Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 241:

  Your network contains an Active Directory forest named fabrikam.com. The forest contains the following domains:

  

  Fabrikam.com

  

  Eu.fabrikam.com

  

  Na.fabrikam.com

  

  Eu.contoso.com

  

  Na.contoso.com

  You need to configure the forest to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix of contoso.com when they create user accounts from Active Directory Users and Computers.

  Which tool should you use?

  A. Active Directory Sites and Services
  B. Set-ADDomain
  C. Set-ADForest
  D. Active Directory Administrative Center
  C. Set-ADForest

  ---

  We would use the following command to achieve this:

  Set-ADForest -UPNSuffixes @{Add="contoso.com"}

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd391925.aspx

  Creating a UPN Suffix for a Forest

  This topic explains how to use the Active Directory module for Windows PowerShell to create a new user principal name (UPN) suffix for the users in a forest.

  Creating an additional UPN suffix helps simplify the names that are used to log on to another domain in the forest.

  Example

  The following example demonstrates how to create a new UPN suffix for the users in the Fabrikam.com forest:

  Set-ADForest -UPNSuffixes @{Add="headquarters.fabrikam.com"} Reference 2

  http://technet.microsoft.com/en-us/library/ee617221.aspx

  Set-ADForest Modifies an Active Directory forest.

  Parameter

  UPNSuffixes

  Modifies the list of user principal name (UPN) suffixes of the forest. This parameter sets the multi- valued msDS-UPNSuffixes property of the cross-reference container. This parameter uses the following syntax to add remove, replace, or

  clear UPN suffix values.

  Syntax:

  To add values:

  -UPNSuffixes @{Add=value1,value2,...}

• Question 242:

  Your company network has an Active Directory forest that has one parent domain and one child domain. The child domain has two domain controllers that run Windows Server 2008. All user accounts from the child domain are migrated to the parent domain. The child domain is scheduled to be decommissioned.

  You need to remove the child domain from the Active Directory forest. What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.)

  A. Run the Computer Management console to stop the Domain Controller service on both domain controllers in the child domain.
  B. Delete the computer accounts for each domain controller in the child domain. Remove the trust relationship between the parent domain and the child domain.
  C. Use Server Manager on both domain controllers in the child domain to uninstall the Active Directory domain services role.
  D. Run the Dcpromo tool that has individual answer files on each domain controller in the child domain.
  C. Use Server Manager on both domain controllers in the child domain to uninstall the Active Directory domain services role.
  D. Run the Dcpromo tool that has individual answer files on each domain controller in the child domain.

  ---

  http://technet.microsoft.com/en-us/library/cc755937%28v=ws.10%29.aspx Decommissioning a Domain Controller

  To complete this task, perform the following procedures:

  1.

  View the current operations master role holders

  2.

  Transfer the schema master

  3.

  Transfer the domain naming master

  4.

  Transfer the domain-level operations master roles

  5.

  Determine whether a domain controller is a global catalog server

  6.

  Verify DNS registration and functionality

  7.

  Verify communication with other domain controllers

  8.

  Verify the availability of the operations masters

  9.

  If the domain controller hosts encrypted documents, perform the following procedure before you remove Active Directory to ensure that the encrypted files can be recovered after Active Directory is removed: Export a certificate with the private key 10.Uninstall Active Directory 11.If the domain controller hosts encrypted documents and you backed up the certificate and private key before you remove Active Directory, perform the following procedure to re-import the certificate to the server: Import a certificate

  12.

  Determine whether a Server object has child objects

  13.

  Delete a Server object from a site http://technet.microsoft.com/en-us/library/cc737258%28v=ws.10%29.aspx Uninstall Active Directory To uninstall Active Directory

  1. Click Start, click Run, type dcpromo and then click OK.

• Question 243:

  Your network contains an Active Directory forest.

  All users have a value set for the Department attribute.

  From Active Directory Users and computers, you search a domain for all users who have a Department attribute value of Marketing.

  The search returns 50 users.

  From Active Directory Users and Computers, you search the entire directory for all users who have a Department attribute value of Marketing.

  The search does not return any users.

  You need to ensure that a search of the entire directory for users in the marketing department returns all of the users who have the Marketing Department attribute.

  What should you do?

  A. Install the Windows Search Service role service on a global catalog server.
  B. From the Active Directory Schema snap-in, modify the properties of the Department attribute.
  C. Install the Indexing Service role service on a global catalog server.
  D. From the Active Directory Schema snap-in, modify the properties of the user class.
  B. From the Active Directory Schema snap-in, modify the properties of the Department attribute.

  ---

  http://technet.microsoft.com/en-us/library/how-global-catalog-servers-work.aspx

  Global Catalog Partial Attribute Set The attributes that are replicated to the global catalog by default include a base set that have been defined by Microsoft as the attributes that are most likely to be used in searches. Administrators can use the Microsoft Management Console (MMC) Active Directory Schema snap-in to specify additional attributes to meet the needs of their installation. In the Active Directory Schema snap-in, you can select the Replicate this attribute to the global catalog check box to designate an attributeSchema object as a member of the PAS, which sets the value of the isMemberOfPartialAttributeSet attribute to TRUE.

• Question 244:

  Your network contains an Active Directory domain named contoso.com.

  Members of the sales department are issued laptops that have wireless network cards.

  You need to ensure that when users connect to an unidentified network from their laptop, the network is configured as a Public network.

  Which node in Group Policy Management Editor should you use?To answer, select the appropriate node in the answer area.

  Hot Area:

  

  

• Question 245:

  You are formulating the backup strategy for Active Directory Lightweight Directory Services (AD LDS) to ensure that data and log files are backed up regularly.

  This will also ensure the continued availability of data to applications and users in the event of a system failure. Because you have limited media resources, you decided to backup only specific ADLDS instance instead of taking backup of the entire volume.

  What should you do to accomplish this task?

  A. Use Windows Server backup utility and enable checkbox to take only backup of database and log files of AD LDS
  B. Use Dsdbutil.exe tool to create installation media that corresponds only to the ADLDS instance
  C. Move AD LDS database and log files on a separate volume and use windows server backup utility
  D. None of the above
  B. Use Dsdbutil.exe tool to create installation media that corresponds only to the ADLDS instance

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc730941.aspx Backing up AD LDS instance data with Dsdbutil.exe

  With the Dsdbutil.exe tool, you can create installation media that corresponds only to the AD LDS instance that you want to back up, as opposed to backing up entire volumes that contain the AD LDS instance.

• Question 246:

  A network contains an Active Directory Domain Services (AD DS) domain. Active Directory is configured as shown in the following table.

  

  The functional level of the domain is Windows Server 2008 R2. The functional level of the forest is Windows Server 2003.

  Active Directory replication between the Seattle site and the Chicago site occurs from 8:00 P.M. to 1:00 M. every day.

  At 7:00 A.M. an administrator deletes a user account while he is logged on to DC001.

  You need to restore the deleted user account. You must achieve this goal by using the minimum administrative effort.

  What should you do?

  A. On DC006, stop AD DS, perform an authoritative restore, and then start AD DS.
  B. On DC001, run the Restore-ADObject cmdlet.
  C. On DC006, run the Restore-ADObject cmdlet.
  D. On DC001, stop AD DS, restore the system state, and then start AD DS.
  A. On DC006, stop AD DS, perform an authoritative restore, and then start AD DS.

  ---

  We cannot use Restore-ADObject, because Restore-ADObject is a part of the Recycle Bin feature, and you can only use Recycle Bin when the forest functional level is set to Windows Server 2008 R2. In the question text it says "The

  functional level of the forest is Windows Server 2003." See http://technet.microsoft.com/nl-nl/library/dd379481.aspx

  Performing an authoritative restore on DC006 updates the Update Sequence Number (USN) on that DC, which causes it to replicate the restored user account to other DC's.

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 692 "An authoritative restore restores data that was lost and updates the Update Sequence Number (USN) for the data to make it authoritative and ensure that

  it is replicated to all other servers." Reference 2:

  http://technet.microsoft.com/en-us/library/cc755296.aspx

  Authoritative restore of AD DS has the following requirements:

  (...)

  You must stop the Active Directory Domain Services service before you run the ntdsutil authoritative restore command and restart the service after the command is complete.

• Question 247:

  Your network contains an Active Directory forest. The forest contains one domain. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2.

  DC1 was installed before DC2.

  DC1 fails.

  You need to ensure that you can add 1,000 new user accounts to the domain.

  What should you do?

  A. Modify the permissions of the DC2 computer account.
  B. Seize the schema master FSMO role.
  C. Configure DC2 as a global catalog server.
  D. Seize the RID master FSMO role.
  D. Seize the RID master FSMO role.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 536-537 RID master failure

  A failed RID master eventually prevents domain controllers from creating new SIDs and, therefore, prevents you from creating new accounts for users, groups, or computers. However, domain controllers receive a sizable pool of RIDs from

  the RID master, so unless you are generating numerous new accounts, you can often go for some time without the RID master online while it is being repaired. Seizing this role to another domain controller is a significant action. After the RID

  master role has been seized, the domain controller that had been performing the role cannot be brought back online.

• Question 248:

  You want users to log on to Active Directory by using a new Principal Name (UPN).

  You need to modify the UPN suffix for all user accounts.

  Which tool should you use?

  A. Dsmod
  B. Netdom
  C. Redirusr
  D. Active Directory Domains and Trusts
  A. Dsmod

  ---

  http://technet.microsoft.com/en-us/library/cc732954%28v=ws.10%29.aspx Dsmod user dsmod user -upn

  Specifies the user principal names (UPNs) of the users that you want to modify, for example, [email protected].

• Question 249:

  Your company has two Active Directory forests as shown in the following table.

  

  The forests are connected by using a two-way forest trust. Each trust direction is configured with forest-wide authentication. The new security policy of the company prohibits users from the eng.fabrikam.com domain to access resources in the contoso.com domain.

  You need to configure the forest trust to meet the new security policy requirement.

  What should you do?

  A. Delete the outgoing forest trust in the contoso.com domain.
  B. Delete the incoming forest trust in the contoso.com domain.
  C. Change the properties of the existing incoming forest trust in the contoso.com domain from Forest- wide authentication to Selective authentication.
  D. Change the properties of the existing outgoing forest trust in the contoso.com domain to exclude *.eng. fabrikam.com from the Name Suffix Routing trust properties.
  D. Change the properties of the existing outgoing forest trust in the contoso.com domain to exclude *.eng. fabrikam.com from the Name Suffix Routing trust properties.

  ---

  http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx How Domain and Forest Trusts Work

  Active Directory provides security across multiple domains or forests through domain and forest trust relationships. Before authentication can occur across trusts, Windows must first determine whether the domain being requested by a user,

  computer or service has a trust relationship with the logon domain of the requesting account. To make this determination, the Windows security system computes a trust path between the domain controller for the server that receives the

  request and a domain controller in the domain of the requesting account.

  ..

  Trust Flow

  The flow of secured communications over trusts determines the elasticity of a trust: how you create or configure a trust determines how far the communication extends within a forest or across forests. The flow of communication over trusts is

  determined by the direction of the trust (one-way or two-way) and the transitivity of the trust (transitive or nontransitive).

  One-Way and Two-Way Trusts

  Trust relationships that are established to enable access to resources can be either one-way or two-way. A one-way trust is a unidirectional authentication path created between two domains. In a one-way trust between Domain A and Domain

  B, users in Domain A can access resources in Domain B. However, users in Domain B cannot access resources in Domain A. Some one-way trusts can be either nontransitive or transitive depending on the type of trust being created. All

  domain trusts in an Active Directory forest are two-way, transitive trusts. When a new child domain is created, a two-way, transitive trust is automatically created between the new child domain and the parent domain. In a two-way trust,

  Domain A trusts Domain B and Domain B trusts Domain A. This means that authentication requests can be passed between the two domains in both directions. Some two-way relationships can be nontransitive or transitive depending on the

  type of trust being created. An Active Directory domain can establish a one-way or two-way trust with:

  Windows Server 2003 domains in the same forest.

  Windows Server 2003 domains in a different forest.

  Windows NT 4.0 domains.

  Kerberos V5 realms.

  Transitive and Nontransitive Trusts

  Transitivity determines whether a trust can be extended outside of the two domains with which it was formed. A transitive trust can be used to extend trust relationships with other domains; a nontransitive trust can be used to deny trust

  relationships with other domains. Each time you create a new domain in a forest, a two-way, transitive trust relationship is automatically created between the new domain and its parent domain. If child domains are added to the new domain,

  the trust path flows upward through the domain hierarchy extending the initial trust path created between the new domain and its parent domain. Transitive trust relationships flow upward through a domain tree as it is formed, creating

  transitive trusts between all domains in the domain tree. Authentication requests follow these trust paths, so accounts from any domain in the forest can be authenticated by any other domain in the forest. With a single logon process,

  accounts with the proper permissions can access resources in any domain in the forest. The following figure shows that all domains in Tree 1 and Tree 2 have transitive trust relationships by default. As a result, users in Tree 1 can access

  resources in domains in Tree 2 and users in Tree 1 can access resources in Tree 2, when the

  proper permissions are assigned at the resource.

  Default Transitive Trust Relationships

  

  In addition to the default transitive trusts established in a Windows Server 2003 forest, by using the New Trust Wizard you can manually create the following transitive trusts. Shortcut trust. A transitive trust between domains in the same

  domain tree or forest that is used to shorten the trust path in a large and complex domain tree or forest. Forest trust. A transitive trust between one forest root domain and another forest root domain. Realm trust. A transitive trust between an

  Active Directory domain and a Kerberos V5 realm. A nontransitive trust is restricted to the two domains in the trust relationship and does not flow to any other domains in the forest. A nontransitive trust can be a two-way trust or a one-way

  trust. Nontransitive trusts are one-way by default, although you can also create a two-way relationship by creating two one-way trusts. Nontransitive domain trusts are the only form of trust relationship possible between:

  A Windows Server 2003 domain and a Windows NT domain

  A Windows Server 2003 domain in one forest and a domain in another forest (when not joined by a forest trust)

  By using the New Trust Wizard, you can manually create the following nontransitive trusts: External trust. A nontransitive trust created between a Windows Server 2003 domain and a Windows NT, Windows 2000, or Windows Server 2003 domain in another forest. When you upgrade a Windows NT domain to a Windows Server 2003 domain, all existing Windows NT trusts are preserved intact. All trust relationships between Windows Server 2003 domains and Windows NT domains are nontransitive. Realm trust A nontransitive trust between an Active Directory domain and a Kerberos V5 realm

• Question 250:

  Your network contains an Active Directory domain. The relevant servers in the domain are configured as shown in the following table.

  

  You need to ensure that all device certificate requests use the MD5 hash algorithm. What should you do?

  A. On Server2, run the Certutil tool.
  B. On Server1, update the CEP Encryption certificate template.
  C. On Server1, update the Exchange Enrollment Agent (Offline Request) template.
  D. On Server3, set the value of the HKLM\Software\Microsoft\Cryptography\MSCEP\ HashAlgorithm\HashAlgorithm registry key.
  D. On Server3, set the value of the HKLM\Software\Microsoft\Cryptography\MSCEP\ HashAlgorithm\HashAlgorithm registry key.

  ---

  Reference: http://technet.microsoft.com/en-us/library/ff955642.aspx

  Managing Network Device Enrollment Service Configuring NDES NDES stores its configuration in the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography \MSCEP. To change NDES configuration, edit the NDES registry settings by using Regedit.exe or Reg.exe, then restart IIS. If necessary, create the key and value using the names and data types described in the following table. Key name HashAlgorithm \ HashAlgorithm Value Data Type String Default value SHA1 Description Accepted values are SHA1 and MD5.