Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com that has the domains shown in the following table.
You are creating a disaster recovery plan for the forest.
What is the minimum number of domain naming FSMO role holders and RID master FSMO role holders that should be online to maintain full functionality of the forest? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
| Name | Number of domain controllers |
| --- | --- |
| contoso.com | 3 |
| west.contoso.com | 2 |
| east.contoso.com | 2 |
| sub.west.contoso.com | 2 |
| adatum.com | 2 |
Explanation
Domain naming: 1 — The domain naming master is a forest-wide FSMO role, so exactly one holder exists in the entire contoso.com forest regardless of how many domains it contains; it is the role that authorizes adding, removing, and renaming domains and application partitions, so a single online holder is all that is required (and all that is possible) for full forest functionality. Higher values such as 2 or 5 would imply one holder per domain, which is how the domain-level roles behave, not the forest-level ones.
RID master: 5 — The RID master is a domain-wide FSMO role, so every domain in the forest has its own holder, and with five domains in contoso.com all five must be online for full functionality. Each RID master issues RID pools to the DCs in its own domain so they can mint unique SIDs for new users, groups, and computers; a domain whose RID master is offline eventually cannot create new security principals, so no single holder can cover the whole forest the way the domain naming master does.
