Question
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains the domain controllers shown in the following table.
| Name | Description |
|---|---|
| DC1 | PDC emulator, RID master, and global catalog server |
| DC2 | Infrastructure master and domain naming master |
| DC3 | Schema master |
| RODC1 | Read-only domain controller (RODC) |
You need to ensure that if an attacker compromises the computer account of RODC1, the attacker cannot view the Employee-Number AD DS attribute.
Which partition should you modify?
- A. configuration
- B. global catalog
- C. domain
- D. schema Correct
Explanation
To stop an attribute such as Employee-Number from being available on a compromised RODC, you add it to the RODC filtered attribute set (FAS). Attributes in the FAS are not replicated to any RODC in the forest, and writable domain controllers refuse replication requests for them. The FAS is configured on the attribute's definition (the searchFlags value of its attributeSchema object), which lives in the schema partition, so the change is made in the schema (on the schema master, DC3). Marking the attribute as confidential is a recommended additional safeguard. The domain and configuration partitions hold objects and their values, not the attribute definitions, and the global catalog is not a partition you modify for this.
