Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 231:

  Your network contains an Active Directory domain named contoso.com.

  The domain contains an organizational unit (OU) named SalesUsers.

  The OU contains 50 user accounts. You need to identify the effective Password Settings object (PSO) of each user in the SalesUsers OU.

  Which command should you run? (To answer, select the appropriate options in the answer area.)

  Hot Area:

  

  

• Question 232:

  You need to purge the list of user accounts that were authenticated on a read-only domain controller (RODC). What should you do?

  A. Run the repadmin.exe command and specify the /prp parameter.
  B. From Active Directory Sites and Services, modify the properties of the RODC computer object.
  C. From Active Directory Users and Computers, modify the properties of the RODC computer object.
  D. Run the dsrm.exe command and specify the -u parameter.
  A. Run the repadmin.exe command and specify the /prp parameter.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication- policy.aspx

  Clearing the authenticated accounts list

  In addition to reviewing the list of authenticated users, you may decide to periodically clean up the list of accounts that are authenticated to the RODC. Cleaning up this list may help you more easily determine the new accounts that have

  authenticated through the RODC.

  Membership in the Domain Admins group of the domain in which the RODC is a member, or equivalent, is the minimum required to complete this procedure. To clear all entries from the list, run the command repadmin /prp delete

  auth2 /all. Substitute the actual host name of the RODC that you want to clear.

  For example, if you want to clear the list of authenticated accounts for RODC2, type repadmin /prp delete rodc2 auth2 /all, and then press ENTER.

• Question 233:

  Your company has a main office and a branch office.

  You discover that when you disable IPv4 on a computer in the branch office, the computer authenticates by using a domain controller in the main office.

  You need to ensure that IPv6-only computers authenticate to domain controllers in the same site.

  What should you do?

  A. Configure the NTDS Site Settings object.
  B. Create Active Directory subnet objects.
  C. Create Active Directory Domain Services connection objects.
  D. Install an Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) router.
  B. Create Active Directory subnet objects.

• Question 234:

  You need to back up all of the group policies in a domain. The solution must minimize the size of the backup.

  What should you use?

  A. the Add-WBSystemState cmdlet
  B. the Group Policy Management console
  C. the Wbadmin tool
  D. the Windows Server Backup feature
  B. the Group Policy Management console

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc770536.aspx To back up a Group Policy object

  1.

  In the Group Policy Management Console (GPMC) console tree, open Group Policy Objects in the forest and domain containing the Group Policy object (GPO) to back up.

  2.

  To back up a single GPO, right-click the GPO, and then click Back Up. To back up all GPOs in the domain, right-click Group Policy objects and click Back Up All.

• Question 235:

  Your company has an Active Directory forest that contains only Windows Server 2008 domain controllers. You need to prepare the Active Directory domain to install Windows Server 2008 R2 domain controllers.

  Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Run the adprep /domainprep command.
  B. Raise the forest functional level to Windows Server 2008.
  C. Raise the domain functional level to Windows Server 2008.
  D. Run the adprep /forestprep command.
  A. Run the adprep /domainprep command.
  D. Run the adprep /forestprep command.

  ---

  http://www.petri.co.il/prepare-for-server-2008-r2-domain-controller.htm Prepare your Domain for the Windows Server 2008 R2 Domain Controller Before installing the first Windows Server 2008 R2 domain controller (DC) into an existing Windows 2000, Windows Server 2003 or Windows Server 2008 domain, you must prepare the AD forest and domain. You do so by running a tool called ADPREP.

  ADPREP extends the Active Directory schema and updates permissions as necessary to prepare a forest and domain for a domain controller that runs the Windows Server 2008 R2 operating system. Note: You may remember that ADPREP was used on previous operating systems such as Windows Server 2003, Windows Server 2003 R2 and Windows Server 2008. This article focuses on Windows Server 2008 R2.

  What does ADPREP do? ADPREP has parameters that perform a variety of operations that help prepare an existing Active Directory environment for a domain controller that runs Windows Server 2008 R2. Not all versions of ADPREP perform the same operations, but generally the different types of operations that ADPREP can perform include the following: Updating the Active Directory schema Updating security descriptors Modifying access control lists (ACLs) on Active Directory objects and on files in the SYSVOL shared folder Creating new objects, as needed Creating new containers, as needed

  To prepare the forest and domain for the installation of the first Windows Server 2008 R2 domain controller please perform these tasks: Lamer note: The following tasks are required ONLY before adding the first Windows Server 2008 R2 domain controller. If you plan on simply joining a Windows Server 2008 R2 Server to the domain and configuring as a regular member server, none of the following tasks are required. Another lamer note: Please make sure you read the system requirements for Windows Server 2008 R2. For example, you cannot join a Windows Server 2008 R2 server to a Windows NT 4.0 domain, not can it participate as a domain controller in a mixed domain. If any domain controllers in the forest are running Windows 2000 Server, they must be running Service Pack 4 (SP4). First, you should review and understand the schema updates and other changes that ADPREP makes as part of the schema management process in Active Directory Domain Services (AD DS). You should test the ADPREP schema updates in a lab environment to ensure that they will not conflict with any applications that run in your environment.

  You must make a system state backup for your domain controllers, including the schema master and at least one other domain controller from each domain in the forest (you do have backups, don't you?). Also, make sure that you can log on to the schema master with an account that has sufficient credentials to run adprep /forestprep. You must be a member of the Schema Admins group, the Enterprise Admins group, and the Domain Admins group of the domain that hosts the schema master, which is, by default, the forest root domain.

  Next, insert the Windows Server 2008 R2 DVD media into your DVD drive. Note that if you do not have the media handy, you may use the evaluation version that is available to download from Microsoft's website.

  If you only have the ISO file and do not want to or cannot actually burn it to a physical DVD media, you can mount it by using a virtual ISO mounting tool such as MagicIso (can Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor). Browse to the X:\support\adprep folder, where X: is the drive letter of your DVD drive. Find a file called adprep.exe or adprep32.exe.

  Note: Unlike in Windows Server 2008 where you had to use either the 32-bit or 64-bit installation media to get the right version of ADPREP, Windows Server 2008 R2 ADPREP is available in a 32-bit version and a 64-bit version. The 64-bit version runs by default. If you need to run ADPREP on a 32-bit computer, run the 32-bit version (adprep32.exe).

  

  To perform this procedure, you must use an account that has membership in all of the following groups:

  Enterprise Admins

  Schema Admins

  Domain Admins for the domain that contains the schema master Open a Command Prompt window by typing CMD and pressing ENTER in the Run menu. Drag the adprep.exe file from the Windows Explorer window to the Command Prompt

  window. Naturally, if you want, you can always manually type the path of the file in the Command Prompt window if that makes you feel better...

  Note: You must run adprep.exe from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator. Note: If your existing DCs are Windows Server 2008,

  dragging and dropping into a Command Prompt window will not work, as that feature was intentionally disabled in windows Server 2008 and Windows Vista.

  In the Command Prompt window, type the following command: adprep /forestprep

  

  You will be prompted to type the letter "c" and then press ENTER. After doing so, process will begin.

  

  ADPREP will take several minutes to complete. During that time, several LDF files will be imported into the AD Schema, and messages will be displayed in the Command Prompt window. File sch47.ldf seems to be the largest one.

  

  When completed, you will receive a success message.

  

  Note: As mentioned above, ADPREP should only be run on an existing DC. When trying to run it from a non-DC, you will get this error:

  Adprep cannot run on this platform because it is not an Active Directory Domain Controller.

  [Status/Consequence]

  Adprep stopped without making any changes.

  [User Action]

  Run Adprep on a Active Directory Domain Controller.

  Allow the operation to complete, and then allow the changes to replicate throughout the forest before you prepare any domains for a domain controller that runs Windows Server 2008 R2. In the Command Prompt window, type the following

  command: adprep /domainprep Process will take less than a second.

  

  ADPREP must only be run in a Windows 2000 Native Mode or higher. If you attempt to run in Mixed Mode you will get this error:

  Adprep detected that the domain is not in native mode

  [Status/Consequence]

  Adprep has stopped without making changes.

  [User Action]

  Configure the domain to run in native mode and re-run domainprep Allow the operation to complete, and then allow the changes to replicate throughout the forest before you prepare any domains for a domain controller that runs Windows

  Server 2008 R2. If you're running a Windows 2008 Active Directory domain, that's it, no additional tasks are needed. If you're running a Windows 2000 Active Directory domain, you must also the following command:

  adprep /domainprep /gpprep

  Allow the operation to complete, and then allow the changes to replicate throughout the forest before you prepare any domains for a domain controller that runs Windows Server 2008 R2. If you're running a Windows 2003 Active Directory

  domain, that's it, no additional tasks are needed. However, if you're planing to run Read Only Domain controllers (RODCs), you must also type the following command: adprep /rodcprep

  If you already ran this command for Windows Server 2008, you do not need to run it again for Windows Server 2008 R2.

  Process will complete in less than a second.

  

  Allow the operation to complete, and then allow the changes to replicate throughout the forest before you prepare any domains for a domain controller that runs Windows Server 2008 R2. To verify that adprep /forestprep completed successfully please perform these steps:

  1.

  Log on to an administrative workstation that has ADSIEdit installed. ADSIEdit is installed by default on domain controllers that run Windows Server 2008 or Windows Server 2008 R2. On Windows Server 2003 you must install the Resource Kit Tools.

  2.

  Click Start, click Run, type ADSIEdit.msc, and then click OK.

  3.

  Click Action, and then click Connect to.

  4.

  Click Select a well known Naming Context, select Configuration in the list of available naming contexts, and then click OK.

  5.

  Double-click Configuration, and then double-click CN=Configuration, DC=forest_root_domain where forest_root_domain is the distinguished name of your forest root domain.

  6.

  Double-click CN=ForestUpdates.

  7.

  Right-click CN=ActiveDirectoryUpdate, and then click Properties.

  

  8. If you ran adprep /forestprep for Windows Server 2008 R2, confirm that the Revision attribute value is 5, and then click OK.

  

  9.

  Click ADSI Edit, click Action, and then click Connect to.

  10.

  Click Select a Well known naming context, select Schema in the list of available naming contexts, and then click OK.

  11.

  Double-click Schema.

  12.

  Right-click CN=Schema,CN=Configuration,DC=forest_root_domain, and then click Properties.

  13.

  If you ran adprep /forestprep for Windows Server 2008 R2, confirm that the objectVersion attribute value is set to 47, and then click OK.

  

  

• Question 236:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2. The forest contains a single domain. You need to ensure that objects can be restored from the Active Directory Recycle Bin.

  Which tool should you use?

  A. Ntdsutil
  B. Set-ADDomain
  C. Dsamain
  D. Enable-ADOptionalFeature
  D. Enable-ADOptionalFeature

  ---

  Similar question to question E/Q28 Reference: http://technet.microsoft.com/en-us/library/dd379481.aspx

  Enabling Active Directory Recycle Bin After the forest functional level of your environment is set to Windows Server 2008 R2, you can enable Active Directory Recycle Bin by using the following methods: Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.) Ldp.exe

• Question 237:

  The default domain GPO in your company is configured by using the following account policy settings:

  

  Minimum password length: 8 characters

  

  Maximum password age: 30 days

  

  Enforce password history: 12 passwords remembered

  

  Account lockout threshold: 3 invalid logon attempts

  

  Account lockout duration: 30 minutes

  You install Microsoft SQL Server on a computer named Server1 that runs Windows Server 2008 R2. The SQL Server application uses a service account named SQLSrv. The SQLSrv account has domain user rights.

  The SQL Server computer fails after running successfully for several weeks. The SQLSrv user account is not locked out.

  You need to resolve the server failure and prevent recurrence of the failure. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Reset the password of the SQLSrv user account.
  B. Configure the local security policy on Server1 to grant the Logon as a service right on the SQLSrv user account.
  C. Configure the properties of the SQLSrv account to Password never expires.
  D. Configure the properties of the SQLSrv account to User cannot change password.
  E. Configure the local security policy on Server1 to explicitly grant the SQLSrv user account the Allow logon locally user right.
  A. Reset the password of the SQLSrv user account.
  C. Configure the properties of the SQLSrv account to Password never expires.

  ---

  Personal comment:

  Maximum password age: 30 days

  The most probable cause for the malfunction is that the password has expired. You need to reset the password and set it to never expire.

  

• Question 238:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain. All regular user accounts reside in an organisational unit (OU) named Employees. All administrator accounts reside in an OU named Admins.

  You need to ensure that any time an administrator modifies an employee's name in AD DS, the change is audited.

  What should you do first?

  A. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Employees OU.
  B. Modify the searchFlags property for the Name attribute in the Schema.
  C. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Admins OU.
  D. Use the Auditpol.exe command-line tool to enable the directory service changes auditing subcategory.
  D. Use the Auditpol.exe command-line tool to enable the directory service changes auditing subcategory.

  ---

  Before we can use the Directory Service Changes audit policy subcategory, we have to enable it first.

  We can do that by using auditpol.exe.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731607.aspx

  Auditing changes to objects in AD DS

  In Windows 2000 Server and Windows Server 2003, there was one audit policy, Audit directory service access, that controlled whether auditing for directory service events was enabled or disabled. In Windows Server 2008, this policy is

  divided into four subcategories:

  

  Directory Service Access

  

  Directory Service Changes

  

  Directory Service Replication

  

  Detailed Directory Service Replication

  The ability to audit changes to objects in AD DS is enabled with the new audit policy subcategory Directory Service Changes. This guide provides instructions for implementing this audit policy subcategory.

  The types of changes that you can audit include a user (or any security principal) creating, modifying, moving, or undeleting an object. The new audit policy subcategory adds the following capabilities to auditing in AD DS:

  When a successful modify operation is performed on an attribute, AD DS logs the previous and current values of the attribute. If the attribute has more than one value, only the values that change as a result of the modify operation are logged.

  (...)

  Steps to set up auditing

  This section includes procedures for each of the primary steps for enabling change auditing:

  Step 1: Enable audit policy.

  Step 2: Set up auditing in object SACLs by using Active Directory Users and Computers.

  Step 1: Enable audit policy.

  This step includes procedures to enable change auditing with either the Windows interface or a command line:

  (...)

  By using the Auditpol command-line tool, you can enable individual subcategories.

  To enable the change auditing policy using a command line

  1.

  Click Start, right-click Command Prompt, and then click Run as administrator.

  2.

  Type the following command, and then press ENTER:

  auditpol /set /subcategory:"directory service changes" /success:enable

• Question 239:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2. The DNS zone for contoso.com is Active Directory-integrated.

  You deploy a read-only domain controller (RODC) named RODC1.

  You install the DNS Server server role on RODC1.

  You discover that RODC1 does not have any application directory partitions. You need to ensure that RODC1 has a directory partition of contoso.com.

  What should you do?

  A. From DNS Manager, create secondary zones.
  B. Run Dnscmd.exe, and specify the /enlistdirectorypartition parameter.
  C. From DNS Manager, right-click RODC1 and click Update Server Data Files.
  D. Run Dnscmd.exe and specify the /createbuiltindirectorypartitions parameter.
  B. Run Dnscmd.exe, and specify the /enlistdirectorypartition parameter.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc742490.aspx

  RODC Post-Installation Configuration If you install DNS server after the AD DS installation, you must also enlist the RODC in the DNS application directory partitions. The RODC is not enlisted automatically in the DNS application directory partitions by design because it is a privileged operation. If the RODC were allowed to enlist itself, it would have permissions to add or remove other DNS servers that are enlisted in the application directory partitions.

  To enlist a DNS server in a DNS application directory partition

  1.

  Open an elevated command prompt.

  2.

  At the command prompt, type the following command, and then press ENTER:

  dnscmd /EnlistDirectoryPartition

  For example, to enlist RODC01 in the domain-wide DNS application directory partition in a domain named child.contoso.com, type the following command:

  dnscmd RODC01 /EnlistDirectoryPartition DomainDNSZones.child.contoso.com

• Question 240:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain and 10 domain controllers. All of the domain controllers run Windows Server 2008 R2 Service Pack 1 (SP1).

  The forest contains an application directory partition named dc=app1,dc=contoso,dc=com. A domain controller named DC1 has a copy of the application directory partition. You need to configure a domain controller named DC2 to receive a

  copy of dc=app1,dc=contoso,dc=com.

  Which tool should you use?

  A. Dsamain
  B. Ntdsutil
  C. Active Directory Sites and Services
  D. Dcpromo
  C. Active Directory Sites and Services

  ---

  Active DirectorySites and Services is a Microsoft Management Console (MMC) snap-in that you can use to administer the replication of directory data among all sites in an Active Directory Domain Services (AD DS) forest. You can use the Active Directory Sites and Services snap-in to manage the site-specific objects that implement the intersite replication topology.