Configure DNSSEC Validation

C

To ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace, you need to configure the Name Resolution Policy Table (NRPT) using Group Policy Object (GPO). The correct answer is C.

Here is a detailed explanation of each answer choice:

A. On Server1, run the Add-DnsServerTrustAnchor cmdlet. This answer choice is incorrect because running the Add-DnsServerTrustAnchor cmdlet on Server1 will only add a trust anchor to Server1's DNS server. It will not ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace.

B. On each member server, run the Add-DnsServerTrustAnchor cmdlet. This answer choice is incorrect because running the Add-DnsServerTrustAnchor cmdlet on each member server is not the best way to ensure that all member servers perform DNSSEC validation for the fabrikam.com namespace. It is not a scalable solution, and it requires manual intervention on each member server.

C. From a Group Policy Object (GPO), add a rule to the Name Resolution Policy Table (NRPT). This answer choice is correct. The NRPT is a table that contains rules for DNS name resolution. By adding a rule to the NRPT using a GPO, you can ensure that all member servers in the domain perform DNSSEC validation for the fabrikam.com namespace. To do this, you can follow these steps:

1. Open the Group Policy Management console.
2. Create a new GPO or select an existing one.
3. Navigate to Computer Configuration > Policies > Windows Settings > Name Resolution Policy.
4. Right-click on Name Resolution Policy and select New Rule.
5. In the New Name Resolution Policy Rule wizard, select DNS Security Extensions (DNSSEC) as the rule type and click Next.
6. In the DNS Server Search Order section, add the DNS server that hosts the fabrikam.com zone (Server1) and click Next.
7. In the DNS Domain Name section, enter fabrikam.com as the domain name and click Next.
8. In the Action section, select Require DNS clients to check if the name is signed and click Next.
9. Review the summary and click Finish.

After you apply the GPO to the domain, all member servers will perform DNSSEC validation for the fabrikam.com namespace.

D. From a Group Policy Object (GPO), modify the Network List Manager policies. This answer choice is incorrect because modifying the Network List Manager policies will not help you ensure that all member servers in the domain perform DNSSEC validation for the fabrikam.com namespace. The Network List Manager policies control settings related to network location awareness, such as firewall rules and network discovery options.