Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 211:

  Your network contains an Active Directory forest named contoso.com. The forest contains two domains. All domain controllers are configured as global catalog servers.

  The forest root domain contains five domain controllers. The domain controllers are configured as shown in the following table.

  

  You plan to create a custom attribute in Active Directory that will replicate to all of the global catalog servers.

  You need to identify which domain controller must be online to perform the planned action.

  Which domain controller should you identify?

  A. DC1
  B. DC2
  C. DC3
  D. DC4
  E. DC5
  B. DC2

• Question 212:

  Your company has two offices. The offices are located in Miami and London. The network contains an Active Directory forest named contoso.com. The forest contains two child domains named miami.contoso.com and london.contoso.com. The domain contains 50 domain controllers that run Windows Server 2008 R2.

  Each office is configured as an Active Directory site.

  You plan to deploy several read-only domain controllers (RODCs) to the Miami site.

  You need to pre-create the computer accounts of the RODCs.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  H. Use the Active Directory Users and Computers console.

• Question 213:

  Your network contains an Active Directory forest. The forest schema contains a custom attribute for user objects.

  You need to modify the custom attribute value of 500 user accounts.

  Which tool should you use?

  A. Csvde
  B. Dsmod
  C. Dsrm
  D. Ldifde
  D. Ldifde

  ---

  We cannot use Dsmod here, because it supports only a subset of commonly used object class attributes.

  Csvde can only import and export data.

  Dsrm is used to delete objects from the directory.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731033.aspx

  Ldifde

  Creates, modifies, and deletes directory objects.

• Question 214:

  You have an Active Directory domain named contoso.com.

  You need to view the account lockout threshold and duration for the domain.

  Which tool should you use?

  A. Net User
  B. Active Directory Users and Computers
  C. Group Policy Management Console (GPMC)
  D. Computer Management
  C. Group Policy Management Console (GPMC)

• Question 215:

  Your network contains two Active Directory forests named contoso.com and nwtraders.com. The functional level of both forests is Windows Server 2003.

  Contoso.com contains one domain.

  Nwtraders.com contains two domains.

  You need to ensure that users in contoso.com can access the resources in all domains. The solution must require the minimum number of trusts.

  Which type of trust should you create?

  A. external
  B. forest
  C. realm
  D. shortcut
  B. forest

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771397.aspx

  When to create a forest trust

  You can create a forest trust between forest root domains if the forest functional level is Windows Server 2003 or higher. Creating a forest trust between two root domains with a forest functional level of Windows Server 2003 or higher

  provides a one-way or two-way, transitive trust relationship between every domain in each forest. Forest trusts are useful for application service providers, organizations undergoing mergers or acquisitions, collaborative business extranets,

  and organizations seeking a solution for administrative autonomy.

• Question 216:

  You have a domain controller that runs Windows Server 2008 R2. The Windows Server Backup feature is installed on the domain controller.

  You need to perform a non-authoritative restore of the domain controller by using an existing backup file.

  What should you do?

  A. Restart the domain controller in Directory Services Restore Mode. Use the WBADMIN command to perform a critical volume restore.
  B. Restart the domain controller in Directory Services Restore Mode. Use the Windows Server Backup snap-in to perform a critical volume restore.
  C. Restart the domain controller in safe mode. Use the Windows Server Backup snap-in to perform a critical volume restore.
  D. Restart the domain controller in safe mode. Use the WBADMIN command to perform a critical volume restore.
  A. Restart the domain controller in Directory Services Restore Mode. Use the WBADMIN command to perform a critical volume restore.

  ---

  Almost identical to B26

  http://technet.microsoft.com/en-us/library/cc816627%28v=ws.10%29.aspx Performing Nonauthoritative Restore of Active Directory Domain Services A nonauthoritative restore is the method for restoring Active Directory Domain Services (AD

  DS) from a system state, critical-volumes, or full server backup. A nonauthoritative restore returns the domain controller to its state at the time of backup and then allows normal replication to overwrite that state with any changes that occurred

  after the backup was taken. After you restore AD DS from backup, the domain controller queries its replication partners. Replication partners use the standard replication protocols to update AD DS and associated information, including the

  SYSVOL shared folder, on the restored domain controller.

  You can use a nonauthoritative restore to restore the directory service on a domain controller without reintroducing or changing objects that have been modified since the backup. The most common use of a nonauthoritative restore is to

  reinstate a domain controller, often after catastrophic or debilitating hardware failures.

  In the case of data corruption, do not use nonauthoritative restore unless you have confirmed that the problem is with AD DS.

  Nonauthoritative Restore Requirements

  You can perform a nonauthoritative restore from backup on a Windows Server 2008 system that is a standalone server, member server, or domain controller. On domain controllers that are running Windows Server 2008, you can stop and

  restart AD DS as a service.

  Therefore, in Windows Server 2008, performing offline defragmentation and other database management tasks does not require restarting the domain controller in Directory Services Restore Mode (DSRM). However, you cannot perform a

  nonauthoritative restore after simply stopping the AD DS service in regular startup mode. You must be able to start the domain controller in Directory Services Restore Mode (DSRM). If the domain controller cannot be started in DSRM, you

  must first reinstall the operating system.

  To perform a nonauthoritative restore, you need one of the following types of backup for your backup source:

  System state backup: Use this type of backup to restore AD DS. If you have reinstalled the operating system, you must use a critical-volumes or full server backup. If you are restoring a system state backup, use the wbadmin start

  systemstaterecovery command. Critical-volumes backup: A critical-volumes backup includes all data on all volumes that contain operating system and registry files, boot files, SYSVOL files, or Active Directory files. Use this type of backup if

  you want to restore more than the system state. To restore a critical-volumes backup, use the wbadmin start recovery command.

  Full server backup: Use this type of backup only if you cannot start the server or you do not have a system state or critical-volumes backup. A full server backup is generally larger than a critical-volumes backup. Restoring a full server backup

  not only rolls back data in AD DS to the time of backup, but it also rolls back all data in all other volumes. Rolling back this additional data is not necessary to achieve nonauthoritative restore of AD DS.

• Question 217:

  Your company has an Active Directory domain. A user attempts to log on to the domain from a client computer and receives the following message: "This user account has expired. Ask your administrator to reactivate the account."

  You need to ensure that the user is able to log on to the domain.

  What should you do?

  A. Modify the properties of the user account to set the account to never expire.
  B. Modify the properties of the user account to extend the Logon Hours setting.
  C. Modify the default domain policy to decrease the account lockout duration.
  D. Modify the properties of the user account to set the password to never expire.
  A. Modify the properties of the user account to set the account to never expire.

  ---

  

  Further information:

  http://technet.microsoft.com/en-us/library/dd145547.aspx User Properties - Account Tab

  Account expires

  Sets the account expiration policy for this user. You can select between the following options:

  Use Never to specify that the selected account will never expire. This option is the default for new users.

  Select End of and then select a date if you want to have the user's account expire on a specified date.

• Question 218:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain.

  The HR department has a dedicated organization unit (OU) named HR. The HR OU has two sub-OUs:

  HR Users and HR Computers. User accounts for the HR department reside in the HR Users OU. Computer accounts for the HR department reside in the HR Computers OU. All HR department employees belong to a security group named

  HR Employees. All HR department computers belong to a security group named HR PCs.

  Company policy requires that passwords are a minimum of six characters.

  You need to ensure that, the next time HR department employees change their passwords, the passwords are required to have at least eight characters. The password length requirement should not change for employees of any other

  department.

  What should you do?

  A. Create a fine-grained password policy and apply it to the HR Computers OU.
  B. Modify the password policy in the GPO that is applied to the domain controllers OU.
  C. Create a fine-grained password policy and apply it to the HR Employees group.
  D. Modify the password policy in the GPO that is applied to the domain.
  C. Create a fine-grained password policy and apply it to the HR Employees group.

• Question 219:

  Your network contains an Active Directory forest named contoso.com. The forest contains two domains named contoso.com and child.contoso.com. All domain controllers run Windows Server 2008. All forest-wide operations master roles are

  in child.contoso.com.

  An administrator successfully runs adprep.exe /forestprep from the Windows Server 2008 R2 Service Pack 1 (SP1) installation media.

  You plan to run adprep.exe /domainprep in each domain.

  You need to ensure that you have the required user rights to run the command successfully in each domain.

  Of which groups should you be a member? (Each correct answer presents part of the solution. Choose two.)

  A. Administrators in child.contoso.com
  B. Enterprise Admins in contoso.com
  C. Domain Admins in child.contoso.com
  D. Domain Admins in contoso.com
  E. Administrators in contoso.com
  F. Schema Admins in contoso.com
  C. Domain Admins in child.contoso.com
  D. Domain Admins in contoso.com

  ---

  Reference:

  http://technet.microsoft.com/de-de/library/cc731728.aspx

  Adprep /domainprep

  Prepares a domain for the introduction of a domain controller that runs Windows Server 2008. You run this command after the forestprep command finishes and after the changes replicate to all the domain controllers in the forest.

  Run this command in each domain where you plan to add a domain controller that runs Windows Server 2008.

  You must run this command on the domain controller that holds the infrastructure operations master role for the domain. You must be a member of the Domain Admins group to run this command.

• Question 220:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2.

  You have four Active Directory sites. Each site has multiple Active Directory subnets. You need to identify all of the authentication requests that originate from client computers that are not associated to an Active Directory subnet.

  What should you use?

  A. The %Systemroot%\System32\Network_llu.log log file
  B. The %Systemroot%\Debug\Netsetup.log log file
  C. The Authentication User Interface operational log
  D. The %Systemroot%\Debug\Netlogon.log log file
  B. The %Systemroot%\Debug\Netsetup.log log file

  ---

  Identifying Whether You Have a Problem Authenticating

  You can identify whether you have a problem authenticating (or joining) a computer to a domain by verifying that the local workstation is working. Do this by running the Netdiag tool. Read the output from the top, and look for the words

  "ERROR" or "FATAL." (Many failures are not relevant to the domain itself; but you should follow up on them because they involve network connectivity issues.) If you don't find these words in the output, continue as follows:

  Run netdiag /v (verbose mode). Do you receive any specific error messages or FATAL errors? If the answer to the preceding question is "No," run netdiag /debug.

  Do you receive any specific error messages or FATAL errors?

  If Netdiag displays an error or failure with the domain itself, check the % SystemRoot %\debug\netsetup.log file for join errors.