Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 151:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. The Active Directory Federation Services (AD FS) role is installed on Server1.

  Contoso.com is defined as an account store.

  A partner company has a Web-based application that uses AD FS authentication. The partner company plans to provide users from contoso.com access to the Web application.

  You need to configure AD FS on contoso.com to allow contoso.com users to be authenticated by the partner company.

  What should you create on Server1?

  A. a new application
  B. a resource partner
  C. an account partner
  D. an organization claim
  D. an organization claim

  ---

  Since the account store has already been configured, what needs to be done is to use the account store to map an AD DS global security group to an organization claim (called group claim extraction). So that's what we need to create for

  authentication: an organization claim.

  Creating a resource/account partner is part of setting up the Federation Trust.

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd378957.aspx

  Configuring the Federation Servers

  [All the steps for setting up an AD FS environment are listed in an extensive step-by-step guide, too long to post here.]

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc732147.aspx

  Add an AD DS Account Store

  If user and computer accounts that require access to a resource that is protected by Active Directory Federation Services (AD FS) are stored in Active Directory Domain Services (AD DS), you must add AD DS as an account store on a

  federation server in the Federation Service that authenticates the accounts.

  Reference 3:

  http://technet.microsoft.com/en-us/library/cc731719.aspx

  Map an Organization Group Claim to an AD DS Group (Group Claim Extraction) When you use Active Directory Domain Services (AD DS) as the Active Directory Federation Services (AD FS) account store for an account Federation Service,

  you map an organization group claim to a security group in AD DS. This mapping is called a group claim extraction.

• Question 152:

  Your company has a single Active Directory domain named intranet.contoso.com. All domain controllers run Windows Server 2008 R2. The domain functional level is Windows 2000 native and the forest functional level is Windows 2000.

  You need to ensure the UPN suffix for contoso.com is available for user accounts.

  What should you do first?

  A. Raise the intranet.contoso.com forest functional level to Windows Server 2003 or higher.
  B. Raise the intranet.contoso.com domain functional level to Windows Server 2003 or higher.
  C. Add the new UPN suffix to the forest.
  D. Change the Primary DNS Suffix option in the Default Domain Controllers Group Policy Object (GPO) to contoso.com.
  C. Add the new UPN suffix to the forest.

  ---

  http://support.microsoft.com/kb/243629

  HOW TO: Add UPN Suffixes to a Forest Adding a UPN Suffix to a Forest Open Active Directory Domains and Trusts. Right-click Active Directory Domains and Trusts in the Tree window pane, and then click Properties. On the UPN Suffixes tab, type the new UPN suffix that you would like to add to the forrest. Click Add, and then click OK. Now when you add users to the forest, you can select the new UPN suffix to complete the user's logon name. APPLIES TO Microsoft Windows 2000 Server Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server

• Question 153:

  Your network contains two DNS servers named Server1 and Server2.

  Server1 hosts a primary zone named contoso.com. Server2 hosts a secondary copy of the contoso.com zone.

  You need to configure how often Server2 will check for updates for the contoso.com zone.

  Which tab should you use? To answer, select the appropriate tab in the answer area.

  Hot Area:

  

  

• Question 154:

  You have an existing Active Directory site named Site1. You create a new Active Directory site and name it Site2.

  You need to configure Active Directory replication between Site1 and Site2. You install a new domain controller.

  You create the site link between Site1 and Site2.

  What should you do next?

  A. Use the Active Directory Sites and Services console to assign a new IP subnet to Site2. Move the new domain controller object to Site2.
  B. Use the Active Directory Sites and Services console to configure a new site link bridge object.
  C. Use the Active Directory Sites and Services console to decrease the site link cost between Site1 and Site2.
  D. Use the Active Directory Sites and Services console to configure the new domain controller as a preferred bridgehead server for Site1.
  A. Use the Active Directory Sites and Services console to assign a new IP subnet to Site2. Move the new domain controller object to Site2.

  ---

  http://www.enterprisenetworkingplanet.com/netsysm/article.php/624411/Intersite-eplication.htm Inter-site Replication The process of creating a custom site link has five basic steps:

  1.

  Create the site link.

  2.

  Configure the site link's associated attributes.

  3.

  Create site link bridges.

  4.

  Configure connection objects. (This step is optional.)

  5.

  Designate a preferred bridgehead server. (This step is optional) http://technet.microsoft.com/en-us/library/cc759160%28v=ws.10%29.aspx Replication between sites

• Question 155:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain and two AD DS sites.

  The AD DS sites are named Toronto and Montreal. Each site has multiple domain controllers. You need to determine which domain controller holds the Inter-Site Topology Generator role for the Toronto site.

  What should you do?

  A. Use the Active Directory Sites and Services console to view the NTDS Site Settings for the Toronto site.
  B. Use the Ntdsutil tool with the roles parameter.
  C. Use the Ntdsutil tool with the LDAP policies parameter.
  D. Use the Active Directory Sites and Services console to view the properties of each domain controller in the Toronto site.
  A. Use the Active Directory Sites and Services console to view the NTDS Site Settings for the Toronto site.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc794776.aspx

  Determine the ISTG Role Owner for a Site The Intersite Topology Generator (ISTG) is the domain controller in each site that is responsible for generating the intersite topology. If you want to regenerate the intersite topology, you must determine the identity of the ISTG role owner in a site. You can use this procedure to view the NTDS Site Settings object properties and determine the ISTG role owner for the site.

  To determine the ISTG role owner for a site

  1.

  Open Active Directory Sites and Services.

  2.

  In the console tree, click the site object whose ISTG role owner you want to determine.

  3.

  In the details pane, right-click the NTDS Site Settings object, and then click Properties. The current role owner appears in the Server box under Inter-Site Topology Generator.

• Question 156:

  Your network contains an Active Directory forest. The forest contains two domains named contoso.com and woodgrovebank.com.

  You have a custom attribute named Attibute1 in Active Directory. Attribute1 is associated to User objects.

  You need to ensure that Attribute1 is replicated to the global catalog.

  What should you do?

  A. In Active Directory Sites and Services, configure the NTDS Settings.
  B. In Active Directory Sites and Services, configure the universal group membership caching.
  C. From the Active Directory Schema snap-in, modify the properties of the User class schema object.
  D. From the Active Directory Schema snap-in, modify the properties of the Attibute1 class schema attribute.
  D. From the Active Directory Schema snap-in, modify the properties of the Attibute1 class schema attribute.

  ---

  http://www.tech-faq.com/the-global-catalog-server.html

  The Global Catalog Server The Global Catalog (GC) is an important component in Active Directory because it serves as the central information store of the Active Directory objects located in domains and forests. Because the GC maintains a list of the Active Directory objects in domains and forests without actually including all information on the objects and it is used when users search for Active Directory objects or for specific attributes of an object, the GC improves network performance and provides maximum accessibility to Active Directory objects. .. How to Include Additional Attributes in the GC The number of attributes in the GC affects GC replication. The more attributes the GC servers have to replicate, the more network traffic GC replication creates. Default attributes are included in the GC when Active Directory is first deployed. The Active Directory Schema snap-in can be used to add any additional attribute to the GC. Because the snap-in is by default not included in the Administrative Tools Menu, users have to add it to the MMC before it can be used to customize the GC. To add the Active Directory Schema snap-in in the MMC:

  1.

  Click Start, Run, and enter cmd in the Run dialog box. Press Enter.

  2.

  Enter the following at the command prompt: regsvr32 schmmgmt.dll.

  3.

  Click OK to acknowledge that the dll was successfully registered.

  4.

  Click Start, Run, and enter mmc in the Run dialog box.

  5.

  When the MMC opens, select Add/Remove Snap-in from the File menu.

  6.

  In the Add/Remove Snap-in dialog box, click Add then add the Active Directory Schema snap-in from the Add Standalone Snap-in dialog box.

  7.

  Close all open dialog boxes. To include additional attributes in the GC:

  1.

  Open the Active Directory Schema snap-in.

  2.

  In the console tree, expand the Attributes container, right-click an attribute, and click Properties from the shortcut menu.

  3.

  Additional attributes are added on the General tab.

  4.

  Ensure that the Replicate this attribute to the Global Catalog checkbox is enabled.

  5.

  Click OK.

• Question 157:

  Your company has a main office and a branch office.

  The network contains an Active Directory domain.

  The main office contains a writable domain controller named DC1. The branch office contains a read- only domain controller (RODC) named DC2.

  You discover that the password of an administrator named Admin1 is cached on DC2.

  You need to prevent Admin1's password from being cached on DC2.

  What should you do?

  A. Modify the NTDS Site Settings.
  B. Modify the properties of the domain.
  C. Create a Password Setting object (PSO).
  D. Modify the properties of DC2's computer account.
  D. Modify the properties of DC2's computer account.

  ---

  http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy%28v=ws.10%29.aspx

  Administering the Password Replication Policy This topic describes the steps for viewing, configuring, and monitoring the Password Replication Policy (PRP) and password caching for read-only domain controllers (RODCs). Viewing the PRP You can view the PRP in a graphical user interface (GUI) by using the Active Directory Users and Computers snap-in or in a Command Prompt window by using the Repadmin tool. The following procedures describe how to view the PRP. To view the PRP using Active Directory Users and Computers

  1.

  Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start. In Start Search, type dsa.msc, and then press ENTER.

  2.

  Ensure that you are connected to the correct domain. To connect to the appropriate domain, in the details pane, right-click the Active Directory Users and Computers object, and then click Change Domain. 3. Expand Domain Controllers, right-click the RODC account object for which you want to modify the PRP, and then click Properties.

  4. Click the Password Replication Policy tab. An example is shown in the following illustration.

  

• Question 158:

  Your network contains an Active Directory domain named contoso.com.

  The Administrator deletes an OU named OU1 accidentally.

  You need to restore OU1. Which cmdlet should you use?

  A. Set-ADObject cmdlet.
  B. Set-ADOrganizationalUnit cmdlet.
  C. Set-ADUser cmdlet.
  D. Set-ADGroup cmdlet.
  A. Set-ADObject cmdlet.

  ---

  http://technet.microsoft.com/en-us/library/dd379509.aspx

  Restoring a deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets You can also restore a deleted Active Directory object by using the Get-ADObject and Restore- ADObject Active Directory module for Windows PowerShell cmdlets. The recommended approach is to use the Get-ADObject cmdlet to retrieve the deleted object and then pass that object through the pipeline to the Restore-ADObject cmdlet.

• Question 159:

  Your network contains an Active Directory domain. The domain contains five domain controllers. A domain controller named DC1 has the DHCP role and the file server role installed.

  You need to move the Active Directory database on DC1 to an alternate location.The solution must minimize impact on the network during the database move.

  What should you do first?

  A. Restart DC1 in Safe Mode.
  B. Restart DC1 in Directory Services Restore Mode.
  C. Start DC1 from Windows PE.
  D. Stop the Active Directory Domain Services service on DC1.
  D. Stop the Active Directory Domain Services service on DC1.

  ---

  http://technet.microsoft.com/en-us/library/cc794895%28v=ws.10%29.aspx Relocating the Active Directory Database Files Applies To: Windows Server 2008, Windows Server 2008 R2 Relocating Active Directory database files usually involves moving files to a temporary location while hardware updates are being performed and then moving the files to a permanent location. On domain controllers that are running versions of Windows 2000 Server and Windows Server 2003, moving database files requires restarting the domain controller in Directory Services Restore Mode (DSRM). Windows Server 2008 introduces restartable Active Directory Domain Services (AD DS), which you can use to perform database management tasks without restarting the domain controller in DSRM. Before you move database files, you must stop AD DS as a service.

• Question 160:

  Your network contains an Active Directory domain. The domain contains 10 domain controllers that run Windows Server 2008 R2.

  You need to monitor the following information on the domain controllers during the next five days:

  

  Memory usage

  

  Processor usage

  

  The number of LDAP queries

  What should you do?

  A. Create a User Defined Data Collector Set (DCS) that uses the Active Directory Diagnostics template.
  B. Use the System Performance Data Collector Set (DCS).
  C. Create a User Defined Data Collector Set (DCS) that uses the System Performance template.
  D. Use the Active Directory Diagnostics Data Collector Set (DCS).
  A. Create a User Defined Data Collector Set (DCS) that uses the Active Directory Diagnostics template.

  ---

  The System Performance Data Collector Set/System Performance template does not monitor Active Directory data (we need the number of LDAP queries). That leaves out answers B ("Use the System Performance Data Collector Set (DCS)") and C ("Create a User Defined Data Collector Set (DCS) that uses the System Performance template"). Because the Active Directory Diagnostics Data Collector Set (DCS) runs only for 5 minutes and we need to monitor for 5 days we have to use a User Defined Data Collector Set (DCS) that uses the Active Directory Diagnostics template. For a User Defined Data Collector Set we can set the monitoring duration in seconds, minutes, hours, days or weeks. So we have to create a User Defined Data Collector Set (DCS) that uses the Active Directory Diagnostics template.

  Reference: http://blogs.technet.com/b/askds/archive/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008- andbeyond.aspx AD Data Collector Sets in Win2008 and beyond

  The Active Directory Diagnostics data collector set runs for a default of 5 minutes. This duration period cannot be modified for the built-in collector. However, the collection can be stopped manually by clicking the Stop button or from the command line. If reducing or increasing the time that a data collector set runs is required, and manually stopping the collection is not desirable, then see How to Create a User Defined Data Collection Set.