Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 161:

  Your company plans to open a new branch office.

  The new office will have a low-speed connection to the Internet. You plan to deploy a read-only domain controller (RODC) in the branch office.

  You need to create an offline copy of the Active Directory database that can be used to install the Active Directory on the new RODC.

  Which commands should you run from Ntdsutil? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc770654.aspx

  Installing AD DS from Media You can use the Ntdsutil.exe tool to create installation media for additional domain controllers that you are creating in a domain. By using the Install from Media (IFM) option, you can minimize the replication of directory data over the network. This helps you install additional domain controllers in remote sites more efficiently.

  To create installation media

  1. Click Start, right-click Command Prompt, and then click Run as administrator to open an elevated command prompt.

  2. At the command prompt, type the following command, and then press ENTER: ntdsutil

  3. At the ntdsutil prompt, type the following command, and then press ENTER: activate instance ntds

  4. At the ntdsutil prompt, type the following command, and then press ENTER: ifm

  5. At the ifm: prompt, type the command for the type of installation media that you want to create (as listed in the table earlier in this topic), and then press ENTER. For example, to create RODC installation media, type the following command, and then press ENTER: create rodc C:\InstallationMedia

  6. Where C:\InstallationMedia is the path to the folder where you want the installation media to be created.

  7. You can save the installation media to a network shared folder or to any other type of removable media.

• Question 162:

  Your network contains an Active Directory domain named contoso.com.

  All domain controllers were upgraded from Windows Server 2003 to Windows Server 2008 R2 Service Pack 1 (SP1). The functional level of the domain is Windows Server 2003.

  You need to configure SYSVOL to use DFS Replication.

  Which tools should you use? (Each correct answer presents part of the solution. Choose two.)

  A. Dfsrmig
  B. Frsdiag
  C. Ntdsutil
  D. Set-ADForest
  E. Repadmin
  F. Set-ADDomainMode
  G. DFS Management
  A. Dfsrmig
  F. Set-ADDomainMode

  ---

  First we need to upgrade the domain functional level, using Set-ADDomainMode. Then, now that the domain controllers have been upgraded to Windows Server 2008 R2 and the domain functional level has been upgraded (to Windows

  Server 2008 (R2)), we can migrate to DFS Replication for replicating SYSVOL, instead of File Replication Service (FRS) of previous Windows Server versions. We can use Dfsrmig for that migration.

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 543 In versions of Windows Server prior to Windows Server 2008, the FRS was used to replicate the contents of SYSVOL between domain controllers. FRS

  has limitations in both capacity and performance that cause it to break occasionally.

  Unfortunately, troubleshooting and configuring FRS is quite difficult. In Windows Server 2008 and Windows Server 2008 R2 domains, you have the option to use DFS-R to replicate the contents of SYSVOL.

  Reference 2:

  http://technet.microsoft.com/en-us/library/ee617230.aspx

  Set-ADDomainMode

  The Set-ADDomainMode cmdlet sets the domain mode for a domain. You specify the domain mode by setting the DomainMode parameter.

  The domain mode can be set to the following values that are listed in order of functionality from lowest to highest.

  Windows2000Domain

  Windows2003InterimDomain

  Windows2003Domain

  Windows2008Domain

  Windows2008R2Domain

  Reference 3:

  http://technet.microsoft.com/en-us/library/dd639809.aspx

  Migrating to the Prepared State

  The following sections provide an overview of the procedures that you perform when you migrate SYSVOL replication from File Replication Service (FRS) to Distributed File System (DFS Replication).

  This migration phase includes the tasks in the following list.

  (...)

  Running the dfsrmig /SetGlobalState 1 command on the PDC emulator to start the migration to the Prepared state.

• Question 163:

  Your company has a main office and a branch office. You deploy a read-only domain controller (RODC) that runs Microsoft Windows Server 2008 to the branch office.

  You need to ensure that users at the branch office are able to log on to the domain by using the RODC.

  What should you do?

  A. Add another RODC to the branch office.
  B. Configure a new bridgehead server in the main office.
  C. Decrease the replication interval for all connection objects by using the Active Directory Sites and Services console.
  D. Configure the Password Replication Policy on the RODC.
  D. Configure the Password Replication Policy on the RODC.

  ---

  Answer: Configure the Password Replication Policy on the RODC.

  http://technet.microsoft.com/en-us/library/cc754956%28v=ws.10%29.aspx RODC Frequently Asked Questions

  What new attributes support the RODC Password Replication Policy? Password Replication Policy is the mechanism for determining whether a user or computer's credentials are allowed to replicate from a writable domain controller to an RODC. The Password Replication Policy is always set on a writable domain controller running Windows Server 2008. What operations fail if the WAN is offline, but the RODC is online in the branch office? If the RODC cannot connect to a writable domain controller running Windows Server 2008 in the hub, the following branch office operations fail:

  Password changes Attempts to join a computer to a domain Computer rename Authentication attempts for accounts whose credentials are not cached on the RODC Group Policy updates that an administrator might attempt by running the gpupdate /force command What operations succeed if the WAN is offline, but the RODC is online in the branch office? If the RODC cannot connect to a writable domain controller running Windows Server 2008 in the hub, the following branch office operations succeed:

  Authentication and logon attempts, if the credentials for the resource and the requester are already cached, Local RODC server administration performed by a delegated RODC server administrator.

• Question 164:

  Your network contains an Active Directory forest. The forest contains two domains named contoso.com and eu.contoso.com. All domain controllers are DNS servers.

  The domain controllers in contoso.com host the zone for contoso.com. The domain controllers in eu.contoso.com host the zone for eu.contoso.com. The DNS zone for contoso.com is configured as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that all domain controllers in the forest host a writable copy of _msdsc.contoso.com.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a zone delegation record in the contoso.com zone.
  B. Create a zone delegation record in the eu.contoso.com zone.
  C. Create an Active Directory-integrated zone for _msdsc.contoso.com.
  D. Create a secondary zone named _msdsc.contoso.com in eu.contoso.com.
  A. Create a zone delegation record in the contoso.com zone.
  C. Create an Active Directory-integrated zone for _msdsc.contoso.com.

  ---

  Note that the question speaks of _msdSC, instead of _msdCS. Not sure if it means something, probably a typo.

• Question 165:

  Your network contains an Active Directory domain named contoso.com.

  You have a comma separated value (CSV) file named Users.txt. Users.txt contains the information for 500 users and all of the attributes required to create user accounts.

  You plan to automate the creation of user accounts by using the Users.txt file.

  You need to identify which two cmdlets you must run. The solution must pipe the output from the first cmdlet to the second cmdlet.

  What should you run from Windows PowerShell? To answer, configure the appropriate PowerShell command in the answer area.

  Hot Area:

  

  

• Question 166:

  Your network contains an Active Directory forest. The forest contains 10 domains. All domain controllers are configured as global catalog servers.

  You remove the global catalog role from a domain controller named DC5. You need to reclaim the hard disk space used by the global catalog on DC5.

  What should you do?

  A. From Active Directory Sites and Services, run the Knowledge Consistency Checker (KCC).
  B. From Active Directory Sites and Services, modify the general properties of DC5.
  C. From Ntdsutil, use the Semantic database analysis option.
  D. From Ntdsutil, use the Files option.
  D. From Ntdsutil, use the Files option.

  ---

  Reference 1: http://http://technet.microsoft.com/en-us/library/cc816618.aspx Database defragmentation In cases in which the data decreases significantly, such as when the global catalog is removed from a domain controller, free disk space is not automatically returned to the file system. Although this condition does not affect database operation, it does result in large amounts of free disk space in the database. To decrease the size of the database file by returning free disk space from the database file to the file system, you can perform an offline defragmentation of the database. Whereas online defragmentation occurs automatically while AD DS is running, offline defragmentation requires taking the domain controller offline and using the Ntdsutil.exe command-line tool to perform the procedure.

  Reference 2: http://technet.microsoft.com/en-us/library/cc794920.aspx To perform offline defragmentation of the directory database

  1.

  Open a Command Prompt as an administrator: On the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, provide credentials, if required, and then click Continue.

  2.

  At the command prompt, type the following command, and then press ENTER: net stop ntds

  3.

  Type Y to agree to stop additional services, and then press ENTER.

  4.

  At the command prompt, type ntdsutil, and then press ENTER.

  5.

  At the ntdsutil prompt, type activate instance ntds, and then press ENTER.

  6.

  At the ntdsutil prompt, type files, and then press ENTER.

• Question 167:

  Your network contains an Active Directory forest named contoso.com. The forest contains three domains named contoso.com, childl.contoso.com, and child2.contoso.com. The childl.contoso.com domain contains five domain controllers. The

  domain controllers are configured as shown in the following table.

  

  You plan to decommission the child1.contoso.com domain.

  You need to identify which two FSMO roles can be moved from childl.contoso.com to child2.contoso.com.

  Which two FSMO roles should you identify? (Each correct answer presents part of the solution. Choose two.)

  A. Domain naming master
  B. Schema master
  C. Infrastructure master
  D. PDC emulator
  E. RID master
  A. Domain naming master
  B. Schema master

  ---

  Forestwide Operations Master Roles

  The schema master and domain naming master are forestwide roles, meaning that there is only one schema master and one domain naming master in the entire forest.

  Note:

  *

  Operations Master Roles

  The five operations master roles are assigned automatically when the first domain controller in a given domain is created. Two forest-level roles are assigned to the first domain controller created in a forest and three domain-level roles are

  assigned to the first domain controller created in a domain.

  *

  The five FSMO roles [in Windows 2003] are:

  Schema master - Forest-wide and one per forest.

  Domain naming master - Forest-wide and one per forest.

  RID master - Domain-specific and one for each domain.

  PDC - PDC Emulator is domain-specific and one for each domain. Infrastructure master - Domain-specific and one for each domain.

• Question 168:

  You have an enterprise root certification authority (CA) that runs Windows Server 2008 R2. You need to ensure that you can recover the private key of a certificate issued to a Web server.

  What should you do?

  A. From the CA, run the Get-PfxCertificate cmdlet.
  B. From the Web server, run the Get-PfxCertificate cmdlet.
  C. From the CA, run the certutil.exe tool and specify the -exportpfx parameter.
  D. From the Web server, run the certutil.exe tool and specify the -exportpfx parameter.
  D. From the Web server, run the certutil.exe tool and specify the -exportpfx parameter.

  ---

  http://technet.microsoft.com/en-us/library/ee449471%28v=ws.10%29.aspx Manual Key Archival Manual key archival can be used in the following common scenarios that are not supported by automatic key archival:

  Secure/Multipurpose Internet Mail Extensions (S/MIME) certificates used by Microsoft?Office Outlook.

  Certificates issued by CAs that do not support key archival. Certificates installed on the Microsoft Windows?2000 and Windows Millennium Edition operating systems.

  This topic includes procedures for exporting a private key by using the following programs and for importing a private key to a CA database:

  Certutil.exe

  Certificates snap-in

  Microsoft Office Outlook

  ..

  To export private keys by using Certutil.exe

  1.

  Open a Command Prompt window.

  2.

  Type the Certutil.exe exportpfx command using the command-line options described in the following table. Certutil.exe [-p ] exportpfx

  

• Question 169:

  Your company has an Active Directory forest.

  You plan to install an Enterprise certification authority (CA) on a dedicated stand-alone server. When you attempt to add the Active Directory Certificate Services (AD CS) role, you find that the Enterprise CA option is not available.

  You need to install the AD CS role as an Enterprise CA.

  What should you do first?

  A. Add the DNS Server role.
  B. Add the Active Directory Lightweight Directory Service (AD LDS) role.
  C. Add the Web server (IIS) role and the AD CS role.
  D. Join the server to the domain.
  D. Join the server to the domain.

  ---

  http://technet.microsoft.com/en-us/library/cc772393%28v=ws.10%29.aspx Active Directory Certificate Services Step-by-Step Guide http://kazmierczak.eu/itblog/2012/09/23/enterprise-ca-option-is-greyed-out-unavailable/ Enterprise CA option is greyed out / unavailable Many times, administrators ask me what to do when installing Active Directory Certificate Services they cannot choose to install Enterprise Certification Authority, ecause it's unavailable as in following picture:

  

  Well, you need to fulfill basic requirements:

  Server machine has to be a member server (domain joined). You can run an Enterprise CA on the Standard, Enterprise, or Data Center Windows Edition. The difference is the number of ADCS features and components that can be enabled.

  To get full functionality, you need to run on Enterprise or Data Center Windows Server 2008 /R2/ Editions. It includes functionality like Role separation, Certificate manager restrictions, Delegated enrollment agent restrictions, Certificate

  enrollment across forests, Online Responder, Network Device Enrollment. In order to install an Enterprise CA, you must be a member of either Enterprise Admins or Domain Admins in the forest root domain (either directly or through a group

  nesting). If issue still persists, there is probably a problem with getting correct credentials of your account. There are many thing that can cause it (network blockage, domain settings, server configuration, and other issues). In all cases I got,

  this troubleshooting helped perfectly:

  First of all, carefully check all above requirements.

  Secondly, install all available patches and Service Packs with Windows Update before trying to install Enterprise CA.

  Check network settings on the CA Server. If there is no DNS setting, Certificate Authority Server cannot resolve and find domain.

  Sufficient privileges for writing the Enterprise CA configuration information in AD configuration partition are required. Determine if you are a member of the Enterprise Admins or Domain Admins in the forest root domain. Think about the

  account you are currently trying to install ADCS with. In fact, you may be sure, that your account is in Enterprise Admins group, but check this how CA Server "sees" your account membership by typing whoami /groups.

  You also need to be a member of local Administrators group. If you are not, you wouldn't be able to run Server Manager, but still needs to be checked.

  View C:\windows\certocm.log file. There you can find helpful details on problems with group membership. For example status of ENUM_ENTERPRISE_UNAVAIL_REASON_NO_INSTALL_RIGHTS indicates that needed memberships are not

  correct.

  Don't forget to check event viewer on CA Server side and look for red lines. Verify that network devices or softwareandhardware firewalls are not blocking access from/to server and Domain Controllers. If so, Certificate Authority Server may not be communicating correctly with the domain. To check that, simply run nltest /sc_verify:DomainName Check also whether Server CA is connected to a writable Domain Controller. Enterprise Admins groups is the most powerful group and has ADCS required full control permissions, but who knows maybe someone changed default permissions? Run adsiedit.msc on Domain Controller, connect to default context and first of all check if CN=Public Key Service,CN=Services,CN=Configuration,DC=Your,DC=Domain,DC=Com container does exist. If so, check permissions for all subcontainers under Public Key Service if Enterprise Admins group has full control permissions. The main subcontainers to verify are Certificate Templates, OID, KRA containers. If no above tips help, disjoin the server from domain and join again. Ultimately reinstall operation system on CA Server.

• Question 170:

  Your network contains an Active Directory domain.

  The domain contains a certification authority (CA).

  The network contains several Layer 3 switches.

  You need to ensure that the switches can request certificates from the CA.

  Which role service should you deploy?

  A. Network Device Enrollment Service
  B. Windows Token-based Agent
  C. Network Policy Server
  D. Client Certificate Mapping Authentication
  A. Network Device Enrollment Service