Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 101:

  You have an Active Directory domain named contoso.com.

  You need to view the account lockout threshold and duration for the domain.

  Which tool should you use?

  A. Computer Management
  B. Net Config
  C. Active Directory Users and Computers
  D. Gpresult
  C. Active Directory Users and Computers

  ---

  You can see the required settings when you:

  1.

  Open Active Directory Users and Computers

  2.

  Go to View in the menubar and make sure "Advanced Features"is checked.

  3.

  Right click on the domain and choose Properties

  4.

  On the Attribute Editor tab click on Filter

  5.

  Ensure that the Show attributes/Optional check box is selected.

  6.

  In the Attributes list locate lockoutThreshold and lockoutDuration. Played with the settings in the Group Policy Management Editor and the settings were reflected in the steps above every time.

• Question 102:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com.

  You attempt to run adprep /domainprep and the operation fails. You discover that the first domain controller deployed to the forest failed.

  You need to run adprep /domainprep successfully.

  What should you do?

  A. Move the domain naming master role.
  B. Install a read-only domain controller (RODC).
  C. Move the PDC emulator role.
  D. Move the RID master role.
  E. Move the infrastructure master role.
  F. Deploy an additional global catalog server.
  G. Move the bridgehead server.
  H. Move the schema master role.
  I. Restart the Active Directory Domain Services (AD DS) service.
  J. Move the global catalog server.
  E. Move the infrastructure master role.

  ---

  Adprep /domainprep must be run on the server holding the Infrastructure Master role. The role was originally installed on the first domain controller in the forest.

  Now it's down and another domain controller must get the Infrastructure Master role.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc754889.aspx

  Planning Operations Master Role Placement

  Operations master role holders are assigned automatically when the first domain controller in a given domain is created. The two forest-level roles (schema master and domain naming master) are assigned to the first domain controller

  created in a forest. In addition, the three domain-level roles (RID master, infrastructure master, and PDC emulator) are assigned to the first domain controller created in a domain.

  Reference 2:

  http://technet.microsoft.com/en-us/library/dd464018.aspx

  Adprep /domainprep Must be run on the infrastructure operations master for the domain.

• Question 103:

  ABC.com boasts a main office and 20 branch offices. Configured as a separate site, each branch office has a Read-Only Domain Controller (RODC) server installed.

  Users in remote offices complain that they are unable to log on to their accounts.

  What should you do to make sure that the cached credentials for user accounts are only stored in their local branch office RODC server?

  A. Open the RODC computer account security tab and set Allow on the Receive as permission only for the users that are unable to log on to their accounts
  B. Add a password replication policy to the main Domain RODC and add user accounts in the security group
  C. Configure a unique security group for each branch office and add user accounts to the respective security group. Add the security groups to the password replication allowed group on the main RODC server
  D. Configure and add a separate password replication policy on each RODC computer account
  D. Configure and add a separate password replication policy on each RODC computer account

  ---

  http://technet.microsoft.com/en-us/library/cc730883%28v=ws.10%29.aspx Password Replication Policy

  When you initially deploy an RODC, you must configure the Password Replication Policy on the writable domain controller that will be its replication partner. The Password Replication Policy acts as an access control list (ACL). It determines if an RODC should be permitted to cache a password. After the RODC receives an authenticated user or computer logon request, it refers to the Password Replication Policy to determine if the password for the account should be cached. The same account can then perform subsequent logons more efficiently. The Password Replication Policy lists the accounts that are permitted to be cached, and accounts that are explicitly denied from being cached. The list of user and computer accounts that are permitted to be cached does not imply that the RODC has necessarily cached the passwords for those accounts. An administrator can, for example, specify in advance any accounts that an RODC will cache. This way, the RODC can authenticate those accounts, even if the WAN link to the hub site is offline.

• Question 104:

  You need to ensure that domain controllers only replicate between domain controllers in adjacent sites.

  What should you configure from Active Directory Sites and Services?

  A. From the IP properties, select Ignore all schedules.
  B. From the IP properties, select Disable site link bridging.
  C. From the NTDS Settings object, manually configure the Active Directory Domain Services connection objects.
  D. From the properties of the NTDS Site Settings object, configure the Inter-Site Topology Generator for each site.
  B. From the IP properties, select Disable site link bridging.

  ---

  http://www.omnisecu.com/windows-2003/active-directory/what-is-site-link-bridge.htm What is Site Link Bridge and How to create Site Link Bridge A site link bridge connects two or more site links. A site link bridge enables transitivity between site links. Each site link in a bridge must have a site in common with another site link in the bridge. By default, all site links are transitive and it is recommended to keep transitivity enabled by not changing the default value of "Bridge all site links" (enabled by default).

  

  We may need to disable "Bridge all site links" and create a site link bridge design if ?When the IP network is not fully routed. When we need to control the replication flow in Active Directory.

• Question 105:

  You deploy a new Active Directory Federation Services (AD FS) federation server. You request new certificates for the AD FS federation server. You need to ensure that the AD FS federation server can use the new certificates.

  To which certificate store should you import the certificates?

  A. Computer
  B. IIS Admin Service service account
  C. Local Administrator
  D. World Wide Web Publishing Service service account
  A. Computer

  ---

  http://technet.microsoft.com/en-us/library/dd378922%28v=ws.10%29.aspx#BKMK_13 Step 2: Installing AD FS Role Services and Configuring Certificates To import the server authentication certificate for adfsresource to adfsweb

  1.

  Click Start, click Run, type mmc, and then click OK.

  2.

  Click File, and then click Add/Remove Snap-in.

  3.

  Select Certificates, click Add, click Computer account, and then click Next.

  4.

  Click Local computer: (the computer this console is running on), click Finish, and then click OK.

  5.

  In the console tree, double-click the Certificates (Local Computer) icon, double-click the Trusted Root Certification Authorities folder, right-click Certificates, point to All Tasks, and then click Import.

  6.

  On the Welcome to the Certificate Import Wizard page, click Next.

  7.

  On the File to Import page, type \\adfsresource\d$\adfsresource.pfx, and then click Next.

  8.

  On the Password page, type the password for the adfsresource.pfx file, and then click Next.

  9.

  On the Certificate Store page, click Place all certificates in the following store, and then click Next.

  10.

  On the Completing the Certificate Import Wizard page, verify that the information you provided is accurate, and then click Finish.

• Question 106:

  A corporate network includes an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers.

  You add multiple DNS records to the zone.

  You need to ensure that the new records are available on all DNS servers as soon as possible.

  Which tool should you use?

  A. Ldp
  B. Repadmin
  C. Ntdsutil
  D. Nslookup
  E. Active Directory Sites And Services console
  F. Active Directory Domains And Trusts console
  G. Dnslint
  H. Dnscmd
  B. Repadmin

  ---

  To make sure that the new DNS records are replicated to all DNS servers we can use the repadmin tool.

  Reference:

  http://technet.microsoft.com/en-us/library/cc811569.aspx

  Forcing Replication

  Sometimes it becomes necessary to forcefully replicate objects and entire partitions between domain controllers that may or may not have replication agreements.

  Force a replication event with all partners

  The repadmin /syncall command synchronizes a specified domain controller with all replication partners.

  Syntax

  repadmin /syncall [] []

  Parameters

  Specifies the host name of the domain controller to synchronize with all replication partners.

  Specifies the distinguished name of the directory partition.

  Performs specific actions during the replication.

• Question 107:

  A network contains an Active Directory forest. The forest contains three domains and two sites. You remove the global catalog from a domain controller named DC2. DC2 is located in Site1.

  You need to reduce the size of the Active Directory database on DC2. The solution must minimize the impact on all users in Site1.

  What should you do first?

  A. On DC2, start the Protected Storage service.
  B. On DC2, stop the Active Directory Domain Services service.
  C. Start DC2 in Safe Mode.
  D. Start DC2 in Directory Services Restore Mode.
  B. On DC2, stop the Active Directory Domain Services service.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc816811.aspx

  Returning Unused Disk Space from the Active Directory Database to the File System During ordinary operation, the free disk space in the Active Directory database file becomes fragmented. Each time garbage collection runs (every 12

  hours, by default), free disk space is automatically defragmented online to optimize its use within the database file. The unused disk space is maintained for the database; it is not returned to the file system.

  Only offline defragmentation can return unused disk space from the directory database to the file system.

  When database contents have decreased considerably through a bulk deletion (for example, when you remove the global catalog from a domain controller), or if the size of the database backup is significantly increased as a result of the

  amount of free disk space, use offline defragmentation to reduce the size of the Ntds.dit file.

  On domain controllers that are running Windows Server 2008, offline defragmentation does not require restarting the domain controller in Directory Services Restore Mode (DSRM), as is required on domain controllers that are running

  versions of Windows Server 2000 and Windows Server 2003. You can use a new feature in Windows Server 2008, restartable Active Directory Domain Services (AD DS), to stop the AD DS service. When the service is stopped, services that

  depend on AD DS shut down automatically. However, any other services that are running on the domain controller, such as Dynamic Host Configuration Protocol (DHCP), continue to run and respond to clients.

• Question 108:

  Your company has a main office and three branch offices. Each office is configured as a separate Active Directory site that has its own domain controller.

  You disable an account that has administrative rights.

  You need to immediately replicate the disabled account information to all sites. What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.)

  A. From the Active Directory Sites and Services console, configure all domain controllers as global catalog servers.
  B. From the Active Directory Sites and Services console, select the existing connection objects and force replication.
  C. Use Repadmin.exe to force replication between the site connection objects.
  D. Use Dsmod.exe to configure all domain controllers as global catalog servers.
  B. From the Active Directory Sites and Services console, select the existing connection objects and force replication.
  C. Use Repadmin.exe to force replication between the site connection objects.

  ---

  http://technet.microsoft.com/en-us/library/cc835086%28v=ws.10%29.aspx Repadmin /syncall Synchronizes a specified domain controller with all of its replication partners. http://ivan.dretvic.com/2012/01/how-to-force-replication-of-domaincontrollers/ How to force replication of Domain Controllers From time to time its necessary to kick off AD replication to speed up a task you may be doing, or just a good too to check the status of replication between DC's.

  Below is a command to replicate from a specified DC to all other DC's. Repadmin /syncall DC_name /Aped By running a repadmin /syncall with the /A(ll partitions) P(ush) e(nterprise, cross sites) d(istinguished names) parameters, you have duplicated exactly what Replmon used to do in Windows 2003, except that you did it in one step, not many.And with the benefit of seeing immediate results on how the operations are proceeding. If I am running it on the DC itself, I don't even have to specify the server name. http://technet.microsoft.com/en-us/library/cc776188%28v=ws.10%29.aspx Force replication over a connection To force replication over a connection

  1. Open Active Directory Sites and Services.

  

• Question 109:

  Your network contains an Active Directory domain. The domain contains several domain controllers.

  You need to modify the Password Replication Policy on a read-only domain controller (RODC).

  Which tool should you use?

  A. Group Policy Management
  B. Active Directory Domains and Trusts
  C. Active Directory Users and Computers
  D. Computer Management
  E. Security Configuration Wizard
  C. Active Directory Users and Computers

  ---

  Reference: http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy.aspx

  Administering the Password Replication Policy This topic describes the steps for viewing, configuring, and monitoring the Password Replication Policy (PRP) and password caching for read-only domain controllers (RODCs). To configure the PRP using Active Directory Users and Computers

  1.

  Open Active Directory Users and Computers as a member of the Domain Admins group.

  2.

  Ensure that you are connected to a writeable domain controller running Windows Server 2008 in the correct domain.

  3.

  Click Domain Controllers, and in the details pane, right-click the RODC computer account, and then click Properties.

  4.

  Click the Password Replication Policy tab.

  5.

  The Password Replication Policy tab lists the accounts that, by default, are defined in the Allowed list and the Deny list on the RODC. To add other groups that should be included in either the Allowed list or the Deny list, click Add.

  To add other accounts that will have credentials cached on the RODC, click Allow passwords for the account to replicate to this RODC.

  To add other accounts that are not allowed to have credentials cached on the RODC, click Deny passwords for the account from replicating to this RODC.

• Question 110:

  Your company has two Active Directory forests named contoso.com and fabrikam.com. Both forests run only domain controllers that run Windows Server 2008.

  The domain functional level of contoso.com is Windows Server 2008. The domain functional level of fabrikam.com is Windows Server 2003 Native mode.

  You configure an external trust between contoso.com and fabrikam.com.

  You need to enable the Kerberos AES encryption option.

  What should you do?

  A. Raise the forest functional level of fabrikam.com to Windows Server 2008.
  B. Raise the domain functional level of fabrikam.com to Windows Server 2008.
  C. Raise the forest functional level of contoso.com to Windows Server 2008.
  D. Create a new forest trust and enable forest-wide authentication.
  B. Raise the domain functional level of fabrikam.com to Windows Server 2008.

  ---

  Answer: Raise the domain functional level of fabrikam.com to Windows Server 2008.

  http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels %28v=ws.10%29.aspx

  Understanding Active Directory Domain Services (AD DS) Functional Levels Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server

  operating systems you can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems you can run on workstations and member servers that are joined to the domain or forest.

  ..

  Features that are available at domain functional levels ..

  Windows Server 2008

  All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available:

  ..

  * Advanced Encryption Standard (AES 128 and AES 256) support for the Kerberos protocol. In order for

  TGTs to be issued using AES, the domain functional level must be Windows Server 2008 or higher and the domain password needs to be changed.

  ...

  Further information:

  http://technet.microsoft.com/en-us/library/cc749438%28WS.10%29.aspx Kerberos Enhancements

  ..

  Requirements

  All Kerberos authentication requests involve three different parties: the client requesting a connection, the server that will provide the requested data, and the Kerberos KDC that provides the keys that are used to protect the various

  messages.

  This discussion focuses on how AES can be used to protect these Kerberos authentication protocol messages and data structures that are exchanged among the three parties. Typically, when the parties are operating systems running

  Windows Vista or Windows Server 2008, the exchange will use AES. However, if one of the parties is an operating system running Windows 2000 Professional, Windows 2000 Server, Windows XP, or Windows Server 2003, the exchange will

  not use AES.