Examkin

Question

Difficulty: Very hardWindows Client Networking Configuration

A network administrator is hardening the network settings on a fleet of Windows 11 Pro workstations. Corporate security policy dictates that clients must properly resolve short, single-label hostnames across multiple internal subdomains without relying on unauthenticated broadcast name resolution protocols if DNS queries fail. Which TWO configuration settings or administrative policies must be implemented on the Windows clients to satisfy these requirements?

  1. Configure the DNS suffix search list in Advanced TCP/IP Settings to append parent and specific domain suffixes in order.Answer
  2. Disable Link-Local Multicast Name Resolution (LLMNR) using Local Group Policy or Registry settings.Answer
  3. C
    Enable NetBIOS over TCP/IP (NetBT) under the WINS configuration tab of the network adapter properties.
  4. D
    Execute `ipconfig /registerdns /flushdns` in an elevated command prompt to force NetBIOS cache clearance.

Answer

The technician must configure the DNS suffix search list under Advanced TCP/IP Settings and disable Link-Local Multicast Name Resolution (LLMNR) via Group Policy.
Configuring the DNS suffix search list allows the client to automatically append defined domain suffixes to single-label queries, ensuring successful DNS lookup across complex internal subdomains. Disabling Link-Local Multicast Name Resolution (LLMNR) ensures that if DNS fails, the client will not send unauthenticated UDP multicast broadcasts across the local subnet, protecting against local name-spoofing attacks.

Step-by-Step Solution

1
Identify the requirement for resolving single-label hostnames across multiple domain trees.
Determined that an explicit DNS suffix search list must be configured in Advanced TCP/IP Properties so the operating system automatically appends domain extensions during host lookup.
Without a DNS suffix search list, single-label queries will only append the primary connection-specific suffix, failing to resolve hosts located in sibling or child subdomains.
2
Identify the requirement to prevent unauthenticated broadcast name resolution fallback.
Determined that Link-Local Multicast Name Resolution (LLMNR) must be disabled via Local Group Policy ('Turn off Link-Local Multicast Name Resolution') or Registry modifications.
LLMNR operates on UDP port 5355 to resolve local names when DNS fails, leaving clients vulnerable to spoofing and poisoned responses (e.g., via Responder tools).

Key Concept

Advanced Windows DNS Suffix Configuration and LLMNR Disablement
Rate this question

Topics

Windows Client Networking Configuration

More questions from this topic