Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 181:

  Your company has an Active Directory domain. The main office has a DNS server named DNS1 that is configured with Active Directory-integrated DNS. The branch office has a DNS server named DNS2 that contains a secondary copy of the

  zone from DNS1. The two offices are connected with an unreliable WAN link.

  You add a new server to the main office.

  Five minutes after adding the server, a user from the branch office reports that he is unable to connect to the new server.

  You need to ensure that the user is able to connect to the new server.

  What should you do?

  A. Clear the cache on DNS2.
  B. Reload the zone on DNS1.
  C. Refresh the zone on DNS2.
  D. Export the zone from DNS1 and import the zone to DNS2.
  C. Refresh the zone on DNS2.

  ---

  Old answer: Refresh the zone on DNS2.

  http://technet.microsoft.com/en-us/library/cc794900%28v=ws.10%29.aspx Adjust the Refresh Interval for a Zone

  You can use this procedure to adjust the refresh interval for a Domain Name System (DNS) zone. The refresh interval determines how often other DNS servers that load and host the zone must attempt to renew the zone.

  By default, the refresh interval for each zone is set to 15 minutes. http://blog.ijun.org/2008/11/difference-between-dnscmd-clearcache.html difference between dnscmd /clearcache and ipconfig /flushdns

  Q: Do "dnscmd /clearcache" and "ipconfig /flushdns" the exact same thing, on a windows 2003 server? What is the difference, if any?

  A: Ipconfig /flushdns will flush the local computer cache. And dnscmd /clearcache will clear the dns server cache.

  Meaning that with the first you will clear the "local" cache of the server you work on. (Even if it is the dns server. It will NOT clear the dns server cache.) While with dnscmd you will clear the dns server cache.

• Question 182:

  Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise.

  You have a custom certificate template named Template 1. Template1 is published to the CA. You need to ensure that all of the members of a group named Group1 can enroll for certificates that use Template1.

  Which snap-in should you use?

  A. Security Templates
  B. Enterprise PKI
  C. Certification Authority
  D. Certificate Templates
  E. Certificates
  F. TPM Management
  G. Authorization Manager
  H. Group Policy Management
  I. Active Directory Users and Computers
  D. Certificate Templates

  ---

  Reference:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 593

  Configuring Certificate Templates

  AD CS provides the Certificate Templates snap-in (Certtmpl.msc), which provides the following capabilities:

  (...)

  Configuring access control lists (ACLs) on certificate templates

• Question 183:

  Your network contains an Active Directory forest named contoso.com. The forest contains a domain controller named DC1 that runs Windows Server 2008 R2 Enterprise and a member server named Server1 that runs Windows Server 2008 R2 Standard. You have a computer named Computer1 that runs Windows 7.

  Computer1 is not connected to the network.

  You need to join Computer1 to the contoso.com domain.

  What should you do? To answer, move the appropriate actions from the Possible Actions list to the Necessary Actions area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 217, 218 Offline Domain Join Offline domain join is also useful when a computer is deployed in a lab or other disconnected environment.

  When the computer is connected to the domain network and started for the first time, it will already be a member of the domain. This also helps to ensure that Group Policy settings are

  applied at the first startup.

  Four major steps are required to join a computer to the domain by using offline domain join:

  1. Log on to a computer in the domain that is running Windows Server 2008 R2 or Windows 7 with an account that has permissions to join computers to the domain.

  2. Use the DJoin command to provision a computer for offline domain join. This step prepopulates Active Directory with the information that Active Directory needs to join the computer to the domain, and exports the information called a blob to a text file.

  3. At the offline computer that you want to join the domain use DJoin to import the blob into the Windows directory.

  4. When you start or restart the computer, it will be a member of the domain.

  Reference 2: http://technet.microsoft.com/en-us/library/offline-domain-join-djoin-step-by-step.aspx Performing an offline domain join using different physical computers To perform an offline domain join using physical computers, you can complete the following steps. The best practice in this case is to have one domain controller, one domain-joined computer to use as a provisioning server, and one client computer that you want to join to the domain.

  1. On the provisioning server, open an elevated command prompt.

  2. Type the following command to provision the computer account:

  djoin /provision /domain /machine /savefile blob.txt

  3. Copy the blob.txt file to the client computer.

  4. On the client computer, open an elevated command prompt, and then type the following command to request the domain join:

  djoin /requestODJ /loadfile blob.txt /windowspath %SystemRoot% /localos

  5. Reboot the client computer. The computer will be joined to the domain.

• Question 184:

  Your network contains an Active Directory domain named adatum.com. All servers run Windows Server 2008 R2 Enterprise. All client computers run Windows 7 Professional.

  The network contains an enterprise certification authority (CA).

  You need to approve a pending certificate request.

  Which snap-in should you use?

  A. Active Directory Administrative Center
  B. Authorization Manager
  C. Certificate Templates
  D. Certificates
  E. Certification Authority
  F. Enterprise PKI
  G. Group Policy Management
  H. Security Configuration Wizard
  I. Share and Storage Management
  E. Certification Authority

  ---

  Reference 1: http://technet.microsoft.com/de-de/library/ff849263.aspx

  To issue a pending certificate request:

  1.

  Log on to your root CA by using an account that is a certificate manager.

  2.

  Start the Certification Authority snap-in.

  3.

  In the console tree, expand your root CA, and click Pending Certificates.

  4.

  In the details pane, right-click the pending CA certificate, and click Issue.

• Question 185:

  Your network contains two forests named contoso.com and fabrikam.com. The functional level of all the domains is Windows Server 2003. The functional level of both forests is Windows 2000.

  You need to create a trust between contoso.com and fabrikam.com. The solution must ensure that users from contoso.com can only access the servers in fabrikam.com that have the Allowed to Authenticate permission set.

  What should you do? To answer, move the appropriate actions from the Possible Actions list to the Necessary Actions area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Still not really sure whether an external trust or forest trust is needed here.Just left it as it is.

  Reference: http://technet.microsoft.com/en-us/library/cc787623.aspx

  Selective authentication over an external trust restricts access to only those users in a trusted domain who have been explicitly given authentication permissions to computer objects (resource computers) that reside in the trusting domain. To explicitly give authentication permissions to computer objects in the trusting domain to certain users, administrators must grant those users the Allowed to Authenticate permission in Active Directory.

• Question 186:

  Your network contains an Active Directory forest. The forest contains two domains. You have a standalone root certification authority (CA).

  On a server in the child domain, you run the Add Roles Wizard and discover that the option to select an enterprise CA is disabled.

  You need to install an enterprise subordinate CA on the server.

  What should you use to log on to the new server?

  A. an account that is a member of the Certificate Publishers group in the child domain
  B. an account that is a member of the Certificate Publishers group in the forest root domain
  C. an account that is a member of the Schema Admins group in the forest root domain
  D. an account that is a member of the Enterprise Admins group in the forest root domain
  D. an account that is a member of the Enterprise Admins group in the forest root domain

  ---

  Reference:

  http://social.technet.microsoft.com/Forums/uk/winserversecurity/thread/887f4cec-12f6-4c15-a506- 568ddb21d46b

  In order to install Enterprise CA you MUST have Enterprise Admins permissions, because Configuration naming context is replicated between domain controllers in the forest (not only current domain) and are writable for Enterprise Admins

  (domain admins permissions are insufficient).

• Question 187:

  Your network consists of an Active Directory forest named contoso.com. All servers run Windows Server 2008 R2. All domain controllers are configured as DNS servers. The contoso.com DNS zone is stored in the ForestDnsZones Active Directory application partition.

  You have a member server that contains a standard primary DNS zone for dev.contoso.com.

  You need to ensure that all domain controllers can resolve names for dev.contoso.com.

  What should you do?

  A. Modify the properties of the SOA record in the contoso.com zone.
  B. Create a NS record in the contoso.com zone.
  C. Create a delegation in the contoso.com zone.
  D. Create a standard secondary zone on a Global Catalog server.
  C. Create a delegation in the contoso.com zone.

  ---

  http://technet.microsoft.com/en-us/library/cc771640.aspx Understanding Zone Delegation

  Domain Name System (DNS) provides the option of dividing up the namespace into one or more zones, which can then be stored, distributed, and replicated to other DNS servers. When you are deciding whether to divide your DNS

  namespace to make additional zones, consider the following reasons to use additional zones:

  You want to delegate management of part of your DNS namespace to another location or department in your organization.

  You want to divide one large zone into smaller zones to distribute traffic loads among multiple servers, improve DNS name resolution performance, or create a more-fault-tolerant DNS environment. You want to extend the namespace by

  adding numerous subdomains at once, for example, to accommodate the opening of a new branch or site.

  ..

  When you delegate zones within your namespace, remember that for each new zone that you create, you need delegation records in other zones that point to the authoritative DNS servers for the new zone. This is necessary both to transfer

  authority and to provide correct referral to other DNS servers and clients of the new servers that are being made authoritative for the new zone.

  ..

  Example: Delegating a subdomain to a new zone

  As shown in the following illustration, when a new zone for a subdomain (example.microsoft.com) is created, delegation from the parent zone (microsoft.com) is needed.

  

• Question 188:

  Your network contains an Active Directory domain. The domain contains four domain controllers.

  You create a new application directory partition.

  You need to ensure that the new application directory partition replicates to only three of the domain controllers.

  Which tool should you use?

  A. Dsdbutil
  B. Active Directory Administrative Center
  C. Dsmod
  D. Dsmgmt
  B. Active Directory Administrative Center

• Question 189:

  Your network contains an Active Directory domain named contoso.com. The domain has one Active Directory site.

  The domain contains an organizational unit (OU) named OU1. OU1 contains user accounts for 100 users and their managers.

  You apply a Group Policy object (GPO) named GPO1 to OU1. GPO1 restricts several desktop settings.

  The managers request that the desktop settings not be applied to them. You need to prevent the desktop settings in GPOl from being applied to the managers. All other users in OU1 must have GPO1 applied to them.

  What should you do?

  A. Configure the permissions on OU1.
  B. Configure the permissions on the user accounts of the managers.
  C. Link GPO1 to a WMI filter.
  D. Configure the permissions of GPOl.
  D. Configure the permissions of GPOl.

  ---

  Security filtering is a way of refining which users and computers will receive and apply the settings in a Group Policy object (GPO). Using security filtering, you can specify that only certain security principals within a container where the GPO is linked apply the GPO. Security group filtering determines whether the GPO as a whole applies to groups, users, or computers; it cannot be used selectively on different settings within a GPO.

  In order for the GPO to apply to a given user or computer, that user or computer must have both Read and Apply Group Policy (AGP) permissions on the GPO, either explicitly, or effectively though group membership.

• Question 190:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. DC1 hosts an Active Directory-integrated zone for contoso.com.

  The research department maintains its own DNS servers and hosts a zone named research.contoso.com on a UNIXbased server named Server1.

  The perimeter network contains a DNS server named Server2. Server2 is a standalone server that runs Windows Server 2008 R2.

  You need to configure the DNS settings of Server2 to meet the following requirements:

  

  Server2 must maintain a copy of all the records in research.contoso.com.

  

  DC1 must query Server2 to resolve the names of Internet hosts.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a secondary zone.
  B. Create a conditional forwarder.
  C. Create a stub zone.
  D. Create a primary zone.
  E. Create a Forwarder.
  A. Create a secondary zone.
  E. Create a Forwarder.

  ---

  A: When a zone that this DNS server hosts is a secondary zone, this DNS server is a secondary source for information about this zone. The zone at this server must be obtained from another remote DNS server computer that also hosts the

  zone. This DNS server must have network access to the remote DNS server that supplies this server with updated information about the zone. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it

  cannot be stored in AD DS.

  E: * A forwarder is a Domain Name System (DNS) server on a network that is used to forward DNS queries for external DNS names to DNS servers outside that network.

  Incorrect:

  Not B: You can configure your server to forward queries according to specific domain names using conditional forwarders.