box by coincidence
• It means a domain controller that looks like just a directory server is usually also quietly running the network's name resolution
• It means domain controllers can no longer process Kerberos authentication requests
• It means every DNS query on the network requires Domain Admin credentials