Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 111:

  Your network contains an Active Directory domain named contoso.com.

  You remove several computers from the network.

  You need to ensure that the host (A) records for the removed computers are automatically deleted from the contoso.com DNS zone.

  What should you do?

  A. Configure dynamic updates.
  B. Configure aging and scavenging.
  C. Create a scheduled task that runs the Dnscmd /ClearCache command.
  D. Create a scheduled task that runs the Dnscmd /ZoneReload contoso.com command.
  B. Configure aging and scavenging.

  ---

  

  http://technet.microsoft.com/en-us/library/cc816625%28v=ws.10%29.aspx Set Aging and Scavenging Properties for a Zone The DNS Server service supports aging and scavenging features. These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time. You can use this procedure to set the aging and scavenging properties for a specific zone using either the DNS Manager snap-in or the dnscmd command-line tool. To set aging and scavenging properties for a zone using the Windows interface

  1.

  Open DNS Manager. To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  2.

  In the console tree, right-click the applicable zone, and then click Properties.

  3.

  On the General tab, click Aging.

  4.

  Select the Scavenge stale resource records check box.

  5.

  Modify other aging and scavenging properties as needed. To set aging and scavenging properties for a zone using a command line

  1.

  Open a command prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2.

  At the command prompt, type the following command, and then press ENTER:

  dnscmd /Config {/Aging |/RefreshInterval |/ NoRefreshInterval }

  

• Question 112:

  Your company has a main office and a branch office that are configured as a single Active Directory forest. The functional level of the Active Directory forest is Windows Server 2003. There are four Windows Server 2003 domain controllers in the main office.

  You need to ensure that you are able to deploy a read-only domain controller (RODC) at the branch office.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Raise the functional level of the forest to Windows Server 2008.
  B. Deploy a Windows Server 2008 domain controller at the main office.
  C. Raise the functional level of the domain to Windows Server 2008.
  D. Run the adprep/rodcprep command.
  B. Deploy a Windows Server 2008 domain controller at the main office.
  D. Run the adprep/rodcprep command.

  ---

  http://technet.microsoft.com/en-us/library/cc731243%28v=ws.10%29.aspx Prerequisites for Deploying an RODC

  Complete the following prerequisites before you deploy a read-only domain controller (RODC):

  Ensure that the forest functional level is Windows Server 2003 or higher Run Adprep.exe commands to prepare your existing forest and domains for domain controllers that run Windows Server 2008 or Windows Server 2008 R2. The adprep

  commands extend the Active Directory schema and update security descriptors so that you can add the new domain controllers. There are different versions of Adprep.exe for Windows Server 2008 and Windows Server 2008 R2.

  1. Prepare the forest and domains. There are three adprep commands to complete and have the changes replicate throughout the forest. Run the three commands as follows:

  *

  Prepare the forest by running adprep /forestprep on the server that holds the schema master operations master (also known as flexible single master operations or FSMO) role to update the schema.

  *

  Prepare the domain by running adprep /domainprep /gpprep on the server that holds the infrastructure operations master role.

  *

  If you are installing an RODC in an existing Windows Server 2003 domain, you must also run adprep /rodcprep.

  2. Install Active Directory Domain Services (AD DS). You can install AD DS by using a wizard, the command line, or an answer file.

  Deploy at least one writable domain controller running Windows Server 2008 or Windows Server 2008 R2 in the same domain as the RODC and ensure that the writable domain controller is also a DNS server that has registered a name server (NS) resource record for the relevant DNS zone. An RODC must replicate domain updates from a writable domain controller running Windows Server 2008 or Windows Server 2008 R2.

• Question 113:

  You have a domain controller that runs the DHCP service.

  You need to perform an offline defragmentation of the Active Directory database on the domain controller.

  You must achieve this goal without affecting the availability of the DHCP service.

  What should you do?

  A. Restart the domain controller in Directory Services Restore Mode. Run the Disk Defragmenter utility.
  B. Restart the domain controller in Directory Services Restore Mode. Run the Ntdsutil utility.
  C. Stop the Active Directory Domain Services service. Run the Ntdsutil utility.
  D. Stop the Active Directory Domain Services service. Run the Disk Defragmenter utility.
  C. Stop the Active Directory Domain Services service. Run the Ntdsutil utility.

  ---

  We don't need to restart the server to defragment the AD database. We do need to stop AD DS in order to defragment the database.

  Reference:

  http://technet.microsoft.com/en-us/library/cc794920.aspx

  To perform offline defragmentation of the directory database

  1.

  Open a Command Prompt as an administrator: On the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, provide credentials, if required, and then click Continue.

  2.

  At the command prompt, type the following command, and then press ENTER: net stop ntds

  3.

  Type Y to agree to stop additional services, and then press ENTER.

  4.

  At the command prompt, type ntdsutil, and then press ENTER.

• Question 114:

  Your network contains two Active Directory forests named contoso.com and nwtraders.com. A two- way forest trust exists between contoso.com and nwtraders.com. The forest trust is configured to use selective authentication.

  Contoso.com contains a server named Server1. Server1 contains a shared folder named Marketing. Nwtraders.com contains a global group named G_Marketing.

  The Change share permission and the Modify NTFS permission for the Marketing folder are assigned to the G_Marketing group. Members of G_Marketing report that they cannot access the Marketing folder.

  You need to ensure that the G_Marketing members can access the folder from the network.

  What should you do?

  A. From Windows Explorer, modify the NTFS permissions of the folder.
  B. From Windows Explorer, modify the share permissions of the folder.
  C. From Active Directory Users and Computers, modify the computer object for Server1.
  D. From Active Directory Users and Computers, modify the group object for G_Marketing.
  C. From Active Directory Users and Computers, modify the computer object for Server1.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 643-644 After you have selected Selective Authentication for the trust, no trusted users will be able to access resources in the trusting domain, even if those

  users have been given permissions. The users must also be assigned the Allowed To Authenticate permission on the computer object in the domain.

  To assign this permission:

  1.

  Open the Active Directory Users And Computers snap-in and make sure that Advanced Features is selected on the View menu.

  2.

  Open the properties of the computer to which trusted users should be allowed to authenticate--that is, the computer that trusted users will log on to or that contains resources to which trusted users have been given permissions.

  3.

  On the Security tab, add the trusted users or a group that contains them and select the Allow check box for the Allowed To Authenticate permission.

• Question 115:

  Your network contains an Active Directory domain.

  You need to activate the Active Directory Recycle Bin in the domain.

  Which tool should you use?

  A. Dsamain
  B. Add-PSSnapin
  C. Enable-ADOptionalFeature
  D. Add-WindowsFeature
  C. Enable-ADOptionalFeature

  ---

  You can enable Active Directory Recycle Bin by using the following methods:

  *

  Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.)

  *

  Ldp.exe

  Note:

  Before you can make the recycle bin available, you must first update Active Directory schema with the required attributes. When you do this, the schema is updated, and then every object in the forest is updated with the recycle bin attributes

  as well. This process is irreversible once it is started.

• Question 116:

  You manage an Active Directory forest named contoso.com.

  The forest contains an empty root domain named contoso.com and a child domain named child.contoso.com.

  All domain controllers run Windows Server 2008. The functional level of the forest is Windows Server 2008.

  You need to raise the functional level of the forest to Windows Server 2008 R2. You must achieve this goal by using the minimum amount of administrative effort.

  What should you do? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  To upgrade the forest level to Windows Server 2008 R2 we need to upgrade the servers first.

  And before we upgrade the servers we need to prepare the domain and forest using adprep.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc771949.aspx

  Caution Do not raise the forest functional level to Windows Server 2008 R2 if you have or will have any domain controllers running Windows Server 2008 or earlier.

  Reference 2:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 96

  The Adprep Utility

  Microsoft provides the Adprep utility to prepare a down-level Active Directory domain for receiving Windows Server 2008 and Windows Server 2008 R2 domain controllers. Found in the \sources\adprep folder of the installation DVD-ROM, this

  tool prepares the forest and domain by extending the Active Directory schema and updating several required permissions.

  Running the Adprep /forestprep Command

  You must run the Adprep /forestprep command on the schema master of the forest first. It extends the schema to receive the new Windows Server 2008 enhancements, including the

  addition of directory descriptors for certain objects including granular password policies. You have to run this command and let its changes replicate throughout the forest before you run the Adprep /domainprep command.

  Reference 3:

  Not really relevant, but some info on why using an empty root domain is no longer preferable:

  http://blogs.technet.com/b/askds/archive/2010/05/07/friday-mail-sack-tweener-clipart-comicsedition.aspx#adempty

• Question 117:

  Your network contains an Active Directory forest named contoso.com. You plan to add a new domain named nwtraders.com to the forest.

  All DNS servers are domain controllers.

  You need to ensure that the computers in nwtraders.com can update their Host (A) records on any of the DNS servers in the forest.

  What should you do?

  A. Add the computer accounts of all the domain controllers to the DnsAdmins group.
  B. Add the computer accounts of all the domain controllers to the DnsUpdateProxy group.
  C. Create a standard primary zone on a domain controller in the forest root domain.
  D. Create an Active Directory-integrated zone on a domain controller in the forest root domain.
  D. Create an Active Directory-integrated zone on a domain controller in the forest root domain.

• Question 118:

  Your network contains an Active Directory domain named contoso.com. All servers are located in the same Active Directory site. The domain contains two domain controllers named DC1 and DC2. Both domain controllers host an Active Directory-integrated zone for contoso.com.

  The Start of Authority (SOA) record of the contoso.com zone is shown in the exhibit. (Click the Exhibit button.)

  

  You have a member server named Server1. Server1 hosts a secondary zone of contoso.com.

  On DC1, you add a new record to the contoso.com zone.

  In the table below, identify the maximum amount of time required to replicate the record to each server. Make only one selection in each column.

  Hot Area:

  

  

  ---

  Note:

  * If you use Active Directory integrated DNS when you configure a domain controller as a DNS name server, zone data is stored as an Active Directory object and is replicated as part of domain replication.

  * Most of the Domain Name System (DNS) zone settings that you can change control how the zone is transferred between primary and secondary servers.

  * Refresh interval

  Refresh interval it is use to regulate the secondary DNS server at what interval the secondary DNS server can request a copy of the zone transfer.

  The refresh interval, which is how often the zone is transferred

  The time, in seconds, that a secondary DNS server waits before querying its source for the zone to attempt renewal of the zone. When the refresh interval expires, the secondary DNS server requests a copy of the current SOA record for the zone from its source, which answers this request. The secondary DNS server then compares the serial number of the source server's current SOA record (as indicated in the response) with the serial number in its own local SOA record. If they are different, the secondary DNS server requests a zone transfer from the primary DNS server.

• Question 119:

  Your network contains an Active Directory forest named contoso.com. The forest contains five domains. You have a shortcut trust between two of the domains.

  You need to validate that the trust is operating properly.

  What should you use?

  A. Dsmod
  B. Set-ADForest
  C. Netdom
  D. Dsadd
  E. Netsh
  C. Netdom

• Question 120:

  Your company has an Active Directory domain named ad.contoso.com. The domain has two domain controllers named DC1 and DC2. Both domain controllers have the DNS server role installed.

  You install a new DNS server named DNS1.contoso.com on the perimeter network. You configure DC1 to forward all unresolved name requests to DNS1.contoso.com. You discover that the DNS forwarding option is unavailable on DC2.

  You need to configure DNS forwarding on the DC2 server to point to the DNS1.contoso.com server.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Clear the DNS cache on DC2.
  B. Configure conditional forwarding on DC2.
  C. Configure the Listen On address on DC2.
  D. Delete the Root zone on DC2.
  B. Configure conditional forwarding on DC2.
  D. Delete the Root zone on DC2.

  ---

  Answer: Delete the Root zone on DC2.

  Configure conditional forwarding on DC2.

  http://technet.microsoft.com/en-us/library/cc754941.aspx Configure a DNS Server to Use Forwarders A forwarder is a Domain Name System (DNS) server on a network that is used to forward DNS queries for external DNS names to DNS servers outside that network. You can also configure your server to forward queries according to specific domain names using conditional forwarders. http://social.technet.microsoft.com/Forums/en-US/winserverNIS/hread/0ca38ece-d76e-42f0-85d5- a342f9e169f5/

  Deleting .root dns zone in 2008 DNS

  Q: We have 2 domain controllers and .root zone is created in the DNS. Due to which the external name resolution is not possible. I had tried to add conditional forwarders but i get an error saying that conditional forwarders cannot be created on root DNS servers. A 1: If you have a "root" zone created in your DNS, and you no longer want that configuration, you can just simply delete that zone. There is no reason to have a root "." zone hosted unless you want to make sure that the DNS server is authoritative for all queries and not allow the DNS server to go elsewhere for name resolution.

  If you delete this zone, the DNS server will be able to use its root hints, or fowarders to resolve queries for zones its not authoritative for.

  A 2: That was from the old 2000 days where DCPROMO would create it if it detected no internet access while promoting the first DC. Jut remove it, and the Forwarders option reappear.

  Further information:

  http://support.microsoft.com/kb/298148

  How To Remove the Root Zone (Dot Zone)

  http://technet.microsoft.com/en-us/library/cc731879%28v=ws.10%29.aspx Reviewing DNS Concepts

  Delegation For a DNS server to answer queries about any name, it must have a direct or indirect path to every zone in the namespace. These paths are created by means of delegation. A delegation is a record in a parent zone that lists a

  name server that is authoritative for the zone in the next level of the hierarchy.

  Delegations make it possible for servers in one zone to refer clients to servers in other zones. The following illustration shows one example of delegation.

  

  The DNS root server hosts the root zone represented as a dot ( . ). The root zone contains a delegation to a zone in the next level of the hierarchy, the com zone.

  The delegation in the root zone tells the DNS root server that, to find the com zone, it must contact the Com server. Likewise, the delegation in the com zone tells the Com server that, to find the contoso.com zone, it must contact the Contoso server. Note: A delegation uses two types of records. The name server (NS) resource record provides the name of an authoritative server. Host (A) and host (AAAA) resource records provide IP version 4 (IPv4) and IP version 6 (IPv6) addresses of an authoritative server. This system of zones and delegations creates a hierarchical tree that represents the DNS namespace. Each zone represents a layer in the hierarchy, and each delegation represents a branch of the tree. By using the hierarchy of zones and delegations, a DNS root server can find any name in the DNS namespace.

  The root zone includes delegations that lead directly or indirectly to all other zones in the hierarchy. Any server that can query the DNS root server can use the information in the delegations to find any name in the namespace.