Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 91:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering. You need to ensure that when users log on to client computers, they are added automatically to the local Administrators group. The users must be removed from the group when they log off of the client computers.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the Group Policy object (GPO) to the Sales OU.
  J. Link the Group Policy object (GPO) to the Engineering OU.
  H. Configure Group Policy Preferences.

  ---

  Reference:

  http://daniel.streefkerkonline.com/managing-local-admins-using-gpp/ http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/

• Question 92:

  Your network contains an Active Directory domain named adatum.com. You need to ensure that IP addresses can be resolved to fully qualified domain names (FQDNs).

  Under which node in the DNS snap-in should you add a zone?

  A. Reverse Lookup Zones
  B. adatum.com
  C. Forward Lookup Zones
  D. Conditional Forwarders
  E. _msdcs.adatum.com
  A. Reverse Lookup Zones

  ---

  Reference:

  Mastering Microsoft Windows Server 2008 R2 (Sybex, 2010) page 193 A forward lookup means the client provides a fully qualified domain name and the DNS server returns an IP address. A reverse lookup does the opposite: the client

  provides an IP address, and then the DNS server returns an FQDN.

• Question 93:

  Your company has file servers located in an organizational unit named Payroll. The file servers contain payroll files located in a folder named Payroll.

  You create a GPO.

  You need to track which employees access the Payroll files on the file servers.

  What should you do?

  A. Enable the Audit process tracking option. Link the GPO to the Domain Controllers organizational unit. On the file servers, configure Auditing for the Authenticated Users group in the Payroll folder.
  B. Enable the Audit object access option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder.
  C. Enable the Audit process tracking option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder.
  D. Enable the Audit object access option. Link the GPO to the domain. On the domain controllers, configure Auditing for the Authenticated Users group in the Payroll folder.
  B. Enable the Audit object access option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder.

  ---

  Answer: Enable the Audit object access option. Link the GPO to the Payroll organizational unit. On the file servers, configure Auditing for the Everyone group in the Payroll folder.

  http://technet.microsoft.com/en-us/library/dd349800%28v=ws.10%29.aspx Audit Policy

  Establishing an organizational computer system audit policy is an important facet of information security.

  Configuring Audit policy settings that monitor the creation or modification of objects gives you a way to track potential security problems, helps to ensure user accountability, and provides evidence in the event of a security breach.

  There are nine different kinds of events for which you can specify Audit Policy settings. If you audit any of these kinds of events, Windows?records the events in the Security log, which you can find in Event Viewer.

  ..

  Object access. Audit this to record when someone has used a file, folder, printer, or other object.

  ..

  Process tracking. Audit this to record when events such as program activation or a process exiting occur.

  ..

  When you implement Audit Policy settings:

  ..

  If you want to audit directory service access or object access, determine which objects you want to audit access of and what type of access you want to audit. For example, if you want to audit all attempts by users to open a particular file, you

  can configure audit policy settings in the object access event category so that both successful and failed attempts to read a file are recorded.

  Further information:

  http://technet.microsoft.com/en-us/library/hh147307%28v=ws.10%29.aspx Group Policy for Beginners

  Group Policy Links

  At the top level of AD DS are sites and domains. Simple implementations will have a single site and a single domain. Within a domain, you can create organizational units (OUs). OUs are like folders in Windows Explorer.

  Instead of containing files and subfolders, however, they can contain computers, users, and other objects.

  For example, in Figure 1 you see an OU named Departments. Below the Departments OU, you see four subfolders: Accounting, Engineering, Management, and Marketing. These are child OUs. Other than the Domain Controllers OU that you

  see in Figure 1, nothing else in the figure is an OU. What does this have to do with Group Policy links? Well, GPOs in the Group Policy objects folder have no impact unless you link them to a site, domain, or OU. When you link a GPO to a

  container, Group Policy applies the GPO's settings to the computers and users in that container.

• Question 94:

  Your company uses a Windows 2008 Enterprise certificate authority (CA) to issue certificates.

  You need to implement key archival.

  What should you do?

  A. Configure the certificate for automatic enrollment for the computers that store encrypted files.
  B. Install an Enterprise Subordinate CA and issue a user certificate to users of the encrypted files.
  C. Apply the Hisecdc security template to the domain controllers.
  D. Archive the private key on the server.
  D. Archive the private key on the server.

  ---

  Answer: Archive the private key on the server.

  http://technet.microsoft.com/en-us/library/cc753011.aspx Enable Key Archival for a CA

  Before a key recovery agent can use a key recovery certificate, the key recovery agent must have enrolled for the key recovery certificate and be registered as the recovery agent for the certification authority (CA).

  You must be a CA administrator to complete this procedure.

  To enable key archival for a CA:

  1.

  Open the Certification Authority snap-in.

  2.

  In the console tree, click the name of the CA.

  3.

  On the Action menu, click Properties.

  4.

  Click the Recovery Agents tab, and then click Archive the key.

  5.

  In Number of recovery agents to use, type the number of key recovery agents that will be used to encrypt the archived key. The Number of recovery agents to use must be between one and the number of key recovery agent certificates that have been configured.

  6.

  Click Add. Then, in Key Recovery Agent Selection, click the key recovery certificates that are displayed, and click OK.

  7.

  The certificates should appear in the Key recovery agent certificates list, but their status is listed as Not loaded.

  8.

  Click OK or Apply. When prompted to restart the CA, click Yes. When the CA has restarted, the status of the certificates should be listed as Valid.

  Further information: http://technet.microsoft.com/en-us/library/ee449489%28v=ws.10%29.aspx Key Archival and Management in Windows Server 2008 http://technet.microsoft.com/en-us/library/cc730721.aspx Managing Key Archival and Recovery

• Question 95:

  Your network contains an Active Directory domain. The domain contains several domain controllers.

  All domain controllers run Windows Server 2008 R2.

  You need to restore the Default Domain Policy Group Policy object (GPO) to the Windows Server 2008 R2 default settings.

  What should you do?

  A. Run dcgpofix.exe /target:dc.
  B. Run dcgpofix.exe /target:domain.
  C. Delete the link for the Default Domain Controllers Policy, and then run gpupdate.exe /force.
  D. Delete the link for the Default Domain Controllers Policy, and then run gpupdate.exe /sync.
  B. Run dcgpofix.exe /target:domain.

• Question 96:

  Your network contains two Active Directory forests named contoso.com and fabrikam.com. Each forest contains one domain. A two-way forest trust exists between the forests.

  You plan to add users from fabrikam.com to groups in contoso.com.

  You need to identify which group you must use to assign users in fabrikam.com access to the shared folders in contoso.com.

  To which group should you add the users?

  A. Group 1: Security Group - Domain Local.
  B. Group 2: Distribution Group - Domain Local.
  C. Group 3: Security Group - Global.
  D. Group 4: Distribution Group - Global.
  E. Group 5: Security Group - Universal.
  F. Group 6: Distribution Group - Universal.
  C. Group 3: Security Group - Global.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc772808.aspx

  Best practices for using security groups across forests

  By carefully using domain local, global, and universal groups, administrators can more effectively control access to resources located in other forests. Consider the following best practices:

  To represent the sets of users who need access to the same types of resources, create role-based global groups in every domain and forest that contains these users. For example, users in the Sales Department in ForestA require access to

  an order-entry application that is a resource in ForestB. Account Department users in ForestA require access to the same application, but these users are in a different domain. In ForestA, create the global group SalesOrder and add users in

  the Sales Department to the group.

  Create the global group AccountsOrder and add users in the Accounting Department to that group. To group the users from one forest who require similar access to the same resources in a different forest, create universal groups that

  correspond to the global group roles. For example, in ForestA, create a universal group called SalesAccountsOrders and add the global groups SalesOrder and AccountsOrder to the group.

  To assign permissions to resources that are to be accessed by users from a different forest, create resource-based domain local groups in every domain and use these groups to assign permissions on the resources in that domain. For

  example, in ForestB, create a domain local group called OrderEntryApp. Add this group to the access control list (ACL) that allows access to the order entry application, and assign appropriate permissions.

  To implement access to a resource across a forest, add universal groups from trusted forests to the domain local groups in the trusting forests. For example, add the SalesAccountsOrders universal group from ForestA to the OrderEntryApp

  domain local group in ForestB.

• Question 97:

  Your network contains a single Active Directory domain.

  A domain controller named DC2 fails.

  You need to remove DC2 from Active Directory.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. At the command prompt, run dcdiag.exe /fix.
  B. At the command prompt, run netdom.exe remove dc2.
  C. From Active Directory Sites and Services, delete DC2.
  D. From Active Directory Users and Computers, delete DC2.
  C. From Active Directory Sites and Services, delete DC2.
  D. From Active Directory Users and Computers, delete DC2.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc816907.aspx Clean Up Server Metadata Metadata cleanup is a required procedure after a forced removal of Active Directory Domain Services (AD DS). You perform metadata cleanup on a domain controller in the domain of the domain controller that you forcibly removed. Metadata cleanup removes data from AD DS that identifies a domain controller to the replication system. Clean up server metadata by using GUI tools Clean up server metadata by using Active Directory Users and Computers

  1.

  Open Active Directory Users and Computers: On the Start menu, point to Administrative Tools, and then click Active Directory Users and Computers.

  2.

  Expand the domain of the domain controller that was forcibly removed, and then click Domain Controllers.

  3.

  In the details pane, right-click the computer object of the domain controller whose metadata you want to clean up, and then click Delete. Clean up server metadata by using Active Directory Sites and Services

  1.

  Open Active Directory Sites and Services: On the Start menu, point to Administrative Tools, and then click Active Directory Sites and Services

  2.

  Expand the site of the domain controller that was forcibly removed, expand Servers, expand the name of the domain controller, right-click the NTDS Settings object, and then click Delete.

• Question 98:

  You have an enterprise subordinate certification authority (CA).

  You have a custom Version 3 certificate template.

  Users can enroll for certificates based on the custom certificate template by using the Certificates console. The certificate template is unavailable for Web enrollment. You need to ensure that the certificate template is available on the Web enrollment pages.

  What should you do?

  A. Run certutil.exe Cpulse.
  B. Run certutil.exe Cinstallcert.
  C. Change the certificate template to a Version 2 certificate template.
  D. On the certificate template, assign the Autoenroll permission to the users.
  C. Change the certificate template to a Version 2 certificate template.

  ---

  Identical to F/Q12.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc732517.aspx

  Certificate Web enrollment cannot be used with version 3 certificate templates.

  Reference 2:

  http://blogs.technet.com/b/ad/archive/2008/06/30/2008-web-enrollment-and-version-3-templates.aspx The reason for this blog post is that one of our customers called after noticing some unexpected behavior when they were trying to use the

  Server 2008 certificate web enrollment page to request a Version 3 Template based certificate. The problem was that no matter what they did the Version 3 Templates would not appear as certificates which could be requested via the web

  page. On the other hand, version 1 and 2 templates did appear in the page and requests could be done successfully using those templates.

• Question 99:

  Your network contains an Active Directory domain named adatum.com. All servers run Windows Server 2008 R2 Enterprise. All client computers run Windows 7 Professional.

  The network contains an enterprise certification authority (CA). You have a custom certificate template named Sales_Temp. Sales_Temp is published to the CA.

  You need to ensure that all of the members of a group named Sales can enroll for certificates that use Sales_Temp.

  Which snap-in should you use?

  A. Enterprise PKI
  B. Certification Authority
  C. Share and storage Management
  D. Certificate Templates
  E. Security Configuration Wizard
  F. Authorization Manager
  G. Group Policy Management
  H. Certificates
  I. Active Directory Administrative Center
  D. Certificate Templates

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc770794.aspx

  Deploying Certificate Templates

  After creating a new certificate template, the next step is to deploy the certificate template so that a certification authority (CA) can issue certificates based on it.

  Deployment includes publishing the certificate template to one or more CAs, defining which security principals have Enroll permissions for the certificate template, and deciding whether to configure autoenrollment for the certificate template.

  To define permissions to allow a specific security principal to enroll for certificates based on a certificate template

  1.

  Open the Certificate Templates snap-in (Certtmpl.msc).

  2.

  In the details pane, right-click the certificate template you want to change, and then click Properties.

  3.

  On the Security tab, ensure that Authenticated users is assigned Read permissions. This ensures that all authenticated users on the network can see the certificate templates.

  4.

  On the Security tab, click Add. Add a global group or universal group that contains all security principals requiring Enroll permissions for the certificate template, and then click OK.

  5.

  On the Security tab, select the newly added security group, and then assign Allow for the Read and Enroll permissions.

  6.

  Click OK.

  Permission Design

  Use the following recommendations for permissions assignments:

  Assign permissions only to global groups or to universal groups. It is not recommended to assign permissions to domain local groups. Domain local groups are only recognized in the domain where they exist, and assigning permissions to

  them can result in inconsistent application of permissions. You should not assign permissions directly to an individual user or computer account. (...)

• Question 100:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering. You have two Group Policy objects (GPOs) named GPO1 and GPO2. GPO1 and

  GPO2 are linked to the Sales OU and contain multiple settings.

  You discover that GPO2 has a setting that conflicts with a setting in GPO1. When the policies are applied, the setting in GPO2 takes effect.

  You need to ensure that the settings in GPO1 supersede the settings in GPO2. The solution must ensure that all non-conflicting settings in both GPOs are applied.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Sales OU.
  J. Link the GPO to the Engineering OU.
  C. Configure the link order.