Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 141:

  Your network contains an Active Directory forest. The forest contains two domain controllers. The domain controllers are configured as shown in the following table.

  

  All client computers run Windows 7.

  You need to ensure that all client computers in the domain keep the same time as an external time server.

  What should you do?

  A. From DC1, run the time command.
  B. From DC2, run the time command.
  C. From DC1, run the w32tm.exe command.
  D. From DC2, run the w32tm.exe command.
  D. From DC2, run the w32tm.exe command.

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc816748.aspx

  Change the Windows Time Service Configuration on the PDC Emulator in the Forest Root Domain The domain controller in the forest root domain that holds the primary domain controller (PDC) emulator operations master (also known as

  flexible single master operations or FSMO) role is the default time source for the domain hierarchy of time sources in the forest.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc773263.aspx

  Windows Time Service Tools and Settings

  Most domain member computers have a time client type of NT5DS, which means that they synchronize time from the domain hierarchy. The only typical exception to this is the domain controller that functions as the primary domain controller

  (PDC) emulator operations master of the forest root domain, which is usually configured to synchronize time with an external time source.

  W32tm.exe is used to configure Windows Time service settings. It can also be used to diagnose problems with the time service. W32tm.exe is the preferred command line tool for configuring, monitoring, or troubleshooting the Windows Time

  service.

• Question 142:

  Your company has a single Active Directory forest with a single domain. Consultants in different departments of the company require access to different network resources. The consultants belong to a global group named TempWorkers.

  Three file servers are placed in a new organizational unit named SecureServers. The file servers contain confidential data in shared folders.

  You need to prevent the consultants from accessing the confidential data. What should you do?

  A. Create a new Group Policy Object (GPO) and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group.
  B. Create a new Group Policy Object (GPO) and link it to the domain. Assign the Deny access to this computer from the network user right to the TempWorkers global group.
  C. On the three file servers, create a share on the root of each hard disk. Configure the Deny Full control permission for the TempWorkers global group on the share.
  D. Create a new Group Policy Object (GPO) and link it to the domain. Assign the Deny log on locally user right to the TempWorkers global group.
  E. Create a new Group Policy Object (GPO) and link it to the SecureServers organizational unit. Assign the Deny log on locally user right to the TempWorkers global group.
  A. Create a new Group Policy Object (GPO) and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group.

• Question 143:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  The DNS zone for contoso.com is Active Directory-integrated. You deploy a read-only domain controller (RODC) named RODC1.

  You install the DNS Server server role on RODC1.

  You discover that RODC1 does not have any DNS application directory partitions. You need to ensure that RODC1 has a copy of the DNS application directory partition of contoso.com.

  What should you do?

  A. From DNS Manager, right-click RODC1 and click Create Default Application Directory Partitions.
  B. From DNS Manager, create primary zones.
  C. Run ntdsutil.exe. From the Partition Management context, run the create nc command.
  D. Run dnscmd.exe and specify the /enlistdirectorypartition parameter.
  A. From DNS Manager, right-click RODC1 and click Create Default Application Directory Partitions.

• Question 144:

  ABC.com has a main office and a branch office. ABC.com's network consists of a single Active Directory forest.

  Some of the servers in the network run Windows Server 2008 and the rest run Windows server 2003.

  You are the administrator at ABC.com. You have installed Active Directory Domain Services (AD DS) on a computer that runs Windows Server 2008. The branch office is located in a physically insecure place. It has no IT personnel onsite and there are no administrators over there. You need to setup a Read-Only Domain Controller (RODC) on the Server Core installation computer in the branch office.

  What should you do to setup RODC on the computer in branch office?

  A. Execute an attended installation of AD DS
  B. Execute an unattended installation of AD DS
  C. Execute RODC through AD DS
  D. Execute AD DS by using deploying the image of AD DS
  E. none of the above
  B. Execute an unattended installation of AD DS

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc754629.aspx Install an RODC on a Server Core installation

  To install an RODC on a Server Core installation of Windows Server 2008, you must perform an unattended installation of AD DS.

• Question 145:

  Your company has two offices. The offices are located in Miami and London. The network contains an Active Directory forest named contoso.com. The forest contains two child domains named miami.contoso.com and london.contoso.com.

  Each domain contains 50 domain controllers that run Windows Server 2008 R2.

  Each office is configured as an Active Directory site.

  The office in London recently hired several thousand new employees.

  You need to move 10 domain controllers from miami.contoso.com to london.contoso.com.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  E. Run the dcpromo.exe command.

• Question 146:

  Your network contains a domain controller that runs Windows Server 2008 R2. You run the following command on the domain controller:

  dsamain.exe -dbpath c:\$SNAP_201006170326_VOLUMEC$\Windows\NTDS\ntds.dit -ldapport 389 -allowNonAdminAccess

  The command fails.

  You need to ensure that the command completes successfully.

  How should you modify the command?

  A. Include the path to Dsamain.
  B. Change the value of the -dbpath parameter.
  C. Change the value of the -ldapport parameter.
  D. Remove the allowNonAdminAccess
  C. Change the value of the -ldapport parameter.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 690 Use the AD DS database mounting tool to load the snapshot as an LDAP server. dsamain -dbpath c:\$SNAP_datetime_VOLUMEC$\windows\ntds\ntds.dit

  -ldapport portnumber

  Be sure to use ALL CAPS for the -dbpath value and use any number beyond 40,000 for the -ldapport value to ensure that you do not conflict with AD DS.

  Also note that you can use the minus () sign or the slash (/) for the options in the command.

• Question 147:

  A corporate network contains a Windows Server 2008 R2 Active Directory forest. You need to add a user principal name (UPN) suffix to the forest. Which tool should you use?

  A. Active Directory Users and Computers console
  B. Active Directory Sites and Services console
  C. Ntdsutil
  D. Active Directory module for Windows PowerShell E. Active Directory Domains and Trusts Console
  E

  ---

  Create Alternate UPN Suffix for a Domain

  To create an alternate UPN suffice in a domain, administrators must follow the steps given as below:

  1. Log on to Windows Server 2008 R2 domain controller with domain admin or enterprise admin account credentials.

  2. From the desktop screen, click Start.

  3. From the Start menu, go to Administrative Tools > Active Directory Domains and Trusts.

  4. On Active Directory Domains and Trusts snap-in, from the console tree in the left pane, right-clickActive Directory Domains and Trusts [computername.domainname] (`srv2k8r2-dc01.mydomain.com' in this demonstration).

  5. From the displayed context menu, click Properties. Click Properties

  6. On the properties box that appears, in the Alternative UPN suffixes field, specify the desired alternate UPN suffix for the domain and click Add.

  7. Once added, click OK to save the settings.

  8. Close Active Directory Domains and Trusts snap-in when done.

  

• Question 148:

  You need to deploy a read-only domain controller (RODC) that runs Windows Server 2008 R2.

  What is the minimal forest functional level that you should use?

  A. Windows Server 2008 R2
  B. Windows Server 2008
  C. Windows Server 2003
  D. Windows 2000
  C. Windows Server 2003

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc731243.aspx Prerequisites for Deploying an RODC

  Complete the following prerequisites before you deploy a read-only domain controller (RODC):

  Ensure that the forest functional level is Windows Server 2003 or higher, so that linked- valuereplication (LVR) is available.

• Question 149:

  Your company has an Active Directory forest. Not all domain controllers in the forest are configured as Global Catalog Servers. Your domain structure contains one root domain and one child domain.

  You modify the folder permissions on a file server that is in the child domain. You discover that some Access Control entries start with S-1-5-21 and that no account name is listed.

  You need to list the account names.

  What should you do?

  A. Move the RID master role in the child domain to a domain controller that holds the Global Catalog.
  B. Modify the schema to enable replication of the friendlynames attribute to the Global Catalog.
  C. Move the RID master role in the child domain to a domain controller that does not hold the Global Catalog.
  D. Move the infrastructure master role in the child domain to a domain controller that does not hold the Global Catalog.
  D. Move the infrastructure master role in the child domain to a domain controller that does not hold the Global Catalog.

  ---

  http://technet.microsoft.com/en-us/library/cc780850%28v=ws.10%29.aspx Security identifiers

  Security identifiers (SIDs) are numeric values that identify a user or group. For each access control entry (ACE), there exists a SID that identifies the user or group for whom access is allowed, denied, or audited. Well-known security identifiers

  (special identities):

  Network (S-1-5-2) Includes all users who are logged on through a network connection. Access tokens for interactive users do not contain the Network SID.

  http://technet.microsoft.com/en-us/library/cc773108%28v=ws.10%29.aspx Operations master roles Active Directory supports multimaster replication of the directory data store between all domain controllers (DC) in the domain, so all domain

  controllers in a domain are essentially peers. However, some changes are impractical to perform in using multimaster replication, so, for each of these types of changes, one domain controller, called the operations master, accepts requests

  for such changes.

  In every forest, there are at least five operations master roles that are assigned to one or more domain controllers. Forest-wide operations master roles must appear only once in every forest. Domain-wide operations master roles must appear

  once in every domain in the forest.

  Domain-wide operations master roles

  Every domain in the forest must have the following roles:

  Relative ID (RID) master

  Primary domain controller (PDC) emulator master

  Infrastructure master

  These roles must be unique in each domain. This means that each domain in the forest can have only one RID master, PDC emulator master, and infrastructure master.

  ...

  Infrastructure master

  At any time, there can be only one domain controller acting as the infrastructure master in each domain.

  The infrastructure master is responsible for updating references from objects in its domain to objects in other domains. The infrastructure master compares its data with that of a global catalog. Global catalogs receive regular updates for

  objects in all domains through replication, so the global catalog data will always be up to date. If the infrastructure master finds data that is out of date, it requests the updated data from a global catalog. The infrastructure master then

  replicates that updated data to the other domain controllers in the domain.

  Important

  Unless there is only one domain controller in the domain, the infrastructure master role should not be assigned to the domain controller that is hosting the global catalog. If the infrastructure master and global catalog are on the same domain

  controller, the infrastructure master will not function. The infrastructure master will never find data that is out of date, so it will never replicate any changes to the other domain controllers in the domain.

  In the case where all of the domain controllers in a domain are also hosting the global catalog, all of the domain controllers will have the current data and it does not matter which domain controller holds the infrastructure master role.

  The infrastructure master is also responsible for updating the group-to-user references whenever the members of groups are renamed or changed. When you rename or move a member of a group (and that member resides in a different

  domain from the group), the group may temporarily appear not to contain that member.

  The infrastructure master of the group's domain is responsible for updating the group so it knows the new name or location of the member. This prevents the loss of group memberships associated with a user account when the user account

  is renamed or moved. The infrastructure master distributes the update via multimaster replication.

  There is no compromise to security during the time between the member rename and the group update. Only an administrator looking at that particular group membership would notice the temporary inconsistency.

• Question 150:

  Your company has an Active Directory domain. All consultants belong to a global group named TempWorkers.

  The TempWorkers group is not nested in any other groups.

  You move the computer objects of three file servers to a new organizational unit named SecureServers. These file servers contain only confidential data in shared folders.

  You need to prevent members of the TempWorkers group from accessing the confidential data on the file servers.

  You must achieve this goal without affecting access to other domain resources.

  What should you do?

  A. Create a new GPO and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group.
  B. Create a new GPO and link it to the domain. Assign the Deny access to this computer from the network user right to the TempWorkers global group.
  C. Create a new GPO and link it to the domain. Assign the Deny log on locally user right to the TempWorkers global group.
  D. Create a new GPO and link it to the SecureServers organizational unit. Assign the Deny log on locally user right to the TempWorkers global group.
  A. Create a new GPO and link it to the SecureServers organizational unit. Assign the Deny access to this computer from the network user right to the TempWorkers global group.

  ---

  Personal comment:

  Basically, you need to create a GPO for the Secure Servers and deny the TempWorkers access to the shared folders (implies access from the network).

  "Deny log on locally" makes no sense in this instance, because we are reffering to shared folder and supposedly physical access to servers should be highly restricted. And best practices recommend that you link GPOs at the domain level

  only for domain wide purposes.