Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 121:

  Your network contains an Active Directory domain controller named DC1. DC1 runs Windows Server 2008 R2.

  You need to defragment the Active Directory database on DC1. The solution must minimize downtime on DC1.

  What should you do first?

  A. At the command prompt, run net stop ntds.
  B. At the command prompt, run net stop netlogon.
  C. Restart DC1 in Safe Mode.
  D. Restart DC1 in Directory Services Restore Mode (DSRM).
  A. At the command prompt, run net stop ntds.

  ---

  We don't need to restart the server to defragment the AD database. We only need to stop AD DS in order to defragment the database, using ntdsutil.

  Reference:

  http://technet.microsoft.com/en-us/library/cc794920.aspx

  To perform offline defragmentation of the directory database

  1.

  Open a Command Prompt as an administrator.

  2.

  At the command prompt, type the following command, and then press ENTER: net stop ntds

  3.

  Type Y to agree to stop additional services, and then press ENTER.

  4.

  At the command prompt, type ntdsutil, and then press ENTER.

• Question 122:

  A corporate network includes an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers. You add multiple DNS records to the zone.

  You need to ensure that the new records are available on all DNS servers as soon as possible.

  Which tool should you use?

  A. Repadmin
  B. Active Directory Domains and Trusts console
  C. Ldp
  D. Ntdsutil
  A. Repadmin

  ---

  To make sure that the new DNS records are replicated to all DNS servers we can use the repadmin tool.

  Reference:

  http://technet.microsoft.com/en-us/library/cc811569.aspx

  Forcing Replication

  Sometimes it becomes necessary to forcefully replicate objects and entire partitions between domain controllers that may or may not have replication agreements.

  Force a replication event with all partners

  The repadmin /syncall command synchronizes a specified domain controller with all replication partners.

  Syntax

  repadmin /syncall [] []

  Parameters Specifies the host name of the domain controller to synchronize with all replication partners.

  Specifies the distinguished name of the directory partition.

  Performs specific actions during the replication.

• Question 123:

  You have an Active Directory domain that runs Windows Server 2008 R2. You need to implement a certification authority (CA) server that meets the following requirements: Allows the certification authority to automatically issue certificates Integrates with Active Directory Domain Services

  What should you do?

  A. Install and configure the Active Directory Certificate Services server role as a Standalone Root CA.
  B. Install and configure the Active Directory Certificate Services server role as an Enterprise Root CA.
  C. Purchase a certificate from a third-party certification authority, Install and configure the Active Directory Certificate Services server role as a Standalone Subordinate CA.
  D. Purchase a certificate from a third-party certification authority, Import the certificate into the computer store of the schema master.
  B. Install and configure the Active Directory Certificate Services server role as an Enterprise Root CA.

  ---

  http://technet.microsoft.com/en-us/library/cc776874%28v=ws.10%29.aspx Enterprise certification authorities

  The Enterprise Administrator can install Certificate Services to create an enterprise certification authority (CA).

  Enterprise CAs can issue certificates for purposes such as digital signatures, secure e-mail using S/MIME (Secure Multipurpose Internet Mail Extensions), authentication to a secure Web server using Secure Sockets Layer (SSL) or Transport

  Layer Security (TLS) and logging on to a Windows Server 2003 family domain using a smart card.

  An enterprise CA has the following features:

  An enterprise CA requires the Active Directory directory service. When you install an enterprise root CA, it uses Group Policy to propagate its certificate to the Trusted Root Certification Authorities certificate store for all users and computers

  in the domain. You must be a Domain Administrator or be an administrator with write access to Active Directory to install an enterprise root

  CA.

  Certificates can be issued for logging on to a Windows Server 2003 family domain using smart cards. The enterprise exit module publishes user certificates and the certificate revocation list (CRL) to Active Directory. In order to publish

  certificates to Active Directory, the server that the CA is installed on must be a member of the Certificate Publishers group. This is automatic for the domain the server is in, but the server must be delegated the proper security permissions to

  publish certificates in other domains. For more information about the exit module, see Policy and exit modules. An enterprise CA uses certificate types, which are based on a certificate template. The following functionality is possible when you

  use certificate templates:

  Enterprise CAs enforce credential checks on users during certificate enrollment. Each certificate template has a security permission set in Active Directory that determines whether the certificate requester is authorized to receive the type of

  certificate they have requested. The certificate subject name can be generated automatically from the information in Active Directory or supplied explicitly by the requestor.

  The policy module adds a predefined list of certificate extensions to the issued certificate. The extensions are defined by the certificate template. This reduces the amount of information a certificate requester has to provide about the

  certificate and its intended use.

  http://technet.microsoft.com/en-us/library/cc780501%28WS.10%29.aspx Stand-alone certification authorities You can install Certificate Services to create a stand-alone certification authority (CA). Stand-alone CAs can issue certificates for

  purposes such as digital signatures, secure e-mail using S/MIME (Secure Multipurpose Internet Mail Extensions) and authentication to a secure Web server using Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

  A stand-alone CA has the following characteristics:

  Unlike an enterprise CA, a stand-alone CA does not require the use of the Active Directory directory service. Stand-alone CAs are primarily intended to be used as Trusted Offline Root CAs in a CA hierarchy or when extranets and the Internet

  are involved. Additionally, if you want to use a custom policy module for a CA, you would first install a stand-alone CA and then replace the stand-alone policy module with your custom policy module.

  When submitting a certificate request to a stand-alone CA, a certificate requester must explicitly supply all identifying information about themselves and the type of certificate that is wanted in the certificate request. (This does not need to be

  done when submitting a request to an enterprise CA, since the enterprise user's information is already in Active Directory and the certificate type is described by a certificate template). The authentication information for requests is obtained

  from the local computer's Security Accounts Manager database.

  By default, all certificate requests sent to the stand-alone CA are set to Pending until the administrator of the stand-alone CA verifies the identity of the requester and approves the request. This is done for security reasons, because the

  certificate requester's credentials are not verified by the stand-alone CA.

  Certificate templates are not used.

  No certificates can be issued for logging on to a Windows Server 2003 family domain using smart cards, but other types of certificates can be issued and stored on a smart card. The administrator has to explicitly distribute the stand-alone

  CA's certificate to the domain user's trusted root store or users must perform that task themselves. When a stand-alone CA uses Active Directory, it has these additional features:

  If a member of the Domain Administrators group or an administrator with write access to Active Directory, installs a stand-alone root CA, it is automatically added to the Trusted Root Certification Authorities certificate store for all users and

  computers in the domain. For this reason, if you install a stand-alone root CA in an Active Directory domain, you should not change the default action of the CA upon receiving certificate requests (which marks requests as Pending).

  Otherwise, you will have a trusted root CA that automatically issues certificates without verifying the identity of the certificate requester. If a stand-alone CA is installed by a member of the Domain Administrators group of the parent domain of

  a tree in the enterprise, or by an administrator with write access to Active Directory, then the stand- alone CA will publish its CA certificate and the certificate revocation list (CRL) to Active Directory.

• Question 124:

  Your company has an Active Directory forest. The company has branch offices in three locations. Each location has an organizational unit.

  You need to ensure that the branch office administrators are able to create and apply GPOs only to their respective organizational units.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Run the Delegation of Control wizard and delegate the right to link GPOs for their branch organizational units to the branch office administrators.
  B. Add the user accounts of the branch office administrators to the Group Policy Creator Owners Group.
  C. Modify the Managed By tab in each organizational unit to add the branch office administrators to their respective organizational units.
  D. Run the Delegation of Control wizard and delegate the right to link GPOs for the domain to the branch office administrators.
  A. Run the Delegation of Control wizard and delegate the right to link GPOs for their branch organizational units to the branch office administrators.
  B. Add the user accounts of the branch office administrators to the Group Policy Creator Owners Group.

  ---

  Answer: Run the Delegation of Control wizard and delegate the right to link GPOs for their branch organizational units to the branch office administrators. Add the user accounts of the branch office administrators to the Group Policy Creator Owners Group.

  http://technet.microsoft.com/en-us/library/cc732524.aspx Delegate Control of an Organizational Unit

  1.

  To delegate control of an organizational unit

  2.

  To open Active Directory Users and Computers, click Start , click Control Panel , double-click Administrative Tools and then double-click Active Directory Users and Computers .

  3.

  In the console tree, right-click the organizational unit (OU) for which you want to delegate control.

  Where?

  Active Directory Users and Computers\ domain node \ organizational unit

  4.

  Click Delegate Control to start the Delegation of Control Wizard, and then follow the instructions in the wizard.

  http://technet.microsoft.com/en-us/library/cc781991%28v=ws.10%29.aspx Delegating Administration of Group Policy

  Your Group Policy design will probably call for delegating certain Group Policy administrative tasks. Determining to what degree to centralize or distribute administrative control of Group Policy is one of the most important factors to consider

  when assessing the needs of your organization. In organizations that use a centralized administration model, an IT group provides services, makes decisions, and sets standards for the entire company. In organizations that use a distributed

  administration model, each business unit manages its own IT group.

  You can delegate the following Group Policy tasks:

  Creating GPOs

  Managing individual GPOs (for example, granting Edit or Read access to a GPO) etc.

  ...

  Delegating Creation of GPOs

  The ability to create GPOs in a domain is a permission that is managed on a per-domain basis. By default, only

  Domain Administrators, Enterprise Administrators, Group Policy Creator Owners, and SYSTEM can create new Group Policy objects. If the domain administrator wants a non-administrator or non- administrative group to be able to create

  GPOs, that user or group can be added to the Group Policy Creator Owners security group. Alternatively, you can use the Delegation tab on the Group Policy Objects container in GPMC to delegate creation of GPOs. When a non-

  administrator who is a member of the Group Policy Creator Owners group creates a GPO, that user becomes the creator owner of the GPO and can edit the GPO and modify permissions on the GPO. However, members of the Group Policy

  Creator Owners group cannot link GPOs to containers unless they have been separately delegated the right to do so on a particular site, domain, or OU. Being a member of the Group Policy Creator Owners group gives the non-administrator

  full control of only those GPOs that the user creates. Group Policy Creator Owner members do not have permissions for GPOs that they do not create.

  Note: When an administrator creates a GPO, the Domain Administrators group becomes the Creator Owner of the Group Policy object. By default, Domain Administrators can edit all GPOs in the domain. The right to link GPOs is delegated

  separately from the right to create GPOs and the right to edit GPOs. Be sure to delegate both rights to those groups you want to be able to create and link GPOs. By default, non- Domain Admins cannot manage links, and this prevents them

  from being able to use GPMC to create and link a GPO. However, non-Domain Admins can create an unlinked GPO if they are members of the Group Policy Creator Owners group. After a non-Domain Admin creates an unlinked GPO, the

  Domain Admin or someone else who has been delegated permissions to link GPOs an a container can link the GPO as appropriate.

  Creation of GPOs can be delegated to any group or user. There are two methods of granting a group or user this permission:

  Add the group or user to the Group Policy Creator Owners group. This was the only method available prior to GPMC.

  Explicitly grant the group or user permission to create GPOs. This method is newly available with GPMC.

  You can manage this permission by using the Delegation tab on the Group Policy objects container for a given domain in GPMC. This tab shows the groups that have permission to create GPOs in the domain, including the Group Policy

  Creator Owners group. From this tab, you can modify the membership of existing groups that have this permission, or add new groups. Because the Group Policy Creator Owners group is a domain global group, it cannot contain members

  from outside the domain. Being able to grant users permissions to create GPOs without using Group Policy Creator Owners facilitates delegating GPO creation to users outside the domain. Without GPMC, this task cannot be delegated to

  members outside the domain. If you require that users outside the domain have the ability to create GPOs, create a new domain local group in the domain (for example, "GPCO External"), grant that group GPO creation permissions in the

  domain, and then add domain global groups from external domains to that group. For users and groups in the domain, you should continue to use the Group Policy Creator Owners group to grant GPO-creation permissions.

  Adding a user to the membership of Group Policy Creator Owners and granting the user GPO-creation permissions directly using the new method available in GPMC are identical in terms of permissions.

• Question 125:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com. You discover the following event in the Event log of domain controllers: "The request for a new accountidentifier pool failed. The operation will be retried until the request succeeds. The error is " %1 ""

  You need to ensure that the domain controllers can acquire new account-identifier pools successfully.

  What should you do?

  A. Move the PDC emulator role.
  B. Move the schema master role.
  C. Move the global catalog server.
  D. Move the domain naming master role.
  E. Move the infrastructure master role.
  F. Move the RID master role.
  G. Restart the Active Directory Domain Services (AD DS) service.
  H. Deploy an additional global catalog server.
  I. Move the bridgehead server.
  J. Install a read-only domain controller (RODC).
  F. Move the RID master role.

  ---

  This error can occur when the server holding the RID master role is not available to provide a new RID pool. Moving the RID master role to another domain controller will resolve this.

  Reference: http://technet.microsoft.com/en-us/library/cc756699.aspx Event ID 16651 -- RID Pool Request Users, computers, and groups stored in Active Directory are collectively known as security principals. Each security principal is assigned a unique alphanumeric string called a SID. The SID includes a domain prefix identifier that uniquely identifies the domain and a relative identifier (RID) that uniquely identifies the security principal within the domain. The RID is a monotonically increasing number at the end of the SID. Each domain controller is assigned a pool of RIDs from the global RID pool by the domain controller that holds the RID master role (also known as flexible single master operations or FSMO) in each Active Directory domain. The RID master (also known as the RID pool manager, RID manager, or RID operations master) is responsible for issuing a unique RID pool to each domain controller in its domain. By default, RID pools are obtained in increments of 500. (...) Newly promoted domain controllers must acquire a RID pool before they can advertise their availability to Active Directory clients or share the SYSVOL. Existing domain controllers require additional RID allocations in order to continue creating security principals when their current RID pool becomes depleted. Event Details Message The request for a new account-identifier pool failed. The operation will be retried until the request succeeds.

  The error is " %1 "

  Resolve

  Check connectivity to the RID master, and check its replication status A relative ID (RID) pool was not allocated to the local domain controller. Ensure that the local domain controller can communicate with the domain controller that is

  identified as the RID operations master. Ensure that the RID master is online and replicating to other domain controllers.

• Question 126:

  Your network contains an Active Directory domain named contoso.com. You need to create a script that runs the Best Practices Analyzer (BPA) each week for all of the server roles that BPA supports on each domain controller.

  You must achieve this goal by using the minimum amount of administrative effort.

  Which tools should you use? (Each correct answer presents part of the solution. Choose three.)

  A. Get-Troubleshooting Pack / Invoke-Troubleshooting Pack.
  B. Import-Module Best Practices.
  C. Get-BPA Model / Invoke-BPA Model.
  D. Import-Module Troubleshooting Pack.
  E. Get- BPA Result.
  B. Import-Module Best Practices.
  C. Get-BPA Model / Invoke-BPA Model.
  E. Get- BPA Result.

  ---

  Reference 1: http://technet.microsoft.com/en-us/library/dd759206.aspx To scan all roles by using Windows PowerShell cmdlets

  1.

  Open a Windows PowerShell session with elevated user rights.

  2.

  Import the Server Manager module into your Windows PowerShell session. To import the Server Manager module, type the following, and then press ENTER. Import-Module ServerManager

  3.

  Import the BPA module. Type the following, and then press Enter. Import-Module BestPractices

  4.

  Pipe all roles for which BPA scans can be performed into the Invoke-BPAModel cmdlet to start scans. Get-BPAModel | Invoke-BPAModel

  Reference 2:

  http://technet.microsoft.com/en-us/library/ee617286.aspx

  Get-BpaResult The Get-BPAResult cmdlet allows you to retrieve and view the results of the most recent Best Practices Analyzer (BPA) scan for a specific model.

• Question 127:

  Your network contains an Active Directory forest named contoso.com. The forest contains one domain. The domain contains three domain controllers. The domain controllers are configured as shown in the following table.

  

  DC2 fails and cannot be recovered.

  Several weeks later, administrators report that they can no longer create new users and groups in the domain.

  You need to ensure that the administrators can create new users and groups.

  What should you add?

  A. the RID master role to DC3
  B. the schema master role to DC1
  C. the infrastructure master role to DC1
  D. the domain naming master role to DC3
  A. the RID master role to DC3

• Question 128:

  Your network contains an Active Directory domain. The domain contains 1,000 user accounts. You have a list that contains the mobile phone number of each user. You need to add the mobile number of each user to Active Directory. What should you do?

  A. Create a file that contains the mobile phone numbers, and then run ldifde.exe.
  B. Create a file that contains the mobile phone numbers, and then run csvde.exe.
  C. From Adsiedit, select the CN=Users container, and then modify the properties of the container.
  D. From Active Directory Users and Computers, select all of the users, and then modify the properties of the users.
  A. Create a file that contains the mobile phone numbers, and then run ldifde.exe.

  ---

  CSVDE can only import and export data from AD DS.

  http://technet.microsoft.com/en-us/library/cc732101.aspx

  Reference:

  http://technet.microsoft.com/en-us/library/cc731033.aspx

  Ldifde

  Creates, modifies, and deletes directory objects.

• Question 129:

  Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise.

  You need to approve a pending certificate request.

  Which snap-in should you use?

  A. Active Directory Users and Computers
  B. Authorization Manager
  C. Certification Authority
  D. Group Policy Management
  E. Certificate Templates
  F. TPM Management
  G. Certificates
  H. Enterprise PKI
  I. Security Templates
  C. Certification Authority

  ---

  Reference: http://technet.microsoft.com/de-de/library/ff849263.aspx

  To issue a pending certificate request:

  1.

  Log on to your root CA by using an account that is a certificate manager.

  2.

  Start the Certification Authority snap-in.

  3.

  In the console tree, expand your root CA, and click Pending Certificates.

  4.

  In the details pane, right-click the pending CA certificate, and click Issue.

• Question 130:

  Your network contains an Active Directory forest. The forest contains a single domain named contoso.com. The domain contains domain controllers that run either Windows Server 2003 or Windows Server 2008 R2.

  The functional level of the domain and the forest is Windows Server 2003.

  You need to add a read-only domain controller (RODC) to the forest.

  What should you do first?

  A. Upgrade the domain controllers that run Windows Server 2003.
  B. Raise the domain functional level.
  C. Run the adprep command.
  D. Raise the forest functional level.
  C. Run the adprep command.