48

Chapter 2


Designing and Planning Server High Availability

RAID 5 offers a balance of performance and fault tolerance by implementing a stripe set
(improved performance) with a parity check (redundancy). RAID 5, which requires at least
three physical disks, splits the write operation across “

n

–1” disks (that is, if you have five
disks, the write operation is split across four of the disks) to improve performance. At the
same time, the RAID controller calculates parity information and stores it on the remaining
disk. The result is that, if a disk is lost, the data on that disk can be re-created by comparing
the data on the surviving disks and the parity information. (In RAID 5, the parity informa-
tion is distributed among the disks, so that the contents of any given disk are 1/

n

parity
info and (

n

–1)/

n

icated to your page file), use RAID 0.
When designing a storage system for Exchange Server 2007, however, you need to consider
what data is being stored and why. The extensible storage engine (ESE) database employed by
Exchange Server uses database and transaction log files to improve

recoverability

. If the data-
base is ever lost or corrupted, you can recover the database up to the point of the failure by
restoring a previous version of the database from backup and replaying the transaction log
files that were made after the backup.
The most common mistake people make when deploying Exchange Server is to store the data-
base files and transaction log files on the same storage volume. If you do this and that storage
volume later becomes damaged, then the odds that you can recover the database to the point of
failure are seriously diminished. Many administrators (and, more frightening, server hardware
vendors and consultants) suggest placing the database files and transaction log files on different
partitions of the same RAID 1 or RAID 5 volume. This might let you keep it straight in your
head, but it does nothing to improve performance or recoverability. Yes, using a RAID 1 or
RAID 5 volume protects against the failure of a single physical disk. But what if two disks fail?
(It’s been known to happen!) Or what if the RAID controller starts writing garbage instead of
data? Then you’re in trouble.

81461.book Page 48 Wednesday, December 12, 2007 4:49 PM

Define High Availability Solutions Based on Client Types and Client Loads

49

Database files and transaction log files should be stored on different RAID volumes. And, if
possible, those RAID volumes should use different RAID controllers. As already mentioned, you

port server is down, then you cannot send messages to anyone: Not even to users on the
same Exchange Server 2007 Mailbox server. Not even to users whose mailboxes are in
the same mailbox database. Not even to yourself! Therefore, unless you are deploying
Exchange Server 2007 on a single server in an environment that doesn’t require high avail-
ability, you need redundancy for the Hub Transport server role.

Hub Transport Redundancy within the Site

More. That’s all it takes. Nothing fancy, nothing challenging. To provide redundancy for Hub
Transport servers within an Active Directory (AD) site, you simply install more of them.

81461.book Page 49 Wednesday, December 12, 2007 4:49 PM

50

Chapter 2


Designing and Planning Server High Availability

When a message is placed in a Mailbox server’s submission queue, the Mailbox server noti-
fies a Hub Transport server in its AD site that the message is ready to be processed. If the Mail-
box server doesn’t reach the first Hub Transport server it tries to contact, then it just tries
another Hub Transport server in the same site, as shown in Figure 2.1.
If the Mailbox server can’t reach any Hub Transport servers in the same AD site, then
the message just sits in the submission queue until a Hub Transport server in the same AD site
is available.

You don’t need any clustering or load balancing to implement redundancy for
the Hub Transport role. When you install a Hub Transport server, it is listed in


81461.book Page 50 Wednesday, December 12, 2007 4:49 PM

Define High Availability Solutions Based on Client Types and Client Loads

51

Hub Transport Redundancy between Sites

Likewise, for site-to-site message-routing redundancy, you just need multiple Hub Transport
servers in each AD site. If a Hub Transport server in one site needs to route a message to
another site, then it retrieves the list of Hub Transport servers in the target site. If the first
server on the list is unavailable, then the sending Hub Transport server just tries the next one
on the list. If the second one isn’t available, it tries the next one and so on.
If none of the Hub Transport servers in the target site are available (if, for example, the WAN
link to that site is down), and if another route to that AD site is available for transferring mes-
sages, then the sending Hub Transport server will attempt to route the message through an inter-
mediary site. In that case, the sending Hub Transport server in the originating site retrieves the
list of Hub Transport servers that exist in the intermediary site and tries to route the message to
the first server on the list and, if that server is unavailable, then the sending Hub Transport server
tries each listed server until it finds an available Hub Transport server or exhausts the list. If that
happens, then the sending Hub Transport just looks for the next-higher-cost route to the original
destination site.

The list of Hub Transport servers in an AD site is delivered in round-robin
fashion. That is, each time a computer requests the list of Hub Transport serv-
ers for an AD site, the order of the list is rotated. For example, assume a site
has four Hub Transport servers: Hub-A, Hub-B, Hub-C, and Hub-D. When the
first request for Hub Transport servers is made, the list returned is “Hub-A,
Hub-B, Hub-C, Hub-D.” The second time the list is requested, the response is

Designing and Planning Server High Availability

FIGURE 2.2

Round-robin listing of Hub Transport servers

Implementing redundancy for Client Access servers is a little more complicated than for
Hub Transport servers, but not much. The first step is the same: install multiple servers in each
AD site with a Mailbox server. However, the Client Access servers installed in each site should
be load balanced. One option for load-balancing your Client Access servers is to use third-
party load-balancing hardware. Another option is to implement Windows Network Load
Balancing (NLB). NLB lets an administrator add a shared IP address to the network interface
cards (NICs) of all members in the NLB cluster. Because, from the client perspective, all Client
Access servers appear to be servers with identical content, NLB can be used for both high
availability and scalability.

Watch for the phrase “servers with identical content” whenever you take
a Microsoft exam. Whenever you see these words, ask yourself, “Will NLB
address this issue?” Most of the time you see that phrase, NLB is at least part

of the correct answer.
Active Directory site “Y”
Mailbox server
Response:
Hub Y-2, Hub-Y3,
Hub-Y1
Domain controller
Hub-Y1 Hub-Y2 Hub-Y3
AD site link
Active Directory site “X”

required for the Autodiscovery feature.

Implementing Network Load Balancing

NLB is supported on Windows 2000 Advanced Server, Windows 2000 Datacenter Server, and
all editions of Window Server 2003. NLB is implemented at the NIC level. To implement NLB,
you enable NLB in the properties of the NIC and configure the NLB properties, such as the
shared IP address and the fully qualified domain name (FQDN) of the cluster, and the dedicated
IP address this cluster member will use when communicating with other cluster members.
All members of an NLB cluster must be a member of the same IP subnet. (The shared IP address
must also be one of the IP addresses configured for the NIC in the IP properties.) Additionally, you
should attach your NLB cluster members to a hub rather than a switch. Because switches filter
packets based on media access control (MAC) address, it is highly possible that attaching your
NLB cluster members to a switch would interfere with the proper filtering/forwarding decision for
packets addressed to the virtual MAC address assigned to the shared IP address. Because hubs do
not filter packets, connecting your NLB cluster members to a hub then connecting that hub to a
switch eliminates this problem. An example of Client Access server configuration with NLB is
shown in Figure 2.3.
While you could use a virtual LAN (VLAN) to implement an NLB cluster by using cluster
members that are in different physical locations, few Exchange deployments would benefit
from such a configuration. Further, implementing an NLB cluster on the Internet-facing side
of cluster members that reside in different locations and have different Internet connections
would not load-balance across the Internet connections. Instead, all traffic would need to be
routed through one of the Internet connections and then directed internally to the NLB cluster
members in the other locations.

Round-Robin DNS

You could attempt to load-balance across Internet connections by using round-robin Address
(A) records in DNS. In fact, some might suggest using round-robin records instead of NLB


If you implement Unified Messaging, then you are using Exchange Server 2007 to manage phone
calls, voicemail, and faxes. Thus, if your Unified Messaging server, or any other component,
such as a Voice over IP (VoIP) gateway, fails, then your voice and fax services could be unavail-
able. This scenario is arguably even worse than losing email. So, if you’re going to implement
Unified Messaging, you must build redundancy into your Unified Messaging components.
Fortunately, implementing redundancy in your Unified Messaging isn’t very difficult. First
you should have multiple Unified Messaging servers in each site where you deploy Unified
Messaging servers. But beyond that, you must have multiple paths for the calls to reach the
Unified Messaging servers. This means you must have redundancy in your VoIP gateways.
Switch
Hub
Zone file

CAS A 192.168.0.10
CAS1 A 192.168.0.1
CAS2 A 192.168.0.2

DNS server
Mailbox server
Hub Transport server
Client Access server Client Access server
Unique: CAS1, 192.168.0.1
NLB: CAS, 192.168.0.10
Unique: CAS2, 192.168.0.2
NLB: CAS, 192.168.0.10

81461.book Page 54 Wednesday, December 12, 2007 4:49 PM

Define High Availability Solutions Based on Client Types and Client Loads


Full redundancy for Unified Messaging servers
1000
1000
Incoming call
on trunk line
PBX
Hunt group
Hunt group
VoIP gateway
Dial plan
Unified
Messaging server
Unified
Messaging server
Hub
Transport
server
Hub
Transport
server
Dial plan
Mailbox
server
VoIP gateway

81461.book Page 55 Wednesday, December 12, 2007 4:49 PM

56



of their email, calendars, contacts, or anything else stored in the mailbox. Thus,
the Mailbox server is clearly the most important role to make highly available.

Redundancy Options for Mailbox Servers

With previous versions of Exchange Server, Mailbox servers could be clustered to provide high
availability. Clustered Mailbox servers required Windows Clustering, which relies upon a
shared disk subsystem and expensive cluster-compatible hardware. This is still supported in
Exchange Server 2007, but there are some new options as well. Let’s look at all of the options,
starting with the traditional clustering.

Single Copy Cluster

Previously, Exchange Server supported both active/active and active/passive clustering. Active/
active clusters could contain only two nodes; in the event of a node failure, the remaining active
node had to do all of the work of the failed node as well as all of its own work. Active/passive clus-
ters, the preferred option, could contain up to eight nodes, one of which had to be passive and
ready to take over if one of the active nodes failed.
Exchange Server 2007 still supports traditional, shared-disk subsystem clustering. How-
ever, only active/passive clustering is supported. In Exchange Server 2007, a traditional cluster
is known as a

single copy cluster

(SCC). SCC still requires the expensive, specialized server
hardware that Windows clustering has always needed, which means that it’s not necessarily
the easiest option to configure for Mailbox high availability. An example of a three-node SCC
clustered mailbox implementation is shown in Figure 2.5.


group on another volume on the same Exchange Server 2007 computer. When LCR is used,
an administrator can quickly recover from a data-volume failure and nonreplicated database
corruption by mounting the backup database in place of the original production database.
When such an event occurs, the Exchange administrator must manually make the switch from
Logs
Database
Cluster resource
Logs
Database
Cluster resource
Shared storage system
Active
Mailbox server
Active
Mailbox server
Passive
Mailbox server
Private Network

81461.book Page 57 Wednesday, December 12, 2007 4:49 PM

58

Chapter 2


Designing and Planning Server High Availability

the production database to the backup copy. Thus, you should expect at least a few minutes
of downtime during the manual failover process.

in addition to the disks used for the operating
system, page file, and Exchange binaries. (However, you could put either the
active or passive database on the same LUN as those other files if you’re not
concerned about the performance degradation doing so introduces.)
An LCR Mailbox configuration is illustrated in Figure 2.6.
FIGURE 2.6 Local continuous replication (LCR) example
Active logs
Transaction logs
Passive logs
Active database Passive database
Transactions Transactions
Transactions
81461.book Page 58 Wednesday, December 12, 2007 4:49 PM
Define High Availability Solutions Based on Client Types and Client Loads
59
If you have the space for enough hard disks in the computer, then you could use local stor-
age, or directly attached storage devices (DASDs), for both your active and passive databases.
(External disk arrays that are directly connected to the Exchange Server computer are also
considered local storage.) However, in many cases you’ll want to use a SAN for at least some
of the storage. If you have to split your databases between local storage and SAN, leave the
active database on local storage and use the SAN for the passive database.
You should at least consider using NTFS mount points for your LCR databases and logs.
For example, you could create four empty folders, such as the following:

C:\ACTIVE.DB

C:\ACTIVE.LOG

C:\PASSIVE.DB



Designing and Planning Server High Availability
FIGURE 2.7 Cluster continuous replication (CCR) example
Suppose you need to implement high availability for Exchange Server 2007, but your budget
is limited and you can purchase only two servers. To implement high availability, you need
redundancy for all of the Exchange Server 2007 roles you’ll implement. That means one of the
things you’ll have to do is ensure that the Mailbox server role survives the failure of an entire
server. Implementing LCR doesn’t suffice because your backup database must reside on a
local volume; you cannot place an LCR backup on a network share, even if you map a drive
to that share. And, as noted later, in the section “Clustering and Server Roles,” clustered Mail-
box servers cannot host any other Exchange Server 2007 roles. Using CCR requires a mini-
mum of four servers for full redundancy: two for the clustered Mailbox servers, and two more
for redundancy of the other roles.
SCR, on the other hand, is a perfect solution in this situation. With SCR, you can place your
backup storage group on a different server. (In fact, you can use SCR to make multiple backup
copies on several servers; LCR and CCR offer only a single backup copy of the storage group.)
The idea is that you can put the backup on another server, even in another physical location,
without the overhead of Windows Clustering. Thus, like LCR, SCR requires a manual failover.
However, because SCR does not involve clustering, your SCR Mailbox servers can also host
the other server roles; you just need to configure the appropriate redundancy options for
those other roles.
File share witness
Active Mailbox server
Private network
Automatic failover
Passive Mailbox server
Active logs
Transaction logs
Passive logs
Active database Passive database

active node, but the active node does not receive communication that the passive node is taking
over, so both nodes think they’re the active one. Windows clustering avoids this by requiring a
majority node set to communicate for any node to operate as active. That means that more than
50 percent of the nodes must be communicating and agree on which servers should be active.
With SCC, you can elect to have up to eight nodes in the cluster, so long as at least one of
the nodes is passive. However, with CCR, you have just two nodes in the CCR cluster. So, in
order to have a majority node set with CCR, you can implement a Windows file share witness.
The file share witness is a shared folder on a Windows Server computer that is available to the
both the active and passive nodes on the private cluster network. The file share witness com-
puter can be running any Windows Server operating system; it does not need to have Windows
clustering configured.
Some best practices recommend that the file share witness be installed on a Hub
Transport server in the same AD site as the clustered Mailbox server. Presumably,
this recommendation is based on the idea that every Mailbox server needs to have
access to a Hub Transport server in the same AD site for message routing.
81461.book Page 61 Wednesday, December 12, 2007 4:49 PM
62
Chapter 2

Designing and Planning Server High Availability
When preparing to configure your CCR clusters, be sure to install either the
update described in Microsoft Knowledge Base article Q921181 (http://support
.microsoft.com/kb/921181/en-us) or Windows Server 2003 Service Pack 2 on all
of the computers that will participate in the cluster. This fix enables the use of the
Windows file share witness.
The second major difference between SCC and CCR Mailbox servers and all other Mailbox
servers is that when you implement SCC or CCR, you cannot deploy any other role on the clus-
tered Mailbox servers. This means that if you’re implementing a high-availability Exchange
Server 2007 solution and your Mailbox server uses SCC or CCR as part of its high-availability
strategy, then a minimum of four servers is required: the active Mailbox server; the passive Mail-

63
MX records, each pointing to a different Edge Transport server, or you can create one MX
record that points to a hostname for which you have created multiple A records. Figure 2.8
illustrates the use of multiple MX records for Edge Transport server redundancy.
FIGURE 2.8 Using multiple Mail Exchanger (MX) records to establish redundancy for
Edge Transport servers
Using multiple MX records is the preferred solution for two reasons:

MX records contain a weight or preference setting. Thus, if you choose, you can assign
different preferences to each of your Edge Transport servers and thereby control the order
in which a sending sever attempts to transfer messages to your network.

In addition the limitations of round-robin A records mentioned previously in the chapter,
relying on round-robin for high availability can cause problems with some older SMTP
servers. When round-robin is used, an A-record query for the name of the inbound SMTP
must be answered with multiple IP addresses. Some older SMTP servers will only try to
contact the first IP address listed when an A-record query is answered with multiple IP
addresses. Thus, if you have a long-term outage of one of your SMTP servers and rely
upon round-robin instead of multiple MX records, it’s very likely that some inbound mail
will be returned to the sender as undeliverable.
Zone file
edge2.exchange2007.tld
208.215.129.148
…
edge1 A 208.215.129.147
edge2 A 208.215.129.148
exchange2007.tld IN MX 10 edge1.exchange2007.tld
exchange2007.tld IN MX 10 edge2.exchange2007.tld

DNS server

is that you really should take a layered approach by protecting your systems at as many levels
as you can. We call that defense-in-depth. For messaging systems, it means not only scanning
the messages themselves on the messaging server for viruses and spam, but scanning the oper-
ating system and files on the server; scanning the messages and files at the client; and scanning
the data at security perimeters, such as firewalls and gateways, as that traffic passes through
our network.
Antivirus Scanning
It is highly recommended that your defense-in-depth approach also include scanning tools
from multiple vendors. Think about it: What is the point of scanning for viruses and spam at
all of these different places if your tools all come from the same vendor and, therefore, use the
same definition files? If you did that, then anything that was missed at the firewall is going
to be missed at the gateway, the server, and the client too. Microsoft Forefront Security for
Exchange Server (formerly Microsoft Antigen) is a tool that includes nine different scanning
engines in one product, and those different engines (along with the definition files from the
respective vendors) can be used to significantly increase the likelihood that you’ll intercept
whatever the latest virus or spam threat is.
81461.book Page 64 Wednesday, December 12, 2007 4:49 PM
Plan Policies to Handle Unsolicited Email and Virus Outbreaks
65
Although Forefront Security for Exchange Server includes nine different
scanning engines, you can only configure it to use five or fewer for any
individual job. And it’s recommended that you use only the default Real-
time Scan Job running most of the time. However, if you have multiple
Exchange Server 2007 servers, then you can configure Forefront Security
for Exchange Server to use different engines on different servers to max-
imize the likelihood of catching the latest malware.
Forefront Security for Exchange Server includes additional advanced features, such as the
stamping of scanned messages and the use of different scanning agents for Mailbox, Hub
Transport, and Edge Transport servers.
File-Based Virus Scanning on Exchange Server Computers

ment filtering strips by adding or removing file extensions from the list.
Exchange Server 2007 Antispam Features
If you implement Edge Transport servers, you can configure a new option called safe sender
list aggregation to reduce the number of false positives for spam filtering. In Outlook, each
user can add users to a list of safe senders. Safe senders are assumed to never send spam. The
idea behind safe sender aggregation is that if one user says that a particular sender is safe, then
that sender is unlikely to be sending spam to anyone. So, when safe sender list aggregation is
enabled, the Edge Transport servers, through the EdgeSync process, retrieves every user’s safe
sender list and combines then into a single list of safe senders who will not have their messages
filtered at the Edge Transport server level.
Exchange Server 2007 can be configured to use a number of methods for blocking inbound
messages that may be spam. These methods include connection filters, Sender ID filtering, use
of real-time block lists, content filtering, and consideration of sender reputation.
Connection filters do just what their name implies: filter inbound messages based on the source
of the connection itself. That is, the Exchange Server computer compares the IP address of the
SMTP server that is sending the message to IP Block and IP Allow lists configured for Exchange.
Sender ID filtering is based upon Sender Policy Framework (SPF) technology, which uses
DNS records to attempt to validate the legitimacy of the message. With Sender ID, Exchange
queries the DNS server for the SMTP domain listed for the message sender. For example, you
could configure SPF records in DNS to indicate that all servers referenced by your MX records
are valid senders, or you could use SPF records to explicitly list the valid outbound mail servers
for your domain. If the message is being sent from a valid sending IP address or a valid sending
server listed in that domain’s SPF records, then the message is accepted. However, if the mes-
sage is coming from an address that isn’t listed as valid for the SMTP domain, then you can
configure Exchange to drop the message, bounce it back to the sender, or accept the message
but flag it as suspicious.
Real-time block lists (RBLs) are third-party services that attempt to provide continuously
updated information on domains or IP addresses that are actively sending spam. IP-based
RBLs are considered to be more reliable than domain-based RBLs because anyone sending
spam is likely using a falsified email address anyway. Be aware that, even if you use IP-based

responsibility for some of the more difficult-to-manage aspects of maintaining an Exchange
Server organization to Microsoft or third-party Microsoft Partners.
TABLE 2.1 Methods for Blocking Inbound Messages in Exchange Server 2007
Method Description
Connection filtering Messages are blocked or allowed based on the source IP address.
Sender ID filtering Messages are blocked or flagged because the sender doesn’t
match policy specified by the DNS records.
Real-time block lists Messages are blocked because a third-party RBL provider says that
domain or IP address is sending spam.
Content filtering Messages are blocked based on keywords and patterns within
the message.
Sender reputation Messages are blocked based on recent behavior of the sender.
81461.book Page 67 Wednesday, December 12, 2007 4:49 PM
68
Chapter 2

Designing and Planning Server High Availability
With Exchange Hosted Filtering, you redirect your MX records to the hosted filtering servers.
Those servers block unwanted messages and scan all email for viruses before forwarding the
remaining messages to your Exchange system. This process is illustrated in Figure 2.9.
FIGURE 2.9 Exchange Hosted Filtering example
Several third parties also offer similar hosted filtering services.
Anti-Malware Product Considerations
Although Exchange Server 2007 includes some very comprehensive antispam and antivirus
features, you might elect to use third-party products along with or instead of the Microsoft
Internet
Zone file
edge
exchange2007.tld IN
exchange2007.tld IN

Exchange hosted
filtering servers
Scanned/clean
email message
Query:
MX for
“exchange2007.tld”?
81461.book Page 68 Wednesday, December 12, 2007 4:49 PM
Plan Policies to Handle Unsolicited Email and Virus Outbreaks
69
offerings. Some of the things you should consider when selecting third-party products for anti-
virus and antispam include the following:

Frequency and timeliness of engine and definition updates

Ease of and automation for obtaining and deploying engine and definition updates

Administration features

User notification and “quarantine release” options

Vendor reputation and technical support

Exchange Server 2007 integration and support
Updates for Exchange Server 2007 and Forefront Security products are deliv-
ered through Microsoft Updates. You can ensure your Exchange Server 2007
computers get these updates by configuring Automatic Updates, implement-
ing Windows Server Update Services (WSUS), or using the Inventory Tool
for Microsoft Updates (ITMU) with the Distribute Software Updates Wizard in
Microsoft Systems Management Server (SMS) 2003.

maintaining a highly available Exchange Server 2007 system. Use defense-in-depth techniques
and comprehensive antispam and antivirus policies to maintain message hygiene.
Exam Essentials
Understand how to interpret SLA requirements Be able to identify and interpret SLA require-
ments in exam scenarios. Understand how to translate SLA requirements into feature configura-
tions. For example, if an exam scenario says that OW must remain available even if two servers
fail, know that you’ll need at least three Client Access servers configured as an NLB cluster.
Your organization is going to get spam. There is no perfect filtering solution because spammers
are always adjusting their tactics to beat the latest filtering techniques. But if you encounter a
significant increase in the number of spam messages that get through your filtering processes,
try to find a key word or phrase common to most of those messages and add that to your con-
tent-filtering keyword list. You may want to do that on a temporary basis, until your antispam
product definitions are updated to deal with the new technique. If the spam outbreak contains
phishing messages, be sure to also educate your users about the scam.
If you have a virus outbreak, then practice good virus containment and cleaning techniques:
1. Disconnect from the Internet.
2. Isolate the known infected systems from everything else. If possible, also isolate the
known clean systems from the systems you’re not sure about.
3. Use a stand-alone computer to connect to the Internet and download the latest virus
fixes, antivirus engines, antivirus definition, and other applicable software updates.
4. Clean and/or protect all of your systems with the newly obtained software.
5. Verify the integrity of your operating systems, programs, and data before reconnecting
any of the isolated computers.
6. Reconnect to the Internet and resume email transfer.
81461.book Page 70 Wednesday, December 12, 2007 4:49 PM
Exam Essentials
71
Understand how to implement high availability for each Exchange Server 2007 role For
the Hub Transport role, simply add additional Hub Transport servers in each AD site that needs
high availability. For the Client Access server role, implement NLB clusters for high availability.

into Exchange Server 2007. Know how to evaluate Hosted Services and third-party product
offerings. Know what to do when measures fail.
81461.book Page 71 Wednesday, December 12, 2007 4:49 PM
72
Chapter 2

Designing and Planning Server High Availability
Review Questions
1. You are designing an Exchange Server 2007 solution for your company. Your company has 900
employees who use email. The hardware design of your Mailbox servers will support up to 300
mailbox users, but the hardware does not support shared-disk clustering. Your network consists of
a single Active Directory site. Your users will use Microsoft Office Outlook 2007 and Microsoft
Office Outlook Web Access to access their mailboxes. Neither the Edge Transport nor Unified
Messaging roles will be deployed. You need to design a highly available Exchange solution. Users
must not be affected by the failure of a single server. Your design must use the fewest number of
servers possible. How many Exchange Server 2007 computers should you deploy?
A. 3
B. 4
C. 6
D. 8
E. 10
2. You are implementing a highly available Exchange Server 2007 solution for your company.
Your Mailbox servers are deployed as CCR clustered Mailbox servers. One Client Access
server and one Hub Transport server have been deployed in each Active Directory (AD) site.
You need to implement high availability for the Hub Transport and Client Access server roles.
Which of the following actions should you perform? (Select two.)
A. Install additional Hub Transport servers in each AD site.
B. Install additional Hub Transport servers in each AD site and configure network load
balancing (NLB).
C. Install additional Client Access servers in any AD site.