Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 1:

  Your network contains an Active Directory domain named adatum.com.

  You need to use Group Policies to deploy the line-of-business applications shown in the following table.

  

  What should you do? To answer, drag the appropriate deployment method to the correct application in the answer area.

  Select and Place:

  

  

  ---

  Reference:

  technet.microsoft.com/en-us/library/cc783502.aspx

  Software installation

  You can use the Software Installation extension of Group Policy to centrally manage software distribution in your organization. You can assign and publish software for groups of users and computers using this extension.

  Assigning Applications

  When you assign applications to users or computers, the applications are automatically installed on their computers at logon (for user-assigned applications) or startup (for computer-assigned applications.)

  When assigning applications to users, the default behavior is that the application will be advertised to the computer the next time the user logs on. This means that the application shortcut appears on the Start menu, and the registry is updated

  with information about the application, including the location of the application package and the location of the source files

  for the installation. With this advertisement information on the user's computer, the application is installed the first time the user tries to use the application. In addition to this default behavior, Windows XP Professional and Windows Server

  2003 clients support an option to fully install the package at logon, as an alternative to installation upon first use. Note that if this option is set, it is ignored by computers running Windows 2000, which will always advertise user-assigned

  applications.

  When assigning applications to computers, the application is installed the next time the computer boots up.

  Applications assigned to computers are not advertised, but are installed with the default set of features configured for the package. Assigning applications through Group Policy requires that the application setup is authored as a Windows

  Installer (.msi) package.

  Publishing Applications

  You can also publish applications to users, making the application available for users to install.

  To install a published application, users can use Add or Remove Programs in Control Panel, which includes a list of all published applications that are available for them to install.

  Alternatively, if the administrator has selected the Auto-install this application by file extension activation feature, users can open a document file associated with a published application. For example, double clicking an .xls file will trigger the

  installation of Microsoft Excel, if it is not already installed. Publishing applications only applies to user policy; you cannot publish

  applications to computers.

• Question 2:

  Your company has a single Active Directory domain named intranet.adatum.com. The domain controllers run Windows Server 2008 and the DNS server role. All computers, including non-domain members, dynamically register their DNS records.

  You need to configure the intranet.adatum.com zone to allow only domain members to dynamically register DNS records.

  What should you do?

  A. Set dynamic updates to Secure Only.
  B. Remove the Authenticated Users group.
  C. Enable zone transfers to Name Servers.
  D. Deny the Everyone group the Create All Child Objects permission.
  A. Set dynamic updates to Secure Only.

  ---

  Answer: Set dynamic updates to Secure Only.

  http://technet.microsoft.com/en-us/library/cc753751.aspx Allow Only Secure Dynamic Updates

  Domain Name System (DNS) client computers can use dynamic update to register and dynamically update their resource records with a DNS server whenever changes occur. This reduces the need for manual administration of zone records,

  especially for clients that frequently move or change locations and use Dynamic Host Configuration Protocol (DHCP) to obtain an IP address. Dynamic updates can be secure or nonsecure. DNS update security is available only for zones that

  are integrated into Active Directory Domain Services (AD DS). After you directory-integrate a zone, access control list (ACL) editing features are available in DNS Manager so that you can add or remove users or groups from the ACL for a

  specified zone or resource record.

  Further information:

  http://technet.microsoft.com/en-us/library/cc771255.aspx Understanding Dynamic Update

• Question 3:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain. The AD DS infrastructure is shown in the following graphic.

  

  When the Montreal site domain controller is offline, authentication requests for Montreal branch office users are sent to the Toronto site domain controller.

  You need to ensure that when the Montreal Site domain controller is offline, authentication requests forMontreal branch office users are sent to the Quebec City site domain controller.

  What should you do?

  A. Create a site link bndge between the Montreal site and the Quebec City site.
  B. Enable the global catalog role on the Montreal site domain controller.
  C. Modify the Default Domain Policy Group Policy Object.
  D. Delete the Toronto-Montreal Site Link
  C. Modify the Default Domain Policy Group Policy Object.

  ---

  Reference 1: http://technet.microsoft.com/en-us/library/cc772592.aspx

  Enable Clients to Locate a Domain Controller in the Next Closest Site You can modify the Default Domain Policy to enable Windows Vista and Windows Server 2008 clients in the domain to locate domain controllers in the next closest site if no domain controller in their own site or the closest site is available.

  To enable clients to locate a domain controller in the next closest site

  1.

  Click Start, click Administrative Tools, and then click Group Policy Management.

  2.

  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  3.

  Double-click Forest:forest_name, double-click Domains, and then double-click domain_name.

  4.

  Right-click Default Domain Policy, and then click Edit.

  5.

  In Group Policy Management Editor, in the console tree, go to Computer Configuration/Policies/ Administrative Templates/System/Netlogon/DC Locator DNS Records.

  6.

  In the details pane, double-click Try Next Closest Site, click Enabled, and then click OK.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc733142.aspx

  Enabling Clients to Locate the Next Closest Domain Controller If you have a domain controller that runs Windows Server 2008 or Windows Server 2008 R2, you can make it possible for client computers that run Windows Vista, Windows 7,

  Windows Server 2008, or Windows Server 2008 R2 to locate domain controllers more efficiently by enabling the Try Next Closest Site Group Policy setting. This setting improves the Domain Controller Locator (DC Locator) by helping to

  streamline network traffic, especially in large enterprises that have many branch offices and sites.

  By default, the Try Next Closest Site setting is not enabled. When the setting is not enabled, DC Locator uses the following algorithm to locate a domain controller:

  Try to find a domain controller in the same site.

  If no domain controller is available in the same site, try to find any domain controller in the domain. If you enable the Try Next Closest Site setting, DC Locator uses the following algorithm to locate a domain controller:

  Try to find a domain controller in the same site.

  If no domain controller is available in the same site, try to find a domain controller in the next closest site. A site is closer if it has a lower site-link cost than another site with a higher site-link cost. If no domain controller is available in the next

  closest site, try to find any domain controller in the domain.

• Question 4:

  Your company has an Active Directory forest. Each regional office has an organizational unit (OU) named Marketing. The Marketing OU contains all users and computers in the region's Marketing department.

  You need to install a Microsoft Office 2007 application only on the computers in the Marketing OUs.

  You create a GPO named MarketingApps.

  What should you do next?

  A. Configure the GPO to assign the application to the computer account. Link the GPO to the domain.
  B. Configure the GPO to assign the application to the user account. Link the GPO to each Marketing OU.
  C. Configure the GPO to assign the application to the computer account. Link the GPO to each Marketing OU.
  D. Configure the GPO to publish the application to the user account. Link the GPO to each Marketing OU.
  C. Configure the GPO to assign the application to the computer account. Link the GPO to each Marketing OU.

  ---

  We need to assign the software to the computers, and link the GPO to each Marketing OU. We do not link it to the domain, then every computer would have the software.

  Reference:

  http://support.microsoft.com/kb/816102

  You can use Group Policy to distribute computer programs by using the following methods:

  Assigning Software You can assign a program distribution to users or computers. If you assign the program to a user, it is installed when the user logs on to the computer. When the user first runs the program, the installation is completed. If

  you assign the program to a computer, it is installed when the computer starts, and it is available to all users who log on to the computer. When a user first runs the program, the installation is completed.

  Publishing Software

  You can publish a program distribution to users. When the user logs on to the computer, the published program is displayed in the Add or Remove Programs dialog box, and it can be installed from there.

• Question 5:

  Your network contains an Active Directory forest named contoso.com. You need to identify the Password Setting object (PSO) applied to a user named User1. Which cmdlet should you run?

  A. Get-AdFineGrainedPasswordPolicy
  B. Get-AdFineGrainedPasswordPolicySubject
  C. Get- AdUserResultantPasswordPolicy
  D. Get-AdDefaultDomainPasswordPolicy
  C. Get- AdUserResultantPasswordPolicy

• Question 6:

  Your network contains an Active Directory forest named contoso.com. The forest contains two sites named Seattle and Montreal. The Seattle site contains two domain controllers. The domain controllers are configured as shown in the following table.

  

  You need to enable universal group membership caching in the Seattle site.

  Which object's properties should you modify? To answer, select the appropriate object in the answer area.

  Hot Area:

  

  

  ---

  Reference:

  http://http://technet.microsoft.com/en-us/magazine/ff797984.aspx

  Configure Universal Group Membership Caching in Active Directory

  You can enable or disable universal group membership caching by following these steps:

  1. In Active Directory Sites And Services, expand and then select the site you want to work with.

  2. In the details pane, right-click NTDS Site Settings, and then click Properties.

  3. To enable universal group membership caching, select the Enable Universal Group Membership Caching check box on the Site Settings tab. Then, in the Refresh Cache From list, choose a site from which to cache universal group memberships. The selected site must have a working global catalog server.

  4. To disable universal group membership caching, clear the Enable Universal Group Membership Caching check box on the Site Settings tab.

  5. Click OK.

• Question 7:

  Your network contains an Active Directory domain named adatum.com. All servers run Windows Server 2008 R2 Enterprise. All client computers run Windows 7 Professional. The network contains an enterprise certification authority (CA). You enable key archival on the CA. The CA is configured to use custom certificate templates for Encrypted File System (EFS) certificates.

  All users plan to encrypt files by using EFS.

  You need to ensure that the private keys for all new EFS certificates are archived.

  Which snap-in should you use?

  A. Share and Storage Management
  B. Security Configuration wizard
  C. Enterprise PKI
  D. Active Directory Administrative Center
  E. Certification Authority
  F. Group Policy Management
  G. Certificate Templates
  H. Authorization Manager
  I. Certificates
  G. Certificate Templates

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753826.aspx

  Configure a Certificate Template for Key Archival The key archival process takes place when a certificate is issued. Therefore, a certificate template must be modified to archive keys before any certificates are issued based on this template. Key archival is strongly recommended for use with the Basic Encrypting File System (EFS) certificate template in order to protect users from data loss, but it can also be useful when applied to other types of certificates.

  To configure a certificate template for key archival and recovery

  1.

  Open the Certificate Templates snap-in.

  2.

  In the details pane, right-click the certificate template that you want to change, and then click Duplicate Template.

  3.

  In the Duplicate Template dialog box, click Windows Server 2003 Enterprise unless all of your certification authorities (CAs) and client computers are running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.

  4.

  In Template, type a new template display name, and then modify any other optional properties as needed.

  5.

  On the Security tab, click Add, type the name of the users or groups you want to issue the certificates to, and then click OK.

  6.

  Under Group or user names, select the user or group names that you just added. Under Permissions, select the Read and Enroll check boxes, and if you want to automatically issue the certificate, also select the Autoenroll check box.

  7.

  On the Request Handling tab, select the Archive subject's encryption private key check box.

• Question 8:

  Your network contains a single Active Directory domain that has two sites named Site1 and Site2. Site1 has two domain controllers named DC1 and DC2. Site2 has two domain controllers named DC3 and DC4.

  DC3 fails.

  You discover that replication no longer occurs between the sites. You verify the connectivity between DC4 and the domain controllers in Site1.

  On DC4, you run repadmin.exe /kcc.

  Replication between the sites continues to fail.

  You need to ensure that Active Directory data replicates between the sites.

  What should you do?

  A. From Active Directory Sites and Services, configure the NTDS Site Settings of Site2.
  B. From Active Directory Sites and Services, configure DC3 so it is not a preferred bridgehead server.
  C. From Active Directory Users and Computers, configure the NTDS settings of DC4.
  D. From Active Directory Users and Computers, configure the location settings of DC4.
  B. From Active Directory Sites and Services, configure DC3 so it is not a preferred bridgehead server.

  ---

  Reference:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) pages 193, 194

  Bridgehead Servers A bridgehead server is the domain controller designated by each site's KCC to take control of intersite replication. The bridgehead server receives information replicated from other sites and replicates it to its site's other

  domain controllers. It ensures that the greatest portion of replication occurs within sites rather than between them.

  In most cases, the KCC automatically decides which domain controller acts as the bridgehead server. However, you can use Active Directory Sites and Services to specify which domain controller will be the preferred bridgehead server by

  using the following steps:

  1.

  In Active Directory Sites and Services, expand the site in which you want to specify the preferred bridgehead server.

  2.

  Expand the Servers folder to locate the desired server, right-click it, and then choose Properties.

  3.

  From the list labeled Transports available for intersite data transfer, select the protocol(s) for which you want to designate this server as a preferred bridgehead server and then click Add.

• Question 9:

  Your network contains an Active Directory forest named contoso.com.

  You plan to migrate all user accounts to a new forest named litwareinc.com.

  The functional level of the contoso.com forest is Windows Server 2003. Contoso.com contains four servers.

  The servers are configured as shown in the following table.

  

  The functional level of the litwareinc.com forest is Windows Server 2008. Litwareinc.com contains four servers. The servers are configured as shown in the following table.

  

  You need to identify on which server in the litwareinc.com forest you must install Active Directory Migration Tool version 3.2 (ADMT v3.2). Which server should you identify?

  A. Litw_Srv4
  B. Litw_Srv1
  C. Litw_Srv2
  D. Litw_Srv3
  D. Litw_Srv3

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc974370.aspx

  Prerequisites for installing ADMT v3.2

  Although you can use ADMT v3.2 to migrate accounts and resources from Active Directory environments that have a domain functional level of Windows Server 2003 or later, you can install ADMT v3.2 only on a server running Windows

  Server 2008 R2.

  In addition to running Windows Server 2008 R2, the server computer that you use to install ADMT v3.2 must not be installed under the Server Core installation option or be running as a read-only domain controller (RODC).

• Question 10:

  A corporate network includes an Active Directory-integrated zone. AIl DNS servers that host the zone are domain controllers.

  You add multiple DNS records to the zone.

  You need to ensure that the new records are available on all DNS servers as soon as possible.

  Which tool should you use?

  A. Active Directory Sites And Services console
  B. Ntdsutil
  C. Dnslint
  D. Nslookup
  A. Active Directory Sites And Services console

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc794809.aspx

  Forcing Replication

  When you need updates to be replicated sooner than the intersite replication schedule allows, or when replication between sites is impossible because of configuration errors, you can force replication to and from domain controllers.

  Forcing replication of all directory updates over a connection If you want to replicate certain updates, such as a significant addition of new passwords or user accounts, to another domain controller in the domain, you can use the Replicate

  now option in the Active Directory Sites and Services snap-in to force replication of all directory partitions over a connection object that represents inbound replication from a specific domain controller. A connection object for a server object

  that represents a domain controller identifies the replication partner from which the domain controller receives replication. If the changes are made on one domain controller, you can select the connection from that domain controller and force

  replication to its replication partner.

  You can also use the Repadmin.exe command-line tool to replication changes from a server to one or more other servers or to all servers.

  ssniyer -- In the case where (Exam J, Q24) Repadmin is not an answer option, I will go with AD Sites and Services because it allows to force AD replication across connection objects. Both DNSLint and nslookup are diagnostic tools. DNSLint

  is useful to make sure RRs are associated with the right services and nslookup for domain namespace resolution issues. There is no diagnostic need in this question.

  Dnscmd is useful to administer/maintain a DNS server or zone using a command line tool. It is also the right tool to create Application Directory Partition. However, I don't see literature to suggest it as a good replication tool for AD integrated

  zones.