Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 271:

  Your network contains an Active Directory domain named contoso.com. The domain contains two member servers named Server1 and Server2. You configure Server1 as a standalone root certification authority (CA). You identify the following requirements for the public key infrastructure (PKI):

  

  The root CA must be offline once the PKI is deployed.

  

  Users must be able to enroll for certificates automatically.

  You need to configure Server2 to meet the PKI requirements. What should you configure on Server2?

  A. A standalone subordinate CA
  B. A standalone root CA
  C. An enterprise subordinate CA
  D. An enterprise root CA
  C. An enterprise subordinate CA

• Question 272:

  Your network contains an Active Directory domain. The domain contains a member server named Server1 that runs Windows Server 2008 R2.

  You need to configure Server1 as a global catalog server.

  What should you do?

  A. Modify the Active Directory schema.
  B. From Ntdsutil, use the Roles option.
  C. Run the Active Directory Domain Services Installation Wizard on Server1.
  D. Move the Server1 computer object to the Domain Controllers organizational unit (OU).
  C. Run the Active Directory Domain Services Installation Wizard on Server1.

  ---

  Now it's just a member server, so you'll have to run dcpromo to start the Active Directory Domain Services Installation Wizard in order to promote the server to a domain controller. Only a domain controller can be a global catalog server.

  Reference:

  http://technet.microsoft.com/en-us/library/cc728188.aspx

  The global catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain in a multidomain Active Directory Domain Services (AD DS) forest. The global catalog is stored on domain

  controllers that have been designated as global catalog servers and is distributed through multimaster replication.

• Question 273:

  Your network contains a domain controller that is configured as a DNS server. The server hosts an Active Directory-integrated zone for the domain. You need to reduce how long it takes until stale records are deleted from the zone.

  What should you do?

  A. From the configuration directory partition of the forest, modify the tombstone lifetime.
  B. From the configuration directory partition of the forest, modify the garbage collection interval.
  C. From the aging properties of the zone, modify the no-refresh interval and the refresh interval.
  D. From the start of authority (SOA) record of the zone, modify the refresh interval and the expire interval.
  C. From the aging properties of the zone, modify the no-refresh interval and the refresh interval.

  ---

  

  http://technet.microsoft.com/en-us/library/cc816625%28v=ws.10%29.aspx Set Aging and Scavenging Properties for a Zone The DNS Server service supports aging and scavenging features. These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time. You can use this procedure to set the aging and scavenging properties for a specific zone using either the DNS Manager snap-in or the dnscmd command-line tool. To set aging and scavenging properties for a zone using the Windows interface

  1.

  Open DNS Manager. To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  2.

  In the console tree, right-click the applicable zone, and then click Properties.

  3.

  On the General tab, click Aging.

  4.

  Select the Scavenge stale resource records check box.

  5.

  Modify other aging and scavenging properties as needed. To set aging and scavenging properties for a zone using a command line

  1.

  Open a command prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2.

  At the command prompt, type the following command, and then press ENTER:

  dnscmd /Config {/Aging |/RefreshInterval |/ NoRefreshInterval }

  

• Question 274:

  Your network contains an Active Directory forest. The forest contains multiple sites.

  You need to enable universal group membership caching for a site.

  What should you do?

  A. From Active Directory Sites and Services, modify the NTDS Settings.
  B. From Active Directory Sites and Services, modify the NTDS Site Settings.
  C. From Active Directory Users and Computers, modify the properties of all universal groups used in the site.
  D. From Active Directory Users and Computers, modify the computer objects for the domain controllers in the site.
  B. From Active Directory Sites and Services, modify the NTDS Site Settings.

  ---

  http://technet.microsoft.com/en-us/library/cc816797%28v=ws.10%29.aspx Enabling Universal Group Membership Caching in a Site

  In a multidomain forest, when a user logs on to a domain, a global catalog server must be contacted to determine the universal group memberships of the user. A universal group can contain users from other domains, and it can be applied to access control lists (ACLs) on objects in all domains in the forest. Therefore, universal group memberships must be ascertained at domain logon so that the user has appropriate access in the domain and in other domains during the logon session. Only global catalog servers store the memberships of all universal groups in the forest. If a global catalog server is not available in the site when a user logs on to a domain, the domain controller must contact a global catalog server in another site. In multidomain forests where remote sites do not have a global catalog server, the need to contact a global catalog server over a potentially slow wide are network (WAN) connection can be problematic and a user can potentially be unable to log on to the domain if a global catalog server is not available. You can enable Universal Group Membership Caching on domain controllers that are running Windows Server 2008 so that when the domain controller contacts a global catalog server for the user's initial domain logon, the domain controller retrieves universal group memberships for the user. On subsequent logon requests by the same user, the domain controller uses cached universal group memberships and does not have to contact a global catalog server. To complete this task, perform the following procedure: http://technet.microsoft.com/en-us/library/cc816928%28v=ws.10%29.aspx Enable Universal Group Membership Caching in a Site

  1.

  Open Active Directory Sites and Services: On the Start menu, point to Administrative Tools, and then click Active Directory Sites and Services.

  2.

  In the console tree, expand Sites, and then click the site in which you want to enable Universal Group Membership Caching.

  3.

  In the details pane, right-click the NTDS Site Settings object, and then click Properties.

  4.

  Under Universal Group Membership Caching, select Enable Universal Group Membership Caching.

  5.

  In the Refresh cache from list, click the site that you want the domain controller to contact when the Universal Group membership cache must be updated, and then click OK.

• Question 275:

  Your network contains two Active Directory forests named contoso.com and fabrikam.com. The contoso.com forest contains a server named Server1l that has the Certification Authority role service installed.

  You need to ensure that Windows 7 client computers in the fabrikam.com forest can enroll for certificates from Server1. The solution must minimize the number of role services installed on Server1.

  Which additional role service or role services should you install? To answer, select the appropriate role service or role services in the answer area.

  Hot Area:

  

  

• Question 276:

  A corporate network includes an Active Directory Domain Services (AD DS) forest that contains two domains. All servers run Windows Server 2008 R2. All domain controllers are configured as DNS servers.

  A standard primary zone for dev.contoso.com is stored on a member server. You need to ensure that all domain controllers can resolve names from the dev.contoso.com zone.

  What should you do?

  A. On one domain controller, create a secondary zone.
  B. On the member server, create a secondary zone.
  C. On each domain controller, create a secondary zone.
  D. On one domain controller, create a conditional forwarder. Configure the conditional forwarder to replicate to all DNS servers in the domain.
  C. On each domain controller, create a secondary zone.

• Question 277:

  ABC.com has an Active Directory forest on a single domain. The domain operates Windows Server 2008. A new administrator accidentally deletes the entire organizational unit in the Active Directory database that hosts 6000 objects.

  You have backed up the system state data using third-party backup software. To restore backup, you start the domain controller in the Directory Services Restore Mode (DSRM). You need to perform an authoritative restore of the organizational unit and restore the domain controller to its original state.

  Which three actions should you perform?

  Select and Place:

  

  

  ---

  References:

  Performing Authoritative Restore of Active Directory Objects

  http://technet.microsoft.com/en-us/library/cc816878.aspx

  Restart the Domain Controller in Directory Services Restore Mode Locally

  http://technet.microsoft.com/en-us/library/cc816897.aspx

  Restore AD DS from Backup (Nonauthoritative Restore)

  http://technet.microsoft.com/en-us/library/cc794755.aspx

  Mark an Object or Objects as Authoritative

  http://technet.microsoft.com/en-us/library/cc816813.aspx

  Restart the Domain Controller in Directory Services Restore Mode Locally

  If you have physical access to a domain controller, you can restart the domain controller in Directory Services Restore Mode (DSRM) locally. Restarting in DSRM takes the domain controller offline. In this mode, the server is functioning as a member server, not as a domain controller.

  During installation of Active Directory Domain Services (AD DS), you set the Administrator password for logging on to the server in DSRM. When you start Windows Server 2008 in DSRM, you must log on by using this DSRM password for the local Administrator account.

  Restore AD DS from Backup (Nonauthoritative Restore)

  Nonauthoritative restore from backup restores Active Directory Domain Services (AD DS) from urrent state to the previous state of a backup. Use this procedure before you perform an authoritative restore procedure to recover objects that were deleted after the time of the backup.

  To restore AD DS from backup, use a system state or critical-volumes backup.

  Mark an Object or Objects as Authoritative

  In this procedure, you use the ntdsutil command to select objects that are to be marked authoritative when they replicate to other domain controllers.

  Restart the domain controller

• Question 278:

  Your network contains an Active Directory forest named fabrikam.com. The forest contains the following domains:

  

  Fabrikam.com

  

  Eu.fabrikam.com

  

  Na.fabrikam.com

  

  Eu.contoso.com

  

  Na.contoso.com

  You need to configure the forest to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix of contoso.com when they create user accounts from Active Directory users and Computers.

  Which tool should you use?

  A. Active Directory Users and Computers
  B. Set-ADAccountControl
  C. Set-ADForest
  D. New-ADObject
  C. Set-ADForest

• Question 279:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows Server 2008 R2. The functional level of the domain is Windows Server 2008 R2. The functional level of the forest is Windows Server 2008.

  You have a member server named Server1 that runs Windows Server 2008.

  You need to ensure that you can add Server1 to contoso.com as a domain controller.

  What should you run before you promote Server1?

  A. dcpromo.exe /CreateDCAccount
  B. dcpromo.exe /ReplicaOrNewDomain:replica
  C. Set-ADDomainMode -Identity contoso.com -DomainMode Windows2008Domain
  D. Set-ADForestMode -Identity contoso.com -ForestMode Windows2008R2Forest
  C. Set-ADDomainMode -Identity contoso.com -DomainMode Windows2008Domain

  ---

  http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels.aspx After you set the domain functional level to a certain value in Windows Server 2008 R2, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

• Question 280:

  Your network contains an Active Directory domain named contoso.com. The domain has one Active Directory site.

  The domain contains an organizational unit (OU) named 0U1. OU1 contains user accounts for 100 users and their managers.

  You apply a Group Policy object (GPO) named GPO1 to OU1. GPO1 restricts several desktop settings.

  The managers request that the desktop settings not be applied to them. You need to prevent the desktop settings in GPO1 from being applied to the managers. All other users in OU1 must have GPO1 applied to them.

  What should you do?

  A. Link GPO1 to the site and remove the link for GPO1 from OU1.
  B. Move the managers to a child OU of OU1 and block inheritance on the child OU.
  C. Configure the permissions on OU1.
  D. Disable the computer configurations of GPO1.
  B. Move the managers to a child OU of OU1 and block inheritance on the child OU.