Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 251:

  Your network contains a server named Server1. Server1 runs Windows Server 2008 R2 and has the Active Directory Lightweight Directory Services (AD LDS) role installed. Server1 hosts two AD LDS instances named Instance1 and Instance2.

  You need to remove Instance2 from Server1 without affecting Instance1.

  Which tool should you use?

  A. NTDSUtil
  B. Dsdbutil
  C. Programs and Features in the Control Panel
  D. Server Manager
  C. Programs and Features in the Control Panel

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc794857.aspx

  Administering AD LDS Instances

  Each AD LDS instance runs as an independent--and separately administered--service on a computer.

  Reference 2:

  technet.microsoft.com/en-us/library/cc794886.aspx

  To remove an AD LDS instance

  1.

  To open Programs and Features, click Start, click Settings, click Control Panel, and then double-click Programs and Features.

  2.

  Locate and click the AD LDS instance that you want to remove.

  3.

  Click Uninstall.

  Note

  It is not necessary to restart the computer after you remove an AD LDS instance.

• Question 252:

  Your network contains an Active Directory forest. The forest schema contains a custom attribute for user objects.

  You need to generate a file that contains the last logon time and the custom attribute values for each user in the forest.

  What should you use?

  A. the Get-ADUser cmdlet
  B. the Export-CSV cmdlet
  C. the Net User command
  D. the Dsquery User tool
  A. the Get-ADUser cmdlet

  ---

  Export-CSV cannot perform queries. It is used to save queries that have been piped through.

  Net User is too limited for our question.

  Get-ADUser

  References:

  https://devcentral.f5.com/weblogs/Joe/archive/2009/01/09/powershell-abcs---o-is-for-output.aspx http://social.technet.microsoft.com/Forums/en-US/winserverpowershell/thread/8d8649d9-f591-4b44- b838-e0f5f3a591d7

  http://kpytko.wordpress.com/2012/07/30/lastlogon-vs-lastlogontimestamp/

  Export-Csv

  Reference:

  http://technet.microsoft.com/en-us/library/ee176825.aspx

  Saving Data as a Comma-Separated Values File

  The Export-Csv cmdlet makes it easy to export data as a comma-separated values (CSV) file; all you need to do is call Export-Csv followed by the path to the CSV file. For example, this command uses Get-Process to grab information about

  all the processes running on the computer, then uses Export-Csv to write that data to a file named C:\Scripts\Test.txt: Get-Process | Export-Csv c:\scripts\test.txt.

  Net User

  Reference:

  http://technet.microsoft.com/en-us/library/cc771865.aspx

  Adds or modifies user accounts, or displays user account information.

  DSQUERY

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc754232.aspx

  Parameters

  { | forestroot | domainroot}

  Specifies the node in the console tree where the search starts. You can specify the forest root (forestroot), domain root (domainroot), or distinguished name of a node as the start node . If you specify forestroot, AD DS searches

  by using the global catalog. -attr { | *} Specifies that the semicolon separated LDAP display names included in for each entry in the result set. If you specify the value of this parameter as a wildcard character (*),

  this parameter displays all attributes that are present on the object in the result set. In addition, if you specify a *, this parameter uses the default output format (a list), regardless of whether you specify the -l parameter. The default

  is a distinguished name.

  Reference 2:

  http://social.technet.microsoft.com/Forums/eu/winserverDS/thread/dda5fcd6-1a10-4d47-9379- 02ca38aaa65b

  Give an example of how to find a user with certain attributes using Dsquery. Note that it uses domainroot as the startnode, instead of forestroot what we need.

  Reference 3:

  http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/c6fc3826-78e1-48fd-ab6f- 690378e0f787/

  List all last login times for all users, regardless of whether they are disabled. dsquery * -filter "(and(objectCategory=user)(objectClass=user))" -limit 0 -attr givenName sn sAMAccountName

  lastLogon>>c:\last_logon_for_all.txt

• Question 253:

  Your network contains an Active Directory domain. You have five organizational units (OUs) named Finance, HR, Marketing, Sales, and Dev. You link a Group Policy object named GPO1 to the domain as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that GPO1 is applied to users in the Finance, HR, Marketing, and Sales OUs.

  The solution must prevent GPO1 from being applied to users in the Dev OU.

  What should you do?

  A. Enforce GPO1.
  B. Modify the security settings of the Dev OU.
  C. Link GPO1 to the Finance OU.
  D. Modify the security settings of the Finance OU.
  C. Link GPO1 to the Finance OU.

  ---

  The OUs that are indicated by a blue exclamation mark in the console tree have blocked inheritance. This means that GPO1 will not be applied to those OUs. For the Dev OU that's ok, but not for the Finance OU. So we have to link GPO1 to

  the Finance OU.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731076.aspx

  Block Inheritance

  You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

  If a domain or OU is set to block inheritance, it will appear with a blue exclamation mark in the console tree.

• Question 254:

  Your network contains an Active Directory forest named contoso.com. The forest contains two member servers named Server1 and Server2. Server1 and Server2 have the DNS Server server role installed. Server1 hosts a standard primary zone for contoso.com. Server2 is configured as a secondary name server for contoso.com.

  You experience issues with the copy of the zone on Server2, You verify that both copies of the zone have the same serial number.

  You need to transfer a complete copy of the zone from Server1 to Server2.

  What should you do on Server2?

  A. From DNS Manager, right-click contoso.com and click Transfer from Master.
  B. From Services, right-click DNS Server and click Refresh.
  C. From Services, right-click DNS Server and click Restart.
  D. From DNS Manager, right-click contoso.com and click Reload.
  E. From DNS Manager, right-click contoso.com and click Transfer a new copy of zone from Master.
  E. From DNS Manager, right-click contoso.com and click Transfer a new copy of zone from Master.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-642) (2nd Edition, 2011) page 212 Manually Updating a Secondary Zone

  By right-clicking a secondary zone in the DNS Manager console tree, you can use the shortcut menu to perform the following secondary zone update operations:

  Reload - This operation reloads the secondary zone from the local storage. Transfer From Master - The server hosting the local secondary zone determines whether the serial number in the secondary zone's SOA resource record has expired

  and then pulls a zone transfer from the master server. Transfer New Copy Of Zone From Master - This operation performs a zone transfer from the secondary zone's master server regardless of the serial number in the secondary zone's SOA

  resource record.

• Question 255:

  Your network consists of an Active Directory forest that contains one domain named contoso.com. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have two Active Directory-integrated zones:

  contoso.com and nwtraders.com.

  You need to ensure a user is able to modify records in the nwtraders.com zone. The solution must prevent the user from modifying the SOA record in the contoso.com zone.

  What should you do?

  A. From the DNS Manager console, modify the permissions of the nwtraders.com zone.
  B. From the DNS Manager console, modify the permissions of the contoso.com zone.
  C. From the Active Directory Users and Computers console, run the Delegation of Control Wizard.
  D. From the Active Directory Users and Computers console, modify the permissions of the Domain Controllers organizational unit (OU).
  A. From the DNS Manager console, modify the permissions of the nwtraders.com zone.

• Question 256:

  You create a Password Settings object (PSO).

  You need to apply the PSO to a domain user named User1.

  What should you do?

  A. Modify the properties of the PSO.
  B. Modify the account options of the User1 account.
  C. Modify the security settings of the User1 account.
  D. Modify the password policy of the Default Domain Policy Group Policy object (GPO).
  A. Modify the properties of the PSO.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc731589.aspx To apply PSOs to users or global security groups using the Windows interface

  1.

  Open Active Directory Users and Computers

  2.

  On the View menu, ensure that Advanced Features is checked.

  3.

  In the console tree, click Password Settings Container.

  4.

  In the details pane, right-click the PSO, and then click Properties.

  5.

  Click the Attribute Editor tab.

  6.

  Select the msDS-PsoAppliesTo attribute, and then click Edit.

  7.

  In the Multi-valued String Editor dialog box, enter the Distinguished Name (also known as DN) of the user or the global security group that you want to apply this PSO to, click Add, and then click OK.

• Question 257:

  Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise.

  You need to ensure that users can enroll for certificates that use the IPSEC (Offline request) certificate template

  Which snap-in should you use?

  A. Enterprise PKI
  B. TPM Management
  C. Certificates
  D. Active Directory Users and Computers
  E. Authorization Manager
  F. Certification Authority
  G. Group Policy Management
  H. Security Templates
  I. Certificate Templates
  I. Certificate Templates

  ---

  Reference:

  http://social.technet.microsoft.com/Forums/en/winserversecurity/thread/962be5d1-d824-4dd8-a501- 3c3a9d600083

  The user should have proper permission on Certificate Templates. Please follow the steps below for troubleshooting:

  1.

  Open MMC, add Certificate Templates snap-in.

  2.

  Double-click IPSec (Offline Request), switch to Security tab, give the user Read and Enroll rights.

  3.

  Close and restart IE on clients computer to test.

• Question 258:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain and 10 domain controllers. All of the domain controllers run Windows Server 2008 R2 Service Pack 1 (SP1).

  The forest contains an application directory partition named dc=app1/dc=contoso,dc=com. A domain controller named DC1 has a copy of the application directory partition.

  You need to configure a domain controller named DC2 to receive a copy of dc=app1,dc=contoso,dc=com.

  Which tool should you use?

  A. Dsdbutil
  B. smgmt
  C. Dsamain
  D. Dsmod
  B. smgmt

• Question 259:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain. The AD DS infrastructure is shown in the following graphic.

  

  When the Montreal Site domain controller is offline, authentication requests for Montreal branch office users are sent to the Toronto Site domain controller.

  You need to ensure that when the Montreal Site domain controller is offline, authentication requests for Montreal branch office users are sent to the Quebec City Site domain controller.

  What should you do?

  A. Create a site link bridge between the Montreal Site and the Quebec City Site.
  B. Create a registry entry on each client computer in the Montreal branch office,
  C. Enable the global catalog role on the Montreal Site domain controller
  D. Delete the Toronto-Montreal Site Link.
  A. Create a site link bridge between the Montreal Site and the Quebec City Site.

• Question 260:

  Your network contains an Active Directory domain. The domain contains four domain controllers.

  You modify the Active Directory schema.

  You need to verify that all the domain controllers received the schema modification.

  Which command should you run?

  A. netdom.exe query fsmo
  B. repadmin.exe /showrepl *
  C. dcdiag.exe /e /test:Topology
  D. dcdiag.exe /a
  C. dcdiag.exe /e /test:Topology