Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 191:

  Your network contains an Active Directory domain named litwareinc.com. The domain contains two sites named Site1 and Site2. Site2 contains a read-only domain controller (RODC). You need to identify which user accounts attempted to authenticate to the RODC.

  Which tool should you use?

  A. Repadmin
  B. Dcdiag
  C. Get-ADAccountResultantPasswordReplicationPolicy
  D. Active Directory Sites and Services
  A. Repadmin

• Question 192:

  Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com. The contoso.com domain contains a domain controller named DC1. The east.contoso.com domain contains a domain controller named DC2. DC1 and DC2 have the DNS Server server role installed.

  You need to create a DNS zone that is available on DC1 and DC2. The solution must ensure that zone transfers are encrypted.

  What should you do?

  A. Create a primary zone on DC1 and store the zone in a zone file. On DC1 and DC2, configure inbound rules and outbound rules by using Windows Firewall with Advanced Security. Create a secondary zone on DC2 and select DC1 as the master.
  B. Create a primary zone on DC1 and store the zone in a DC=ForestDNSZones, DC=Contoso, DC=com naming context.
  C. Create a primary zone on DC2 and store the zone in a DC= DC=East, DC=Contoso/DC=com naming context. Create a secondary zone on DC1 and select DC2 as the master.
  D. Create a primary zone on DC1 and store the zone in a zone file. Configure DNSSEC for the zone. Create a secondary zone on DC2 and select DC1 as the master.
  B. Create a primary zone on DC1 and store the zone in a DC=ForestDNSZones, DC=Contoso, DC=com naming context.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc781101.aspx

  Securing DNS Zone Replication

  Using Active Directory Replication

  Replicating zones as part of Active Directory replication provides the following security benefits:

  Active Directory replication traffic is encrypted; therefore zone replication traffic is encrypted automatically.

  (...)

  Reference:

  http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions DNSSEC was designed to protect Internet resolvers (clients) from forged DNS data, such as that created by DNS cache poisoning. All answers in DNSSEC are digitally

  signed. By checking the digital signature, a DNS resolver is able to check if the information is identical (correct and complete) to the information on the authoritative DNS server. DNSSEC does not provide confidentiality of data; in particular,

  all DNSSEC responses are authenticated but not encrypted.

  Reference:

  http://www.nlnetlabs.nl/publications/dnssec_howto/

  Voorbeeld opbouw DNSSEC records.

  Reference:

  http://www.efficientip.com/dnssec

  It is important to note that DNSSEC does not supply a solution for data confidentiality but only a validation of DNS data authenticity and integrity. All information exchanged is not encrypted; it is only the signature which is encrypted.

  Reference:

  http://technet.microsoft.com/en-us/library/ee649277.aspx

  Zone transfers Zone transfers of a DNSSEC-signed zone function in the same way they do for an unsigned zone. All of the resource records, including DNSSEC resource records, are transferred from the primary server to the secondary

  servers with no additional setup requirements.

• Question 193:

  Your network contains a single Active Directory domain. Client computers run either Windows XP Service Pack 3 (SP3) or Windows 7. All of the computer accounts for the client computers are located in an organizational unit (OU) named OU1.

  You link a new Group Policy object (GPO) named GPO10 to OU1. You need to ensure that GPO10 is applied only to client computers that run Windows 7.

  What should you do?

  A. Create a new OU in OU1. Move the Windows XP computer accounts to the new OU.
  B. Enable block inheritance on OU1.
  C. Create a WMI filter and assign the filter to GPO10.
  D. Modify the permissions of OU1.
  C. Create a WMI filter and assign the filter to GPO10.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc947846.aspx To make sure that each GPO associated with a group can only be applied to computers running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each computer.

• Question 194:

  Your company has an Active Directory domain. All servers run Windows Server 2008 R2. Your company uses an Enterprise Root certification authority (CA) and an Enterprise Intermediate CA.

  The Enterprise Intermediate CA certificate expires.

  You need to deploy a new Enterprise Intermediate CA certificate to all computers in the domain.

  What should you do?

  A. Import the new certificate into the Intermediate Certification Store on the Enterprise Root CA server.
  B. Import the new certificate into the Intermediate Certification Store on the Enterprise Intermediate CA server.
  C. Import the new certificate into the Intermediate Certification Store in the Default Domain Controllers group policy object.
  D. Import the new certificate into the Intermediate Certification Store in the Default Domain group policy object.
  B. Import the new certificate into the Intermediate Certification Store on the Enterprise Intermediate CA server.

  ---

  http://technet.microsoft.com/en-us/library/cc962065.aspx Certification Authority Trust Model

  Certification Authority Hierarchies The Windows 2000 public key infrastructure supports a hierarchical CA trust model, called the certification hierarchy, to provide scalability, ease of administration, and compatibility with a growing number of commercial third-party CA services and public key-aware products. In its simplest form, a certification hierarchy consists of a single CA. However, the hierarchy usually contains multiple CAs that have clearly defined parent-child relationships. Figure 16.5 shows some possible CA hierarchies.

  

  You can deploy multiple CA hierarchies to meet your needs. The CA at the top of the hierarchy is called a root CA . Root CAs are self-certified by using a self-signed CA certificate. Root CAs are the most trusted CAs in the organization and it

  is recommended that they have the highest security of all. There is no requirement that all CAs in an enterprise share a common top-level CA parent or root. Although trust for CAs depends on each domain's CA trust policy, each CA in the

  hierarchy can be in a different domain.

  Child CAs are called subordinate CAs. Subordinate CAs are certified by the parent CAs. A parent CA certifies the subordinate CA by issuing and signing the subordinate CA certificate. A subordinate CA can be either an intermediate or an

  issuing CA. An intermediate CA issues certificates only to subordinate CAs. An issuing CA issues certificates to users, computers, or services. http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/605dbf9d-2694-47838002-c08b9c7d4149

  Forum FAQ: How to import certificate into Intermediate Certification Authorities store? Question:

  How to import certificate into Intermediate Certification Authorities store? Answer:

  In Windows Server 2008 or Windows Server 2008 R2 domain, we can import intermediate CA certificates using group policy:

  Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Intermediate Certification AUthorities The policy is not available in Windows Server 2003. For Windows 2003 domain, you can write a script that uses

  the following command to push out the intermediate CA certificate via group policy. The server will have to be rebooted for this to take effect.

  Certutil f addstore CA .crt

  Note: CA is the programmatic name of the Intermediate Certification Authorities store.

• Question 195:

  ABC.com has purchased laptop computers that will be used to connect to a wireless network.

  You create a laptop organizational unit and create a Group Policy Object (GPO) and configure user profiles by utilizing the names of approved wireless networks.

  You link the GPO to the laptop organizational unit. The new laptop users complain to you that they cannot connect to a wireless network.

  What should you do to enforce the group policy wireless settings to the laptop computers?

  A. Execute gpupdate/target:computer command at the command prompt on laptop computers
  B. Execute Add a network command and leave the SSID (service set identifier) blank
  C. Execute gpupdate/boot command at the command prompt on laptops computers
  D. Connect each laptop computer to a wired network and log off the laptop computer and then login again.
  E. None of the above
  D. Connect each laptop computer to a wired network and log off the laptop computer and then login again.

• Question 196:

  Your network contains an Active Directory domain.

  You have two Group Policy objects (GPOS) named GPO1 and GPO2. GPO1 and GPO2 are linked to theFinance organizational unit (OU) and contain multiple settings. You discover that GPO2 has a setting that conflicts with a setting in GPO1. When the policies are applied, the setting in GPO2 takes effect.

  You need to ensure that the settings in GPO1 supersede the settings in GPO2. The solution must ensure that all non-conflicting settings in both GPOs are applied.

  What should you do?

  A. Configure the link order.
  B. Configure Restricted Groups.
  C. Enable block inheritance.
  D. Link the GPO to the Finance OU.
  E. Enable Ioopback processing in merge mode.
  F. Enable Ioopback processing in replace mode.
  G. Link the GPO to the Human Resources OU.
  H. Configure Group Policy Preferences.
  I. Configure WMI filtering.
  J. Modify the Group Policy permissions.
  A. Configure the link order.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 283 Precedence of Multiple Linked GPOs

  An OU, domain, or site can have more than one GPO linked to it. In the event of multiple GPOs, the GPOs' link order determines their precedence. In Figure 6-10, two GPOs are linked to the People OU.

  

  Figure 6-10 GPO link order

  The object higher on the list, with a link order of 1, has the highest precedence. Therefore, settings that are enabled or disabled in the Power User Configuration GPO have precedence over these same settings in the Standard User

  Configuration GPO.

  To change the precedence of a GPO link:

  1.

  Select the OU, site, or domain in the GPMC console tree.

  2.

  Click the Linked Group Policy Objects tab in the details pane.

  3.

  Select the GPO.

  4.

  Use the Up, Down, Move To Top, and Move To Bottom arrow icons to change the link order of the selected GPO.

• Question 197:

  Your company has a main office and four branch offices. An Active Directory site exists for each office. Each site contains one domain controller. Each branch office site has a site link to the main office site.

  You discover that the domain controllers in the branch offices sometimes replicate directly to each other.

  You need to ensure that the domain controllers in the branch offices only replicate to the domain controller in the main office.

  What should you do?

  A. Modify the firewall settings for the main office site.
  B. Disable the Knowledge Consistency Checker (KCC) for each branch office site.
  C. Disable site link bridging.
  D. Modify the security settings for the main office site.
  C. Disable site link bridging.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc757117.aspx

  Configuring site link bridges By default, all site links are bridged, or transitive. This allows any two sites that are not connected by an explicit site link to communicate directly, through a chain of intermediary site links and sites. One advantage to bridging all site links is that your network is easier to maintain because you do not need to create a site link to describe every possible path between pairs of sites. Generally, you can leave automatic site link bridging enabled. However, you might want to disable automatic site link bridging and create site link bridges manually just for specific site links, in the following cases: You have a network routing or security policy in place that prevents every domain controller from being able to directly communicate with every other domain controller.

• Question 198:

  Your network contains an Active Directory forest named contoso.com. You need to identify whether a fine-grained password policy is applied to a specific group. Which tool should you use?

  A. Active Directory Sites and Services
  B. Active Directory Users and Computers
  C. Security Configuration Wizard (SCW)
  D. Local Security Policy
  A. Active Directory Sites and Services

• Question 199:

  Your network contains an Active Directory forest.

  You need to add a new user principal name (UPN) suffix to the forest.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Active Directory Domains and Trusts
  C. Active Directory Sites and Services
  D. Active Directory Users and Computers
  B. Active Directory Domains and Trusts

  ---

  Reference:

  http://www.kassapoglou.com/windows-server-2008-lesson-23-video-creating-a-user/ Demonstration adding a UPN Suffix

  To add or modify a UPN suffix for your forest, open Active Directory Domains and Trusts from the start menu. Right click Active Directory Domains and Trusts at the top and open the properties. From here you can add and remove additional

  domain UPN suffixes for the forest.

• Question 200:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. A domain controller named DC1 has a standard primary zone for contoso.com. A domain controller named DC2 has a standard secondary zone for contoso.com.

  You need to ensure that the replication of the contoso.com zone is encrypted.

  You must not lose any zone data.

  What should you do?

  A. Convert the primary zone into an Active Directory-integrated stub zone. Delete the secondary zone.
  B. Convert the primary zone into an Active Directory-integrated zone. Delete the secondary zone.
  C. Configure the zone transfer settings of the standard primary zone. Modify the Master Servers lists on the secondary zone.
  D. On both servers, modify the interface that the DNS server listens on.
  B. Convert the primary zone into an Active Directory-integrated zone. Delete the secondary zone.

  ---

  Answer: Convert the primary zone into an Active Directory-integrated zone. Delete the secondary zone.

  http://technet.microsoft.com/en-us/library/cc771150.aspx Change the Zone Type

  You can use this procedure to change make a zone a primary, secondary, or stub zone. You can also use it to integrate a zone with Active Directory Domain Services (AD DS). http://technet.microsoft.com/en-us/library/cc726034.aspx

  Understanding Active Directory Domain Services Integration The DNS Server service is integrated into the design and implementation of Active Directory Domain Services (AD DS). AD DS provides an enterprise-level tool for organizing,

  managing, and locating resources in a network.

  Benefits of AD DS integration

  For networks that deploy DNS to support AD DS, directory-integrated primary zones are strongly recommended. They provide the following benefits:

  DNS features multimaster data replication and enhanced security based on the capabilities of AD DS. In a standard zone storage model, DNS updates are conducted based on a single-master update model. In this model, a single

  authoritative DNS server for a zone is designated as the primary source for the zone.

  This server maintains the master copy of the zone in a local file. With this model, the primary server for the zone represents a single fixed point of failure. If this server is not available, update requests from DNS clients are not processed for

  the zone. With directory-integrated storage, dynamic updates to DNS are sent to any AD DS-integrated DNS server and are replicated to all other AD DS-integrated DNS servers by means of AD DS replication. In this model, any AD DS-

  integrated DNS servercan accept dynamic updates for the zone. Because the master copy of the zone is maintained in the AD DS database, which is fully replicated to all domain controllers, the zone can be updated by the DNS servers

  operating at any domain controller for the domain. With the multimaster update model of AD DS, any of the primary servers for the directoryintegrated zone can process requests from DNS clients to update the zone as long as a domain

  controller is available and reachable on the network.

  ..

  Zones are replicated and synchronized to new domain controllers automatically whenever a new one is added to an AD DS domain.

  By integrating storage of your DNS zone databases in AD DS, you can streamline database replication planning for your network.

  Directory-integrated replication is faster and more efficient than standard DNS replication. http://technet.microsoft.com/en-us/library/ee649124%28v=ws.10% 29.aspx Deploy IPsec Policy to DNS Servers

  You can deploy IPsec rules through one of the following mechanisms:

  Domain Controllers organizational unit (OU): If the DNS servers in your domain are Active Directoryintegrated, you can deploy IPsec policy settings using the Domain Controllers OU. This option is recommended to make configuration and

  deployment easier. DNS Server OU or security group: If you have DNS servers that are not domain controllers, then consider creating a separate OU or a security group with the computer accounts of your DNS servers. Local firewall

  configuration: Use this option if you have DNS servers that are not domain members or if you have a small number of DNS servers that you want to configure locally. http://technet.microsoft.com/en-us/library/cc772661%28v=ws.10%29.aspx

  Deploying Secure DNS

  Protecting DNS Servers

  When the integrity of the responses of a DNS server are compromised or corrupted, or when the DNS data is tampered with, clients can be misdirected to unauthorized locations without their knowledge. After the clients start communicating

  with these unauthorized locations, attempts can be made to gain access to information that is stored on the client computers. Spoofing and cache pollution are examples of this type of attack. Another type of attack, the denial-of-service

  attack, attempts to incapacitate a DNS server to make DNS infrastructure unavailable in an enterprise. To protect your DNS servers from these types of attacks:

  Use IPsec between DNS clients and servers.

  Monitor network activity.

  Close all unused firewall ports.

  Implementing IPsec Between DNS Clients and Servers

  IPsec encrypts all traffic over a network connection. Encryption minimizes the risk that data that is sent between the DNS clients and the DNS servers can be scanned for sensitive information or tampered with by anyone attempting to collect

  information by monitoring traffic on the network. When IPsec is enabled, both ends of a connection are validated before communication begins. A client can be certain that the DNS server with which it is communicating is a valid server. Also,

  all communication over the connection is encrypted, thereby eliminating the possibility of tampering with client communication. Encryption prevents spoofing attacks, which are false responses to DNS client queries by unauthorized sources

  that act like a DNS server.

  Further information:

  http://technet.microsoft.com/en-us/library/cc771898.aspx Understanding Zone Types

  The DNS Server service provides for three types of zones:

  Primary zone

  Secondary zone

  Stub zone

  Note: If the DNS server is also an Active Directory Domain Services (AD DS) domain controller, primary zones and stub zones can be stored in AD DS.

  The following sections describe each of these zone types:

  Primary zone When a zone that this DNS server hosts is a primary zone, the DNS server is the primary source for information about this zone, and it stores the master copy of zone data in a local file or in AD DS. When the zone is stored in a

  file, by default the primary zone file is named zone_name.dns and it is located in the % windir%\System32\Dns folder on the server. Secondary zone When a zone that this DNS server hosts is a secondary zone, this DNS server is a

  secondary source for information about this zone. The zone at this server must be obtained from another remote DNS server computer that also hosts the zone. This DNS server must have network access to the remote DNS server that

  supplies this server with updated information about the zone. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.

  Stub zone

  When a zone that this DNS server hosts is a stub zone, this DNS server is a source only for information about the authoritative name servers for this zone. The zone at this server must be obtained from another DNS server that hosts the

  zone. This DNS server must have network access to the remote DNS server to copy the authoritative name server information about the zone.

  You can use stub zones to:

  Keep delegated zone information current. By updating a stub zone for one of its child zones regularly, the DNS server that hosts both the parent zone and the stub zone will maintain a current list of authoritative DNS servers for the child zone.

  Improve name resolution. Stub zones enable a DNS server to perform recursion using the stub zone's list of name servers, without having to query the Internet or an internal root server for the DNS namespace.

  Simplify DNS administration. By using stub zones throughout your DNS infrastructure, you can distribute a list of the authoritative DNS servers for a zone without using secondary zones. However, stub zones do not serve the same purpose

  as secondary zones, and they are not an alternative for enhancing redundancy and load sharing.

  There are two lists of DNS servers involved in the loading and maintenance of a stub zone:

  The list of master servers from which the DNS server loads and updates a stub zone. A master server may be a primary or secondary DNS server for the zone. In both cases, it will have a complete list of the DNS servers for the zone.

  The list of the authoritative DNS servers for a zone. This list is contained in the stub zone using name server (NS) resource records.

  When a DNS server loads a stub zone, such as widgets.tailspintoys.com, it queries the master servers, which can be in different locations, for the necessary resource records of the authoritative servers for the zone widgets.tailspintoys.com.

  The list of master servers may contain a single server or multiple servers, and it can be changed anytime.

  http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/d352966e-b1ec-46b6-a8b4- 317c2c3388c3/Answered what is non-standard dns secondary zone?

  Q: While passing through 70-291 exam prep questions, I encountered the term "standard secondary zone".

  From the context of other questions I understood that "standard", in context of primary zone, mean "non-ADintegrated".

  A: Standard means it is not an AD integrated zone. AD integrated zones are stored in the AD database and not in a text file.

  Q: What does "standard" mean in context of DNS secondary zone?

  A: It means the same thing in context of a Standard Primary Zone. Simply stated, "Standard" means the zone data is stored in a text file, which can be found in system32\dns.