Question
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC.
You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.
What should you do?
- A. On Server1, run the Add-DnsServerTrustAnchor cmdlet.
- B. On each member server, run the Add-DnsServerTrustAnchor cmdlet.
- C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT). Correct
- D. From a Group Policy Object (GPO), modify the Network List Manager policies.
Explanation
To ensure all member servers in the domain perform DNSSEC validation for the fabrikam.com namespace, you should configure a rule in the Name Resolution Policy Table (NRPT) via a Group Policy Object (GPO). This method allows centralized management and application of DNSSEC validation settings to multiple machines.
