Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 261:

  Your network contains an Active Directory-integrated DNS zone named contoso.com. You discover that the zone includes DNS records for computers that were removed from the network. You need to ensure that the DNS records are deleted automatically from the zone.

  What should you do?

  A. From DNS Manager, set the aging properties.
  B. Create a scheduled task that runs dnslint.exe /v /d contoso.com.
  C. From DNS Manager, modify the refresh interval of the start of authority (SOA) record.
  D. Create a scheduled task that runs ipconfig.exe /flushdns.
  A. From DNS Manager, set the aging properties.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753217.aspx Set Aging and Scavenging Properties for the DNS Server The DNS Server service supports aging and scavenging features. These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time. You can use this procedure to set the default aging and scavenging properties for the zones on a server. To set aging and scavenging properties for the DNS server using the Windows interface

  1.

  Open DNS Manager.

  2.

  In the console tree, right-click the applicable DNS server, and then click Set Aging/Scavenging for all zones.

  3.

  Select the Scavenge stale resource records check box.

  4.

  Modify other aging and scavenging properties as needed.

• Question 262:

  You had installed Windows Server 2008 on a computer and configured it as a file server, named FileSrv1. The FileSrv1 computer contains four hard disks, which are configured as basic disks. For fault tolerance and performance you want to configure Redundant Array of Independent Disks (RAID) 0 +1 on FileSrv1.

  Which utility you will use to convert basic disks to dynamic disks on FileSrv1?

  A. Diskpart.exe
  B. Chkdsk.exe
  C. Fsutil.exe
  D. Fdisk.exe
  E. None of the above
  A. Diskpart.exe

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771534.aspx [Diskpart] Convert dynamic Converts a basic disk into a dynamic disk.

• Question 263:

  Your company has a main office and five branch offices that are connected by WAN links. The company has an Active Directory domain named contoso.com.

  Each branch office has a member server configured as a DNS server. All branch office DNS servers host a secondary zone for contoso.com.

  You need to configure the contoso.com zone to resolve client queries for at least four days in the event that a WAN link fails.

  What should you do?

  A. Configure the Expires after option for the contoso.com zone to 4 days.
  B. Configure the Retry interval option for the contoso.com zone to 4 days.
  C. Configure the Refresh interval option for the contoso.com zone to 4 days.
  D. Configure the Minimum (default) TTL option for the contoso.com zone to 4 days.
  A. Configure the Expires after option for the contoso.com zone to 4 days.

  ---

  http://technet.microsoft.com/en-us/library/cc816704%28v=ws.10%29.aspx Adjust the Expire Interval for a Zone

  You can use this procedure to adjust the expire interval for a Domain Name System (DNS) zone. Other DNS servers that are configured to load and host the zone use the expire interval to determine when zone data expires if it is not

  successfully transferred. By default, the expire interval for each zone is set to one day.

  You can complete this procedure using either the DNS Manager snap-in or the dnscmd command-line tool.

  To adjust the expire interval for a zone using the Windows interface

  1.

  Open DNS Manager. To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  2.

  In the console tree, right-click the applicable zone, and then click Properties.

  3.

  On the General tab, verify that the zone type is either Primary or Active Directory-integrated.

  4.

  Click the Start of Authority (SOA) tab.

  5.

  In Expires after, click a time period in minutes, hours, or days, and then type a number in the text box.

  6.

  Click OK to save the adjusted interval.

• Question 264:

  Your network contains an Active Directory domain named contoso.com. The properties of the contoso.com DNS zone are configured as shown in the exhibit. the Exhibit button.)

  

  You need to update all service location (SRV) records for a domain controller in the domain. What should you do?

  A. Restart the Netlogon service.
  B. Restart the DNS Client service.
  C. Run sc.exe and specify the triggerinfo parameter.
  D. Run ipconfig.exe and specify the /registerdns parameter.
  A. Restart the Netlogon service.

  ---

  Reference:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 62

  The SRV resource records for a domain controller are important in enabling clients to locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a domain controller is restarted. You can

  also re-register a domain controller's SRV resource records by restarting this service from the Services branch of Server Manager or by typing net start netlogon. An exam question might ask you how to troubleshoot the nonregistration of

  SRV resource records.

• Question 265:

  You have an Active Directory domain named contoso.com.

  You need to view the account lockout threshold and duration for the domain.

  Which tool should you use?

  A. Get-ItemProperty
  B. Active Directory Domains and Trusts
  C. Net User
  D. Gpresult
  C. Net User

• Question 266:

  Your network contains an Active Directory domain named litwareinc.com. The domain contains two sites named Site1 and Site2. Site2 contains a read-only domain controller (RODC).

  You need to identify which user accounts attempted to authenticate to the RODC.

  Which tool should you use?

  A. Repadmin
  B. Get-ADAccountResultantPasswordReplicationPolicy
  C. Active Directory Sites and Services
  D. Get-ADFineGrainedPasswordPolicy
  A. Repadmin

• Question 267:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit. (Click the Exhibit button.)

  

  Users in the Finance organizational unit (OU) frequently log on to client computers in the Human Resources OU. You need to meet the following requirements:

  

  All of the user settings in the Group Policy objects (GPOs) linked to both the Finance OU and the Human Resources OU must be applied to finance users when they log on to client computers in the Engineering OU.

  

  Only the policy settings in the GPOs linked to the Finance OU must be applied to finance users when they log on to client computers in the Finance OU.

  

  Policy settings in the GPOs linked to the Finance OU must not be applied to users in the Human Resources OU. What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Finance OU.
  J. Link the GPO to the Human Resources OU.
  D. Enable loopback processing in merge mode.

  ---

  Very similar question to K/Q11.

  We have to use loopback processing in merge mode if we want all User Configuration settings from the GPO's that are linked to the Sales OU and the Engineering OU to be applied.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc782810.aspx

  Loopback processing with merge or replace

  Setting loopback causes the User Configuration settings in GPOs that apply to the computer to be applied to every user logging on to that computer, instead of (in replace mode) or in addition to (in merge mode) the User Configuration

  settings of the user. This allows you to ensure that a consistent set of policies is applied to any user logging on to a particular computer, regardless of their location in Active Directory.

  Loopback can be set to Not Configured, Enabled, or Disabled. In the Enabled state, loopback can be set to Merge or Replace. In either case the user only receives user-related policy settings. Loopback with Replace--In the case of Loopback

  with Replace, the GPO list for the user is replaced in its entirety by the GPO list that is already obtained for the computer at computer startup (during step 2 in Group Policy processing and precedence). The User Configuration settings from

  this list are applied to the user.

  Loopback with Merge--In the case of Loopback with Merge, the Group Policy object list is a concatenation. The default list of GPOs for the user object is obtained, as normal, but then the list of GPOs for the computer (obtained during

  computer startup) is appended to this list. Because the computer's GPOs are processed after the user's GPOs, they have precedence if any of the settings conflict.

  Reference 2:

  http://kudratsapaev.blogspot.in/2009/07/loopback-processing-of-group-policy.html

  For a clear and easy explanation of Loopback Processing. Recommended! Reference 3:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) page 1028

  Loopback Processing

  When a user is processing domain policies, the policies that apply to that user are based on the location of the user object in the Active Directory hierarchy. The same goes for domain policy application for computers. There are situations,

  however, when administrators or organizations want to ensure that all users get the same policy when logging on to a particular computer or server. For example, on a computer that is used for training or on a Remote Desktop Session Host,

  also known as a Terminal Server, when the user desktop environment must be the same for each user, this can be controlled by enabling loopback processing in Replace mode on a policy that is applied to the computer objects.

  To explain a bit further, if a domain policy has the loopback settings enabled and set to Replace mode, any settings defined within that policy in the User Configuration node are applied to all users who log on to the computer this particular

  policy is applied to. When loopback processing is enabled and configured in Merge mode on a policy applied to a computer object and a user logs on, all of the user policies are applied and then all of the user settings within the policy applied

  to the computer object are also applied to the user. This ensures that in either Replace or Merge mode, loopback processing applies the settings contained in the computer-linked policies last.

• Question 268:

  Your network contains an Active Directory domain named contoso.com. The network has a branch office site that contains a read-only domain controller (RODC) named RODC1. RODC1 runs Windows Server 2008 R2.

  A user logs on to a computer in the branch office site.

  You discover that the user's password is not stored on RODC1. You need to ensure that the user's password is stored on RODC1 when he logs on to a branch office site computer.

  What should you do?

  A. Modify the RODC s password replication policy by removing the entry for the Allowed RODC Password Replication Group.
  B. Modify the RODC's password replication policy by adding RODC1's computer account to the list of allowed users, groups, and computers.
  C. Add the user's user account to the built-in Allowed RODC Password Replication Group on RODC1.
  D. Add RODC1's computer account to the built-in Allowed RODC Password Replication Group on RODC1.
  C. Add the user's user account to the built-in Allowed RODC Password Replication Group on RODC1.

  ---

  Reference: MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 416-417 Password Replication Policy Password Replication Policy (PRP) determines which users' credentials can be cached on a specific RODC. If PRP allows an RODC to cache a user's credentials, authentication and service ticket activities of that user can be processed by the RODC. If a user's credentials cannot be cached on an RODC, authentication and service ticket activities are referred by the RODC to a writable domain controller. An RODC's PRP is determined by two multivalued attributes of the RODC's computer account. These attributes are commonly known as the Allowed List and the Denied List. If a user's account is on the Allowed List, the user's credentials are cached. You can include groups on the Allowed List, in which case all users who belong to the group can have their credentials cached on the RODC. If the user is on both the Allowed List and the Denied List, the user's credentials will not be cached--the Denied List takes precedence.

  Configuring Domain-Wide Password Replication Policy To facilitate the management of PRP, Windows Server 2008 R2 creates two domain local security groups in the Users container of Active Directory. The first group, Allowed RODC Password Replication Group, is added to the Allowed List of each new RODC. By default, the group has no members. Therefore, by default, a new RODC will not cache any user's credentials. If you have users whose credentials you want to be cached by all domain RODCs, add those users to the Allowed RODC Password Replication Group.

• Question 269:

  Your network contains an Active Directory domain. The domain contains a group named Group1.

  The minimum password length for the domain is set to six characters. You need to ensure that the passwords for all users in Group1 are at least 10 characters long. All other users must be able to use passwords that are six characters long.

  What should you do first?

  A. Run the New-ADFineGrainedPasswordPolicy cmdlet.
  B. Run the Add-ADFineGrainedPasswordPolicySubject cmdlet.
  C. From the Default Domain Policy, modify the password policy.
  D. From the Default Domain Controller Policy, modify the password policy.
  A. Run the New-ADFineGrainedPasswordPolicy cmdlet.

  ---

  First we need to create a new Active Directory fine grained password policy, using New- ADFineGrainedPasswordPolicy.

  Then we can apply the new policy to Group1, using Add-ADFineGrainedPasswordPolicySubject.

  Reference:

  http://technet.microsoft.com/en-us/library/ee617238.aspx

  New-ADFineGrainedPasswordPolicy

  Creates a new Active Directory fine grained password policy.

• Question 270:

  Your network contains an Active Directory domain named contoso.com. You have a management computer named Computer1 that runs Windows 7.

  You need to forward the logon events of all the domain controllers in contoso.com to Computer1. All new domain controllers must be dynamically added to the subscription.

  What should you do?

  A. From Computer1, configure source-initiated event subscriptions. From a Group Policy object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event Forwarding node.
  B. From Computer1, configure collector-initiated event subscriptions. From a Group Policy object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event Forwarding node.
  C. From Computer1, configure source-initiated event subscriptions. Install a server authentication certificate on Computer1. Implement autoenrollment for the Domain Controllers organizational unit (OU).
  D. From Computer1, configure collector-initiated event subscriptions. Install a server authentication certificate on Computer1. Implement autoenrollment for the Domain Controllers organizational unit (OU).
  A. From Computer1, configure source-initiated event subscriptions. From a Group Policy object (GPO) linked to the Domain Controllers organizational unit (OU), configure the Event Forwarding node.

  ---

  Reference:

  http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx Setting up a Source Initiated Subscription

  Source-initiated subscriptions allow you to define a subscription on an event collector computer without defining the event source computers, and then multiple remote event source computers can be set up (using a group policy setting) to forward events to the event collector computer. This differs from a collector initiated subscription because in the collector initiated subscription model, the event collector must define all the event sources in the event subscription.