Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 171:

  Your company has an Active Directory forest that contains client computers that run Windows Vista andMicrosoft Windows XP.

  You need to ensure that users are able to install approved application updates on their computers. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Set up Automatic Updates through Control Panel on the client computers.
  B. Create a GPO and link it to the Domain Controllers organizational unit. Configure the GPO to automatically search for updates on the Microsoft Update site.
  C. Create a GPO and link it to the domain. Configure the GPO to direct the client computers to the Windows Server Update Services (WSUS) server for approved updates.
  D. Install the Windows Server Update Services (WSUS). Configure the server to search for new updates on the Internet. Approve all required updates.
  C. Create a GPO and link it to the domain. Configure the GPO to direct the client computers to the Windows Server Update Services (WSUS) server for approved updates.
  D. Install the Windows Server Update Services (WSUS). Configure the server to search for new updates on the Internet. Approve all required updates.

  ---

  http://technet.microsoft.com/en-us/library/cc720539%28v=ws.10%29.aspx Configure Automatic Updates by Using Group Policy

  When you configure the Group Policy settings for WSUS, use a Group Policy object (GPO) linked to an Active Directory container appropriate for your environment.

• Question 172:

  A corporate environment includes a Windows Server 2008 R2 Active Directory Domain Services (AD DS) domain.

  You need to enable Universal Group Membership Caching on several domain controllers in the domain.

  Which tool should you use?

  A. Dsmod
  B. Dscmd
  C. Ntdsutil
  D. Active Directory Sites and Services console
  D. Active Directory Sites and Services console

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc816928.aspx

  Enable Universal Group Membership Caching in a Site In a branch site that has no global catalog server and in a forest that has multiple domains, you can use this procedure to enable Universal Group Membership Caching on a domain controller in the site so that a global catalog server does not have to be contacted across a wide area network (WAN) link for every initial user logon.

  To enable Universal Group Membership Caching in a site

  1.

  Open Active Directory Sites and Services.

  2.

  In the console tree, expand Sites, and then click the site in which you want to enable Universal Group Membership Caching.

  3.

  In the details pane, right-click the NTDS Site Settings object, and then click Properties.

  4.

  Under Universal Group Membership Caching, select Enable Universal Group Membership Caching.

  5.

  In the Refresh cache from list, click the site that you want the domain controller to contact when the Universal Group membership cache must be updated, and then click OK.

• Question 173:

  Your network contains a single Active Directory domain. The domain contains five read-only domain controllers (RODCs) and five writable domain controllers. All servers run Windows Server 2008. You plan to install a new RODC that runs Windows Server 2008 R2. You need to ensure that you can add the new RODC to the domain. You want to achieve this goal by using the minimum amount of administrative effort.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. From Active Directory Domains and Trusts, raise the functional level of the domain.
  B. At the command prompt, run adprep.exe /forestprep.
  C. From Active Directory Users and Computers, pre-stage the RODC computer account.
  D. At the command prompt, run adprep.exe /domainprep.
  E. At the command prompt, run adprep.exe /rodcprep.
  C. From Active Directory Users and Computers, pre-stage the RODC computer account.
  D. At the command prompt, run adprep.exe /domainprep.

  ---

  C:

  *

  During the first stage of the installation, the wizard records all the data about the RODC that will be stored in the distributed Active Directory database, including the read-only domain controller account name and the site in which it will be placed. This stage must be performed by a member of the Domain Admins group.

  *

  To create an RODC account by using the Windows interface Click Start, click Administrative Tools, and then click Active Directory Users and Computers. Double-click the domain container, then you can either right-click the Domain Controllers container or click the Domain Controllers container, and then click Action.

  Click Pre-create Read-only Domain Controller account

• Question 174:

  You are the administrator of an organization with a single Active Directory domain.

  A user who left the company returns after 16 weeks.

  The user tries to log onto their old computer and receives an error stating that authentication has failed.

  The user's account has been enabled.

  You need to ensure that the user is able to log onto the domain using that computer.

  What do you do?

  A. Reset the computer account in Active Directory. Disjoin the computer from the domain and then rejoin the computer to the domain.
  B. Run the ADadd command to rejoin the computer account.
  C. Run the MMC utility on the user's computer and add the Domain Computers snap-in.
  D. Re-create the user account and reconnect the user account to the computer account.
  A. Reset the computer account in Active Directory. Disjoin the computer from the domain and then rejoin the computer to the domain.

  ---

  Basically the same as A/Q10:

  Answer: Reset the computer account. Disjoin the computer from the domain, and then rejoin the computer to the domain.

  http://social.technet.microsoft.com/wiki/contents/articles/9157.trust-relationship-between-workstation- andprimary-domain-failed.aspx

  Trust Relationship between Workstation and Primary Domain failed What are the common causes which generates this message on client systems? There might be multiple reasons for this kind of behaviour. Below are listed a few of them:

  1.

  Single SID has been assigned to multiple computers.

  2.

  If the Secure Channel is Broken between Domain controller and workstations

  3.

  If there are no SPN or DNSHost Name mentioned in the computer account attributes

  4.

  Outdated NIC Drivers.

  How to Troubleshoot this behaviour? ..

  2. If the Secure Channel is Broken between Domain controller and workstations When a Computer account is joined to the domain, Secure Channel password is stored with computer account in domain controller. By default this password will change every 30 days (This is an automatic process, no manual intervention is required). Upon starting the computer, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC. If there are problems with system time, DNS configuration or other settings, secure channel's password between Workstation and DCs may not synchronize with each other. A common cause of broken secure channel [machine account password] is that the secure channel password held by the domain member does not match that held by the AD. Often, this is caused by performing a Windows System Restore (or reverting to previous backup or snapshot) on the member machine, causing an old (previous) machine account password to be presented to the AD.

  Resolution:

  Most simple resolution would be unjoin/disjoin the computer from the domain and rejoin the computer account back to the domain. (this is a somewhat similar principle to performing a password reset for a user account)

  Or

  You can go ahead and reset the computer account using netdom.exe tool http://technet.microsoft.com/en-us/library/cc772217%28v=ws.10%29.aspx Netdom Enables administrators to manage Active Directory domains and trust relationships

  from the command prompt.

  Netdom is a command-line tool that is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the Active Directory Domain Services (AD DS) server role installed. It is also available if you install the Active

  Directory Domain Services Tools that are part of the Remote Server Administration Tools (RSAT).

  You can use netdom to:

  Join a computer that runs Windows XP Professional, Windows Vista, or Windows 7 to a Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 2000, or Windows NT 4.0 domain.

  Manage computer accounts for domain member workstations and member servers. Management operations include:

  Establish one-way or two-way trust relationships between domains, including the following kinds of trust relationships:

  Verify or reset the secure channel for the following configurations:

  *

  Member workstations and servers.

  *

  Backup domain controllers (BDCs) in a Windows NT 4.0 domain.

  *

  Specific Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or Windows 2000 replicas. Manage trust relationships between domains.

  Syntax

  NetDom [] [{/d: | /domain:} ] [] http://technet.microsoft.com/en-us/library/cc788073%28v=ws.10%29.aspx Netdom reset Resets the secure connection between a workstation and a domain

  controller. Syntax netdom reset {/d: | /domain:} [{/s: | /server:} ] [{/uo: | /usero:} {/po: | /passwordo}{|*}] [{/help | /?}] Further information:

  http://technet.microsoft.com/en-us/library/cc835085%28v=ws.10%29.aspx Netdom trust

  Establishes, verifies, or resets a trust relationship between domains. Syntax netdom trust {/d: | /domain:} [{/ud: | /userd:} [\]

  [{/pd: | /passwordd:}{|*}] [{/uo: | /usero:}] [{/po: | /passwordo:} {|*}] [/verify] [/reset] [/passwordt:][/add [/realm]] [/remove [/force]] [/twoway] [/kerberos] [/transitive[:{YES|NO}]] [/

  oneside:{TRUSTED | TRUSTING}] [/force] [/quarantine[:{YES | NO}]] [/namesuffixes: [/togglesuffix:#]] [/nableSIDHistory] [/ForestTRANsitive] [/SelectiveAUTH][/AddTLN][/AddTLNEX][/RemoveTLN] [/RemoveTLNEX] [{/help | /?}]

• Question 175:

  A corporate network includes an Active Directory Domain Services (AD DS) forest that contains two domains. All servers run Windows Server 2008 R2. All domain controllers are configured as DNS servers.

  A standard primary zone for dev.contoso.com is stored on a member server. You need to ensure that all domain controllers can resolve names from the dev.contoso.com zone.

  What should you do?

  A. On one domain controller, create a stub zone. Configure the stub zone to replicate to all DNS servers in the forest.
  B. On one domain controller, create a stub zone. Configure the stub zone to replicate to all DNS servers in the domain.
  C. On one domain controller, create a conditional forwarder. Configure the conditional forwarder to replicate to all DNS servers in the domain.
  D. On the member server, create a secondary zone.
  A. On one domain controller, create a stub zone. Configure the stub zone to replicate to all DNS servers in the forest.

• Question 176:

  Your network contains an Active Directory forest named contoso.com. You need to identify whether a fine-grained password policy is applied to a specific group. Which tool should you use?

  A. Active Directory Users and Computers
  B. Security Configuration Wizard (SCW)
  C. Group Policy Management Editor
  D. Active Directory Sites and Services
  A. Active Directory Users and Computers

• Question 177:

  Your network contains an Active Directory domain named contoso.com. You need to create one password policy for administrators and another password policy for all other users. Which tool should you use?

  A. Group Policy Management Editor
  B. Authorization Manager
  C. Dsadd
  D. Ldifde
  D. Ldifde

  ---

  Reference: http://technet.microsoft.com/en-US/library/cc754461.aspx

  Creating a PSO using ldifde You can use the ldifde command as a scriptable alternative for creating PSOs. To create a PSO using ldifde

  1.

  Define the settings of a new PSO by saving the following sample code as a file, for example, pso.ldf: dn: CN=PSO1, CN=Password Settings Container,CN=System,DC=dc1,DC=contoso,DC=com changetype: add objectClass: msDS-PasswordSettings msDS-MaximumPasswordAge:-1728000000000 msDS-MinimumPasswordAge:-864000000000 msDS-MinimumPasswordLength:8 msDS-PasswordHistoryLength:24 msDS-PasswordComplexityEnabled:TRUE msDS-PasswordReversibleEncryptionEnabled:FALSE msDS-LockoutObservationWindow:-18000000000 msDS-LockoutDuration:-18000000000 msDS-LockoutThreshold:0 msDS-PasswordSettingsPrecedence:20

  msDS-PSOAppliesTo:CN=user1,CN=Users,DC=dc1,DC=contoso,DC=com

  2.

  Open a command prompt. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  3.

  Type the following command, and then press ENTER: ldifde i f pso.ldf

• Question 178:

  Your company has an Active Directory domain that runs Windows Server 2008 R2. The Sales OU contains an OU for Computers, an OU for Groups, and an OU for Users.

  You perform nightly backups. An administrator deletes the Groups OU.

  You need to restore the Groups OU without affecting users and computers in the Sales OU.

  What should you do?

  A. Perform an authoritative restore of the Sales OU.
  B. Perform a non-authoritative restore of the Sales OU.
  C. Perform an authoritative restore of the Groups OU.
  D. Perform a non-authoritative restore of the Groups OU.
  C. Perform an authoritative restore of the Groups OU.

  ---

  Answer: Perform an authoritative restore of the Groups OU.

  http://technet.microsoft.com/en-us/library/cc816878%28v=ws.10%29.aspx Performing Authoritative Restore of Active Directory Objects An authoritative restore process returns a designated, deleted Active Directory object or container of objects to its predeletion state at the time when it was backed up. For example, you might have to perform an authoritative restore if an administrator inadvertently deletes an organizational unit (OU) that contains a large number of users. In most cases, there are two parts to the authoritative restore process: a nonauthoritative restore from backup, followed by an authoritative restore of the deleted objects. If you perform a nonauthoritative restore from backup only, the deleted OU is not restored because the restored domain controller is updated after the restore process to the current status of its replication partners, which have deleted the OU. To recover the deleted OU, after you perform nonauthoritative restore from backup and before allowing replication to occur, you must perform an authoritative restore procedure. During the authoritative restore procedure, you mark the OU as authoritative and let the replication process restore it to all the other domain controllers in the domain. After an authoritative restore, you also restore group memberships, if necessary.

• Question 179:

  You have an Active Directory snapshot.

  You need to view the contents of the organizational units (OUs) in the snapshot.

  Which tools should you run?

  A. explorer.exe, netdom.exe, and dsa.msc
  B. ntdsutil.exe, dsamain.exe, and dsa.msc
  C. wbadmin.msc, dsamain.exe, and netdom.exe
  D. wbadmin.msc, ntdsutil.exe, and explorer.exe
  B. ntdsutil.exe, dsamain.exe, and dsa.msc

• Question 180:

  All consultants belong to a global group named TempWorkers. You place three file servers in a new organizational unit named SecureServers. The three file servers contain confidential data located in shared folders.

  You need to record any failed attempts made by the consultants to access the confidential data.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create and link a new GPO to the SecureServers organizational unit. Configure the Deny access to this computer from the network user rights setting for the TempWorkers global group.
  B. Create and link a new GPO to the SecureServers organizational unit. Configure the Audit privilege use Failure audit policy setting.
  C. Create and link a new GPO to the SecureServers organizational unit. Configure the Audit object access Failure audit policy setting.
  D. On each shared folder on the three file servers, add the three servers to the Auditing tab. Configure the Failed Full control setting in the Auditing Entry dialog box.
  E. On each shared folder on the three file servers, add the TempWorkers global group to the Auditing tab. Configure the Failed Full control setting in the Auditing Entry dialog box.
  C. Create and link a new GPO to the SecureServers organizational unit. Configure the Audit object access Failure audit policy setting.
  E. On each shared folder on the three file servers, add the TempWorkers global group to the Auditing tab. Configure the Failed Full control setting in the Auditing Entry dialog box.

  ---

  Reference:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) page 671

  Auditing Resource Access

  Object access can be audited, although it is not one of the recommended settings. Auditing object access can place a significant load on the servers, so it should only be enabled when it is specifically needed. Auditing object access is a two-

  step process: Step one is enabling "Audit object access" and step two is selecting the objects to be audited. When enabling Audit object access, you need to decide if both failure and success events will be logged. The two options are as

  follows:

  Audit object access failure enables you to see if users are attempting to access objects to which they have no rights. This shows unauthorized attempts.

  Audit object access success enables you to see usage patterns. This shows misuse of privilege. After object access auditing is enabled, you can easily monitor access to resources such as folders, files, and printers.

  Auditing Files and Folders

  The network administrator can tailor the way Windows Server 2008 R2 audits files and folders through the property pages for those files or folders. Keep in mind that the more files and folders that are audited, the more events that can be

  generated, which can increase administrative overhead and system resource requirements.

  Therefore, choose wisely which files and folders to audit. To audit a file or folder, do the following:

  1.

  In Windows Explorer, right-click the file or folder to audit and select Properties.

  2.

  Select the Security tab and then click the Advanced button.

  3.

  In the Advanced Security Settings window, select the Auditing tab and click the Edit button.

  4.

  Click the Add button to display the Select User or Group window.

  5.

  Enter the name of the user or group to audit when accessing the file or folder. Click the Check Names button to verify the name.