Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 221:

  Your network contains an Active Directory domain.

  You have a server named Server1 that runs Windows Server 2008 R2. Server1 is an enterprise root certification authority (CA). You have a client computer named Computer1 that runs Windows 7.

  You enable automatic certificate enrollment for all client computers that run Windows 7.

  You need to verify that the Windows 7 client computers can automatically enroll for certificates.

  Which command should you run on Computer1?

  A. certreq.exe retrieve
  B. certreq.exe submit
  C. certutil.exe getkey
  D. certutil.exe pulse
  D. certutil.exe pulse

  ---

  http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/795f209d-b056-4de8-8dcf- 7c7f80529aab/

  What does "certutil -pulse" command do?

  Certutil -pulse will initiate autoenrollment requests.

  It is equivalent to doing the following in the CertMgr.msc console (in Vista and Windows 7) Right-click Certificates , point to All Tasks , click Automatically Enroll and Retrieve Certificates.

  The command does require that

  -

  any autoenrollment GPO settings have already been applied to the target user or computer

  -

  a certificate template enables Read, Enroll and Autoenroll permissions for the user or a global or universal group containing the user

  -

  The group membership is recognized in the users Token (they have logged on after the membership was added http://technet.microsoft.com/library/cc732443.aspx

  Certutil Certutil.exe is a command-line program that is installed as part of Certificate Services. You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, backup and restore CA components, and verify certificates, key pairs, and certificate chains. When certutil is run on a certification authority without additional parameters, it displays the current certification authority configuration. When cerutil is run on a non-certification authority, the command defaults to running the certutil -dump verb. Verbs The following table describes the verbs that can be used with the certutil command. pulse Pulse auto enrollment events

• Question 222:

  A user in a branch office of your company attempts to join a computer to the domain, but the attempt fails.

  You need to enable the user to join a single computer to the domain.

  You must ensure that the user is denied any additional rights beyond those required to complete the task.

  What should you do?

  A. Prestage the computer account in the Active Directory domain.
  B. Add the user to the Domain Administrators group for one day.
  C. Add the user to the Server Operators group in the Active Directory domain.
  D. Grant the user the right to log on locally by using a Group Policy Object (GPO).
  A. Prestage the computer account in the Active Directory domain.

  ---

  http://technet.microsoft.com/en-us/library/cc770832%28v=ws.10%29.aspx#BKMK_1 Prestaging Client Computers Benefits of Prestaging Client Computers Prestaging clients provides three main benefits:

  An additional layer of security. You can configure Windows Deployment Services to answer only prestaged clients, therefore ensuring that clients that are not prestaged will not be able to boot from the network. Additional flexibility. Prestaging

  clients increases flexibility by enabling you to control the following. For instructions on performing these tasks, see the "Prestage Computers" section of How to Manage Client Computers.

  *

  The computer account name and location within AD DS.

  *

  Which server the client should network boot from.

  *

  Which network boot program the client should receive.

  *

  Other advanced options -- for example, what boot image a client will receive or what Windows Deployment Services client unattend file the client should use. The ability for multiple Windows Deployment Services servers to service the same network segment. You can do this by restricting the server to answer only a particular set of clients. Note that the prestaged client must be in the same forest as the Windows Deployment Services server (trusted forests do not work).

  Further information:

  http://www.windows-noob.com/forums/index.php?/topic/506-how-can-i-prestage-a-computer-for- wds/how can I PRESTAGE a computer for WDS?

• Question 223:

  Your network contains an Active Directory forest named contoso.com. You need to provide a user named User1 with the ability to create and manage subnet objects.

  The solution must minimize the number of permissions assigned to User1.

  What should you do?

  A. From Active Directory Users and Computers, run the Delegation of Control wizard.
  B. From Active Directory Administrative Centre, add User1 to the Schema Admins group.
  C. From Active Directory Sites and Services, run the Delegation of Control wizard.
  D. From Active Directory Administrative Centre, add User1 to the Network Configuration Operators group.
  C. From Active Directory Sites and Services, run the Delegation of Control wizard.

  ---

  Adding the user to the Schema Admins group, or to the Network Configuration Operators group would give User1 too much rights. Since we have to delegate an administrative task concerning subnets, we have to run the Delegation of Control wizard from Active Directory Sites and Services. Reference below is for Windows Server 2003 R2, but is still valid for 2008 R2.

  Reference: http://technet.microsoft.com/en-us/library/cc736770.aspx Delegate control of a site To delegate control of a site

  1.

  Open Active Directory Sites and Services.

  2.

  Right-click the container whose control you want to delegate, and then click Delegate Control to start the Delegation of Control Wizard.

  3.

  Follow the instructions in the Delegation of Control Wizard.

  Notes

  (...)

  In Active Directory Sites and Services, you can delegate control for the subnets, intersite transports, sites, and server containers.

• Question 224:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains a writable domain controller named DC1 and a read-only domain controller (RODC) named DC2. All domain controllers run Windows Server 2008 R2.

  You need to install a new writable domain controller named DC3 in a remote site. The solution must minimize the amount of replication traffic that occurs during the installation of Active Directory Domain Services (AD DS) on DC3.

  What should you do first?

  A. Run dcpromo.exe /createdcaccount on DC3.
  B. Run ntdsutil.exe on DC2.
  C. Run dcpromo.exe /adv on DC3.
  D. Run ntdsutil.exe on DC1.
  D. Run ntdsutil.exe on DC1.

  ---

  We can run dcpromo.exe /adv on DC3 to install a new writable domain controller using the Install From Media (IFM) option. That way there is less replication traffic. But before we can do that we have to create the installation media first. I

  suspect that's what they mean when they say "What should you do first?" So first we create the installation media, then we use the installation media to install DC3. Technet gives us instructions on how to create the installation media. It says:

  "You can use the Ntdsutil.exe tool to create installation media for additional domain controllers that you are creating in a domain. By using the Install from Media (IFM) option, you can minimize the replication of directory data over the network.

  This helps you install additional domain controllers in remote sites more efficiently."

  "You must use writeable domain controller installation media to install a writeable domain controller. You can create writeable domain controller installation media only on a writeable domain controller." Since DC2 in answer B is a read-only

  domain controller, that leaves us with answer D ("Run ntdsutil.exe on DC1").

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc770654.aspx

  [Used for the information above]

  [Some extra info on using IFM to install the DC:]

  Reference 2:

  http://http://technet.microsoft.com/en-us/library/cc732887.aspx dcpromo /adv

  Performs an install from media (IFM) operation.

  Reference 3:

  http://http://technet.microsoft.com/en-us/library/cc816722.aspx Installing an Additional Domain Controller by Using IFM

  When you install Active Directory Domain Services (AD DS) by using the install from media (IFM) method, you can reduce the replication traffic that is initiated during the installation of an additional domain controller in an Active Directory

  domain. Reducing the replication traffic reduces the time that is necessary to install the additional domain controller.

• Question 225:

  You have two servers named Server1 and Server2. Both servers run Windows Server 2008 R2. Server1 is configured as an enterprise root certification authority (CA).

  You install the Online Responder role service on Server2. You need to configure Server1 to support the Online Responder.

  What should you do?

  A. Import the enterprise root CA certificate.
  B. Configure the Certificate Revocation List Distribution Point extension.
  C. Configure the Authority Information Access (AIA) extension.
  D. Add the Server2 computer account to the CertPublishers group.
  C. Configure the Authority Information Access (AIA) extension.

  ---

  http://technet.microsoft.com/en-us/library/cc732526.aspx Configure a CA to Support OCSP Responders

  To function properly, an Online Responder must have a valid Online Certificate Status Protocol (OCSP)Response Signing certificate. This OCSP Response Signing certificate is also needed if you are using a non-Microsoft OCSP responder.

  Configuring a certification authority (CA) to support OCSP responder services includes the following steps:

  1.

  Configure certificate templates and issuance properties for OCSP Response Signing certificates.

  2.

  Configure enrollment permissions for any computers that will be hosting Online Responders.

  3.

  If this is a Windows Server 2003based CA, enable the OCSP extension in issued certificates.

  4.

  Add the location of the Online Responder or OCSP responder to the authority information access extension on the CA.

  5.

  Enable the OCSP Response Signing certificate template for the CA.

• Question 226:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to identify the Lightweight Directory Access Protocol (LDAP) clients that are using the largest amount of available CPU resources on a domain controller.

  What should you do?

  A. Review performance data in Resource Monitor.
  B. Review the Hardware Events log in the Event Viewer.
  C. Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory Diagnostics report.
  D. Run the LAN Diagnostics Data Collector Set. Review the LAN Diagnostics report.
  C. Run the Active Directory Diagnostics Data Collector Set. Review the Active Directory Diagnostics report.

  ---

  http://servergeeks.wordpress.com/2012/12/31/active-directory-diagnostics/ Active Directory Diagnostics

  Prior to Windows Server 2008, troubleshooting Active Directory performance issues often required the installation of SPA. SPA is helpful because the Active Directory data set collects performance data and it generates XML based diagnostic reports that make analyzing AD performance issues easier by identifying the IP addresses of the highest volume callers and the type of network traffic that is placing the most loads on the CPU.

  Download SPA tool: http://www.microsoft.com/en-us/download/details.aspx?id=15506 Now the same functionality has been built into Windows Server 2008 and Windows Server 2008 R2 and you don't have to install SPA anymore.

  This performance feature is located in the Server Manager snap-in under the Diagnostics node and when the Active Directory Domain Services Role is installed the Active Directory Diagnostics data collector set is automatically created under System as shown here.

  

  When you will check the properties of the collector you will notice that the data is stored under %systemdrive %\perflogs, only now it is under the \ADDS folder and when a data collection is run it creates a new subfolder called YYYYMMDD#### where YYYY = Year, MM = Month and DD=Day and #### starts with 0001 .

  Active Directory Diagnostics data collector set runs for a default of 5 minutes. This duration period cannot be modified for the built-in collector. However, the collection can be stopped manually by clicking the Stop button or from the command

  line.

  

  To start the data collector set, you just have to right click on Active Directory Diagnostics data collector set and select Start. Data will be stored at %systemdrive%\perflogs location.

  

  Once you've gathered your data, you will have these interesting and useful reports under Report section, to aid in your troubleshooting and server performance trending.

  

  Further information:

  http://technet.microsoft.com/en-us/library/dd736504%28v=ws.10%29.aspx Monitoring Your Branch Office Environment http://blogs.technet.com/b/askds/archive/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008- andbeyond.aspx

  Son of SPA: AD Data Collector Sets in Win2008 and beyond

• Question 227:

  Your network contains an Active Directory domain.

  You need to activate the Active Directory Recycle Bin in the domain.

  Which tool should you use?

  A. Dsamain
  B. Set-ADDomain
  C. Add-WindowsFeature
  D. Ldp
  D. Ldp

  ---

  Reference: http://technet.microsoft.com/en-us/library/dd379481.aspx

  Enabling Active Directory Recycle Bin After the forest functional level of your environment is set to Windows Server 2008 R2, you can enable Active Directory Recycle Bin by using the following methods: Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.) Ldp.exe

• Question 228:

  Your network contains a domain controller that runs Windows Server 2008 R2. You need to reset the Directory Services Restore Mode (DSRM) password on the domain controller. Which tool should you use?

  A. Ntdsutil
  B. Dsamain
  C. Active Directory Users and Computers
  D. Local Users and Groups
  A. Ntdsutil

  ---

  Reference:

  http://blogs.technet.com/b/meamcs/archive/2012/05/29/reset-the-dsrm-administrator-password.aspx To Reset the DSRM Administrator Password

  1.

  Click, Start, click Run, type ntdsutil, and then click OK.

  2.

  At the Ntdsutil command prompt, type set dsrm password.

• Question 229:

  You have a DNS zone that is stored in a custom application directory partition. You install a new domain controller.

  You need to ensure that the custom application directory partition replicates to the new domain controller.

  What should you use?

  A. the Active Directory Administrative Center console
  B. the Active Directory Sites and Services console
  C. the DNS Manager console
  D. the Dnscmd tool
  D. the Dnscmd tool

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc772069.aspx dnscmd /enlistdirectorypartition Adds the DNS server to the specified directory partition's replica set.

• Question 230:

  You need to receive an e-mail message whenever a domain user account is locked out.

  Which tool should you use?

  A. Active Directory Administrative Center
  B. Event Viewer
  C. Resource Monitor
  D. Security Configuration Wizard
  B. Event Viewer

  ---

  MS Press - Self-Paced Training Kit (Exam 70-642) (2nd Edition, 2011) page 525 Automatically Responding to Events

  One of the most useful ways to use Task Scheduler is to launch a task in response to a specific event type that appears in Event Viewer. You can respond to events in three ways: Start A Program - Launches an application. Often,

  administrators write a script that carries out a series of tasks that they would otherwise need to manually perform, and automatically run that script when an event appears. Send An E-mail - Sends an email by using the Simple Mail Transport

  Protocol (SMTP) server you specify.

  Often, administrators configure urgent events to be sent to a mobile device. Display A Message - Displays a dialog box showing a message. This is typically useful only when a user needs to be notified of something happening on the

  computer. To trigger a task when an event occurs, follow one of these three procedures:

  Find an example of the event in Event Viewer. Then, right-click the event and click Attach Task To This Event. A wizard will guide you through the process.