Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 131:

  Your company has an Active Directory forest that contains two domains, The forest has universal groups that contain members from each domain. A branch office has a domain controller named DC1, Users at the branch office report that the

  logon process takes too long.

  You need to decrease the amount of time it takes for the branch office users to logon.

  What should you do?

  A. Configure DC1 as a Global Catalog server.
  B. Configure DC1 as a bridgehead server for the branch office site.
  C. Decrease the replication interval on the site link that connects the branch office to the corporate network.
  D. Increase the replication interval on the site link that connects the branch office to the corporate network.
  A. Configure DC1 as a Global Catalog server.

  ---

  http://technet.microsoft.com/en-us/library/cc728188.aspx What Is the Global Catalog?

  The global catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain in a multidomain Active Directory Domain Services (AD DS) forest. The global catalog is stored on domain controllers that have been designated as global catalog servers and is distributed through multimaster replication. Searches that are directed to the global catalog are faster because they do not involve referrals to different domain controllers. In addition to configuration and schema directory partition replicas, every domain controller in a forest stores a full, writable replica of a single domain directory partition. Therefore, a domain controller can locate only the objects in its domain. Locating an object in a different domain would require the user or application to provide the domain of the requested object. The global catalog provides the ability to locate objects from any domain without having to know the domain name. A global catalog server is a domain controller that, in addition to its full, writable domain directory partition replica, also stores a partial, read-only replica of all other domain directory partitions in the forest. The additional domain directory partitions are partial because only a limited set of attributes is included for each object. By including only the attributes that are most used for searching, every object in every domain in even the largest forest can be represented in the database of a single global catalog server.

• Question 132:

  Your network contains an Active Directory domain named contoso.com. You need to ensure that when computers are joined manually to the domain by using the System Properties, the computer account of the computers is created automatically in an organizational unit (OU) named NewComputers.

  Which command should you run?

  A. dsmgmt.exe
  B. redircmp.exe
  C. csvde.exe
  D. computerdefaults.exe
  B. redircmp.exe

• Question 133:

  Your network contains an Active Directory domain. The domain contains a group named Group1. The minimum password length for the domain is set to six characters.

  You need to ensure that the passwords for all users in Group1 are at least 10 characters long. All other users must be able to use passwords that are six characters long.

  You create an Active Directory Fine Grained Password Policy.

  What should you do next?

  A. From the Default Domain Policy, modify the password policy.
  B. Run the Add-ADFineGrainedPasswordPolicySubject cmdlet.
  C. Run the Set-ADDomain cmdlet.
  D. From the Default Domain Controller Policy, modify the password policy.
  B. Run the Add-ADFineGrainedPasswordPolicySubject cmdlet.

• Question 134:

  Your network contains an Active Directory domain named contoso.com. All domain controllers and member servers run Windows Server 2008. All client computers run Windows 7.

  From a client computer, you create an audit policy by using the Advanced Audit Policy Configuration settings in the Default Domain Policy Group Policy object (GPO).

  You discover that the audit policy is not applied to the member servers. The audit policy is applied to the client computers.

  You need to ensure that the audit policy is applied to all member servers and all client computers.

  What should you do?

  A. Add a WMI filter to the Default Domain Policy GPO.
  B. Modify the security settings of the Default Domain Policy GPO.
  C. Configure a startup script that runs auditpol.exe on the member servers.
  D. Configure a startup script that runs auditpol.exe on the domain controllers.
  C. Configure a startup script that runs auditpol.exe on the member servers.

  ---

  Advanced audit policy settings cannot be applied using group policy to Windows Server 2008 servers. To circumvent that we have to use a logon script to apply the audit policy to the Windows Server 2008 member servers.

  Reference1:

  http://technet.microsoft.com/en-us/library/ff182311.aspx

  Advanced Security Auditing FAQ

  The advanced audit policy settings were introduced in Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server

  2008.

  Note

  In Windows Vista and Windows Server 2008, advanced audit event settings were not integrated withGroup Policy and could only be deployed by using logon scripts generated with the Auditpol.exe command-line tool. In Windows Server 2008

  R2 and Windows 7, all auditing capabilities are integrated with Group Policy.

  This allows administrators to configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU).

• Question 135:

  Your network contains an Active Directory forest named contoso.com. All client computers run Windows 7 Enterprise.

  You need automatically to create a local group named PowerManagers on each client computer that contains a battery. The solution must minimize the amount of administrative effort.

  Which node in Group Policy Management Editor should you use? To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732525.aspx

  Configure a Local Group Item

  Local Group preference items allow you to centrally create, delete, and rename local groups.

  Also, you can use these preference items to change local group memberships. Before you create a local group preference item, you should review the behavior of each type of action possible with the extension.

  Creating a Local Group item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Local Users and Groups node, point to New, and select Local Group.

  4. In the New Local Group Properties dialog box, select an Action for Group Policy to perform.

  (For more information, see "Actions" in this topic.)

  5. Enter local group settings for Group Policy to configure or remove. (For more information, see "Local group settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

  Actions This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether a group with the same name exists.

  Create - Create a new local group on the local computer. If the local group exists, then do not modify it.

  (...)

• Question 136:

  Your network contains a single Active Directory domain that has two sites named Site1 and Site2. Site1 has two domain controllers named DC1 and DC2. Site2 has two domain controllers named DC3 and DC4.

  DC3 fails.

  You discover that replication no longer occurs between the sites. You verify the connectivity between DC4 and the domain controllers in Site1.

  On DC4, you run repadmin.exe /kcc.

  Replication between the sites continues to fail.

  You need to ensure that Active Directory data replicates between the sites.

  What should you do?

  A. From Active Directory Sites and Services, modify the properties of DC3.
  B. From Active Directory Sites and Services, modify the NTDS Site Settings of Site2.
  C. From Active Directory Users and Computers, modify the location settings of DC4.
  D. From Active Directory Users and Computers, modify the delegation settings of DC4.
  A. From Active Directory Sites and Services, modify the properties of DC3.

  ---

  Reference: MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) pages 193, 194 Bridgehead Servers A bridgehead server is the domain controller designated by each site's KCC to take control of intersite replication. The bridgehead server receives information replicated from other sites and replicates it to its site's other domain controllers. It ensures that the greatest portion of replication occurs within sites rather than between them.

  In most cases, the KCC automatically decides which domain controller acts as the bridgehead server. However, you can use Active Directory Sites and Services to specify which domain controller will be the preferred bridgehead server by using the following steps:

  1.

  In Active Directory Sites and Services, expand the site in which you want to specify the preferred bridgehead server.

  2.

  Expand the Servers folder to locate the desired server, right-click it, and then choose Properties.

  3.

  From the list labeled Transports available for intersite data transfer, select the protocol(s) for which you want to designate this server as a preferred bridgehead server and then click Add.

• Question 137:

  Your network contains an Active Directory domain. The domain contains an enterprise certification authority (CA).

  You need to ensure that only members of a group named Admin1 can create certificate templates.

  Which tool should you use to assign permissions to Admin1?

  A. the Certification Authority console
  B. Active Directory Users and Computers
  C. the Certificates snap-in
  D. Active Directory Sites and Services
  D. Active Directory Sites and Services

  ---

  We need to use Active Directory Sites and Services to assign permissions to create certificate templates to global or universal groups.

  The first reference lists what needs to be done, the second reference explains how to do it.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc725621.aspx

  Delegating Template Management

  You can delegate the ability to manage individual certificate templates or to create any certificate templates by defining appropriate permissions to global groups or universal groups that a user belongs to.

  There are three levels of delegation for certificate template administration:

  -Modify existing templates

  -Create new templates (by duplicating existing templates)

  -Full delegation (including modifying all existing templates and creating new ones)

  -Create New Templates

  To delegate the ability to create certificate templates to users who are not members of the Domain Admins group in the forest root domain, or members of the Enterprise Admins group, it is necessary to define the appropriate permissions in

  the Configuration naming context of AD DS. To delegate the ability to duplicate and create new certificate templates, you must make the following permission assignments to a global or universal group of which the user is a member:

  Grant Create All Child Objects permission on the following container: CN=Certificate Templates,CN=Public

  Key Services,CN=Services,CN=Configuration,DC=ForestRoot.

  Grant Full Control permission to every certificate template in the following container: CN=Certificate Templates,CN=Public Key

  Services,CN=Services,CN=Configuration,DC=ForestRoot. The permissions assigned to the Certificate Templates container are not inherited by the individual certificate templates. Grant Create All Child Objects permission on the following

  container: CN=OID,CN=Public Key Services, CN=Services,CN=Configuration,DC=ForestRoot container.

  Reference 2:

  Windows Server 2008 - PKI and Certificate Security (Microsoft Press, 2008) page 298 Delegate Permissions for Creation of New Templates

  You can delegate the permission to create new templates by assigning permissions to a custom universal group for the CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,

  ForestRootDomain container.

  1.

  Log on as a member of the Enterprise Admins group or the forest root domain Domain Admins group.

  2.

  Open the Active Directory Sites And Services console.

  3.

  From the View menu, ensure that the Show Services Node setting is enabled.

  4.

  In the console tree, expand Services, expand Public Key Services, and then click Certificate Templates.

  5.

  In the console tree, right-click Certificate Templates, and then click Delegate Control.

  6.

  In the Delegation Of Control wizard, click Next.

  7.

  On the Users Or Groups page, click Add.

  8.

  In the Select Users, Computers, Or Groups dialog box, type a user or group name, and then click OK.

  9.

  On the Users Or Groups page, click Next.

  10.On the Tasks To Delegate page, click Create A Custom Task To Delegate, and then click Next.

  11.On the Active Directory Object Type page, click This Folder, Existing Objects In This Folder, and Creation Of New Objects In This Folder, and then click Next.

  12.On the Permissions page, in the Permissions list, enable Full Control, and then click Next.

  13.On the Completing The Delegation Of Control wizard page, click Finish.

• Question 138:

  Your network contains two Active Directory forests. One forest contains two domains named contoso.com and na.contoso.com. The other forest contains a domain named nwtraders.com. A forest trust is configured between the two forests.

  You have a user named User1 in the na.contoso.com domain. User1 reports that he fails to log on to a computer in the nwtraders.com domain by using the user name NA\User1.

  Other users from na.contoso.com report that they can log on to the computers in the nwtraders.com domain.

  You need to ensure that User1 can log on to the computer in the nwtraders.com domain.

  What should you do?

  A. Enable selective authentication over the forest trust.
  B. Create an external one-way trust from na.contoso.com to nwtraders.com.
  C. Instruct User1 to log on to the computer by using his user principal name (UPN).
  D. Instruct User1 to log on to the computer by using the user name nwtraders\User1.
  C. Instruct User1 to log on to the computer by using his user principal name (UPN).

  ---

  http://apttech.wordpress.com/2012/02/29/what-is-upn-and-why-to-use-it/ What is UPN and why to use it?

  UPN or User Principal Name is a logon method of authentication when you enter the credentials as [email protected] instead of Windows authentication method: domainname\username to be used as login. So UPN is BASICALLY a suffix that is added after a username which can be used in place of "Samaccount" name to authenticate a user. So lets say your company is called ABC, then instead of ABC\Username you can use [email protected] at the authentication popup. The additional UPN suffix can help users to simplify the logon information in long domain names with an easier name. Example: instead of [email protected]", change it to "username@atlanta", if you create an UPN suffix called Atlanta. http://blogs.technet.com/b/mir/archive/2011/06/12/accessing-resources-across-forest-and-achieve- singlesignon-part1.aspx Accessing Resources across forest and achieve Single Sign ON (Part1) http://technet.microsoft.com/en-us/library/cc772808%28v=ws.10%29.aspx Accessing resources across forests ... When a forest trust is first established, each forest collects all of the trusted namespaces in its partner forest and stores the information in a TDO. Trusted namespaces include domain tree names, user principal name (UPN) suffixes, service principal name (SPN) suffixes, and security ID (SID) namespaces used in the other forest. TDO objects are replicated to the global catalog.

• Question 139:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com.

  You attempt to create a new child domain and you receive the following error message: "An LDAP read of operational attributes failed."

  You need to ensure that you can add a new child domain to the forest.

  What should you do?

  A. Move the PDC emulator role.
  B. Move the RID master role.
  C. Move the infrastructure master role.
  D. Move the schema master role.
  E. Move the domain naming master role.
  F. Move the global catalog server.
  G. Move the bridgehead server.
  H. Install a read-only domain controller (RODC).
  I. Deploy an additional global catalog server.
  J. Restart the Active Directory Domain Services (AD DS) service.
  E. Move the domain naming master role.

  ---

  This message appears when the domain naming master is unavailable. It needs to be moved to another domain controller to resolve this.

  Reference:

  http://technet.microsoft.com/en-us/library/bb727058.aspx

  Troubleshooting Active Directory Installation Wizard Problems

  Symptom or Error

  An LDAP read of operational attributes failed.

  Root Cause

  The domain naming master for the forest is offline or cannot be contacted. Solution Make the current domain naming master accessible. If necessary, see "Seizing Operations Master Roles" in this guide.

• Question 140:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You mount an Active Directory snapshot.

  You need to ensure that you can query the snapshot by using LDAP.

  What should you do?

  A. Run the dsamain.exe command.
  B. Create custom views from Event Viewer.
  C. Run the ntdsutil.exe command.
  D. Configure subscriptions from Event Viewer.
  E. Run the Get-ADForest cmdlet.
  F. Create a Data Collector Set (DCS).
  G. Run the eventcreate.exe command.
  H. Configure the Active Directory Diagnostics Data Collector Set (DCS).
  I. Run the repadmin.exe command.
  J. Run the dsquery.exe command.
  A. Run the dsamain.exe command.

  ---

  http://technet.microsoft.com/en-us/library/cc753609.aspx

  The Active Directory database mounting tool (Dsamain.exe) can improve recovery processes for your organization by providing a means to compare data as it exists in snapshots that are taken at different times so that you can better decide which data to restore after data loss. This eliminates the need to restore multiple backups to compare the Active Directory data that they contain. Requirements for using the Active Directory database mounting tool You do not need any additional software to use the Active Directory database mounting tool. All the tools that are required to use this feature are built into Windows Server 2008 and are available if you have the AD DS or the AD LDS server role installed. These tools include the following: Dsamain.exe, which you can use to expose the snapshot data as an LDAP server Existing LDAP tools, such as Ldp.exe and Active Directory Users and Computers