Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 281:

  You create 200 new user accounts. The users are located in six different sites. New users report that they receive the following error message when they try to log on: "The username or password is incorrect." You confirm that the user accounts exist and are enabled. You also confirm that the user name and password information supplied are correct.

  You need to identify the cause of the failure. You also need to ensure that the new users are able to log on.

  Which utility should you run?

  A. Active Directory Domains and Trusts
  B. Repadmin
  C. Rstools
  D. Rsdiag
  B. Repadmin

  ---

  Repadmin allows us to check the replication status and also allows us to force a replication between domain controllers.

  Reference:

  http://technet.microsoft.com/en-us/library/cc770963.aspx Repadmin /replsummary

  Identifies domain controllers that are failing inbound replication or outbound replication, and summarizes the results in a report.

  Repadmin /showrepl

  Displays the replication status when the specified domain controller last attempted to perform inbound replication on Active Directory partitions.

  Repadmin /syncall Synchronizes a specified domain controller with all replication partners.

• Question 282:

  Your company has recently acquired a new subsidiary company in Quebec. The Active Directory administrators of the subsidiary company must use the French-language version of the administrative templates.

  You create a folder on the PDC emulator for the subsidiary domain in the path %systemroot %\SYSVOL\domain\Policies\PolicyDefinitions\FR.

  You need to ensure that the French-language version of the templates is available.

  What should you do?

  A. Download the Conf.adm, System.adm, Wuau.adm, and Inetres.adm files from the Microsoft Web site. Copy the ADM files to the FR folder.
  B. Copy the ADML files from the French local installation media for Windows Server 2008 R2 to the FR folder on the subsidiary PDC emulator.
  C. Copy the Install.WIM file from the French local installation media for Windows Server 2008 R2 to the FR folder on the subsidiary PDC emulator.
  D. Copy the ADMX files from the French local installation media for Windows Server 2008 R2 to the FR folder on the subsidiary PDC emulator.
  B. Copy the ADML files from the French local installation media for Windows Server 2008 R2 to the FR folder on the subsidiary PDC emulator.

  ---

  http://technet.microsoft.com/en-us/library/cc772507%28v=ws.10%29.aspx .admx and .adml File Structure

  In order to support the multilingual display of policy settings, the ADMX file structure must be broken into two types of files:

  A language-neutral file, .admx, describing the structure of the categories and Administrative template policy settings displayed in the Group Policy Management Console (GPMC) or Local Group Policy Editor.

  A set of language-dependent files, .adml, providing the localized portions displayed in the GPMC or Local Group Policy Editor. Each .adml file represents a single language you wish to support.

  Language-neutral file (.admx) structure

  ..

  Language resource file (.adml) structure

  The language resource files, .adml, provide the language specific information needed by the language neutral file. The language neutral file will then reference specific sections of the language resource file in order for the GPMC or Local

  Group Policy Editor to display a policy setting in the correct language.

• Question 283:

  You have Active Directory Certificate Services (AD CS) deployed.

  You create a custom certificate template.

  You need to ensure that all of the users in the domain automatically enroll for a certificate based on the custom certificate template.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. In a Group Policy object (GPO), configure the autoenrollment settings.
  B. In a Group Policy object (GPO), configure the Automatic Certificate Request Settings.
  C. On the certificate template, assign the Read and Autoenroll permission to the Authenticated Users group.
  D. On the certificate template, assign the Read, Enroll, and Autoenroll permission to the Domain Users group.
  A. In a Group Policy object (GPO), configure the autoenrollment settings.
  D. On the certificate template, assign the Read, Enroll, and Autoenroll permission to the Domain Users group.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/dd379539.aspx

  To automatically enroll client computers for certificates in a domain environment, you must:

  Configure an autoenrollment policy for the domain.

  (...)

  In Configuration Model, select Enabled to enable autoenrollment.

  Configure certificate templates for autoenrollment.

  (...)

  In the Permissions for Authenticated Users list, select Read, Enroll, and Autoenroll in the Allow column, and then click OK and Close to finish Configure an enterprise CA.

• Question 284:

  Your network contains an Active Directory domain named contoso.com. The domain contains two domain controllers named DC1 and DC2. Both domain controllers host an Active Directory-integrated zone for contoso.com. Each domain controller is located in a different city. You have a member server named Serverl. Serverl hosts a stub zone for contoso.com. On DC1, you add a name server (NS) record to the contoso.com zone. In the table below, identify which toot you must use to replicate the record to each server. Make only one selection in each column. Each correct selection is worth one point.

  

  

• Question 285:

  Your network contains a server named Server1. The Active Directory Rights Management Services (AD RMS) server role is installed on Server1.

  An administrator changes the password of the user account that is used by AD RMS.

  You need to update AD RMS to use the new password.

  Which console should you use?

  A. Active Directory Rights Management Services
  B. Active Directory Users and Computers
  C. Local Users and Groups
  D. Services
  A. Active Directory Rights Management Services

  ---

  Reference:

  http://social.technet.microsoft.com/wiki/contents/articles/13034.ad-rms-how-to-change-the-rms- serviceaccount-password.aspx

  AD RMS How To: Change the RMS Service Account Password

  The Active Directory Rights Management Services management console provides a wizard to change or update the AD RMS service account. The most common use for this process is to update the service account password when it has

  been changed.

  It is important to use this process to update or change the AD RMS service account. This ensures the necessary components are updated properly.

• Question 286:

  Your network contains two forests named adatum.com and litwareinc.com. The functional level of all the domains is Windows Server 2003. The functional level of both forests is Windows 2000.

  You need to create a forest trust between adatum.com and litwareinc.com.

  What should you do first?

  A. Create an external trust.
  B. Raise the functional level of both forests.
  C. Configure SID filtering.
  D. Raise the functional level of all the domains.
  B. Raise the functional level of both forests.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771397.aspx

  When to create a forest trust

  You can create a forest trust between forest root domains if the forest functional level is Windows Server 2003 or higher.

• Question 287:

  Your company plans to open a new branch office. The new office will have a Iow-speed connection to the Internet.

  You plan to deploy a read-only domain controller (RODC) in the branch office.

  You need to create an offline copy of the Active Directory database that can be used to install Active Directory on the new RODC.

  Which commands should you run from Ntdsutil? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc770654.aspx

  Installing AD DS from Media You can use the Ntdsutil.exe tool to create installation media for additional domain controllers that you are creating in a domain. By using the Install from Media (IFM) option, you can minimize the replication of directory data over the network. This helps you install additional domain controllers in remote sites more efficiently.

  To create installation media

  1. Click Start, right-click Command Prompt, and then click Run as administrator to open an elevated command prompt.

  2. At the command prompt, type the following command, and then press ENTER: ntdsutil

  3. At the ntdsutil prompt, type the following command, and then press ENTER: activate instance ntds

  4. At the ntdsutil prompt, type the following command, and then press ENTER: ifm

  5. At the ifm: prompt, type the command for the type of installation media that you want to create (as listed in the table earlier in this topic), and then press ENTER.

  For example, to create RODC installation media, type the following command, and then press ENTER: create rodc C:\InstallationMedia

  Where C:\InstallationMedia is the path to the folder where you want the installation media to be created.

  You can save the installation media to a network shared folder or to any other type of removable media.

• Question 288:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering. Users in the Sates OU frequently log on to client computers in the Engineering OU.

  You need to meet the following requirements:

  

  All of the user settings in the Group Policy objects (GPOs) linked to both the Sales OU and the Engineering OU must be applied to sales users when they log on to client computers in the Engineering OU.

  

  Only the policy settings in the GPOs linked to the Sales OU must be applied to sales users when they log on to client computers in the Sales OU.

  

  Policy settings in the GPOs linked to the Sales OU must not be applied to users in the Engineering OU.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Sales OU.
  J. Link the GPO to the Engineering OU.
  D. Enable loopback processing in merge mode.

  ---

  We have to use loopback processing in merge mode if we want all User Configuration settings from the GPO's that are linked to the Sales OU and the Engineering OU to be applied.

  Reference 1: http://technet.microsoft.com/en-us/library/cc782810.aspx

  Loopback processing with merge or replace Setting loopback causes the User Configuration settings in GPOs that apply to the computer to be applied to every user logging on to that computer, instead of (in replace mode) or in addition to (in merge mode) the User Configuration settings of the user. This allows you to ensure that a consistent set of policies is applied to any user logging on to a particular computer, regardless of their location in Active Directory. Loopback can be set to Not Configured, Enabled, or Disabled. In the Enabled state, loopback can be set to Merge or Replace. In either case the user only receives user-related policy settings. Loopback with Replace--In the case of Loopback with Replace, the GPO list for the user is replaced in its entirety by the GPO list that is already obtained for the computer at computer startup (during step 2 in Group Policy processing and precedence). The User Configuration settings from this list are applied to the user. Loopback with Merge--In the case of Loopback with Merge, the Group Policy object list is a concatenation. The default list of GPOs for the user object is obtained, as normal, but then the list of GPOs for the computer (obtained during computer startup) is appended to this list. Because the computer's GPOs are processed after the user's GPOs, they have precedence if any of the settings conflict.

  Reference 2: http://kudratsapaev.blogspot.in/2009/07/loopback-processing-of-group-policy.html

  For a clear and easy explanation of Loopback Processing. Recommended! Reference 3: Windows Server 2008 R2 Unleashed (SAMS, 2010) page 1028 Loopback Processing When a user is processing domain policies, the policies that apply to that user are based on the location of the user object in the Active Directory hierarchy. The same goes for domain policy application for computers. There are situations, however, when administrators or organizations want to ensure that all users get the same policy when logging on to a particular computer or server. For example, on a computer that is used for training or on a Remote Desktop Session Host, also known as a Terminal Server, when the user desktop environment must be the same for each user, this can be controlled by enabling loopback processing in Replace mode on a policy that is applied to the computer objects. To explain a bit further, if a domain policy has the loopback settings enabled and set to Replace mode, any settings defined within that policy in the User Configuration node are applied to all users who log on to the computer this particular policy is applied to. When loopback processing is enabled and configured in Merge mode on a policy applied to a computer object and a user logs on, all of the user policies are applied and then all of the user settings within the policy applied to the computer object are also applied to the user. This ensures that in either Replace or Merge mode, loopback processing applies the settings contained in the computer-linked policies last.

• Question 289:

  You remotely monitor several domain controllers.

  You run winrm.exe quickconfig on each domain controller.

  You need to create a WMI script query to retrieve information from the bios of each domain controller.

  Which format should you use to write the query?

  A. XrML
  B. XML
  C. WQL
  D. HTML
  C. WQL

  ---

  http://msdn.microsoft.com/en-us/library/windows/desktop/aa394606%28v=vs.85%29.aspx WQL (SQL for WMI)

  The WMI Query Language (WQL) is a subset of the American National Standards Institute Structured Query Language (ANSI SQL)--with minor semantic changes.

• Question 290:

  Your network contains an Active Directory domain. The domain contains three domain controllers.

  One of the domain controllers fails.

  Seven days later, the help desk reports that it can no longer create user accounts. You need to ensure that the help desk can create new user accounts.

  Which operations master role should you seize?

  A. domain naming master
  B. infrastructure master
  C. primary domain controller (PDC) emulator
  D. RID master
  E. schema master
  D. RID master

  ---

  http://technet.microsoft.com/en-us/library/cc773108%28v=ws.10%29.aspx Operations master roles

  Active Directory supports multimaster replication of the directory data store between all domain controllers (DC) in the domain, so all domain controllers in a domain are essentially peers. However, some changes are impractical to perform in using multimaster replication, so, for each of these types of changes, one domain controller, called the operations master, accepts requests for such changes. In every forest, there are at least five operations master roles that are assigned to one or more domain controllers. Forest-wide operations master roles must appear only once in every forest. Domain-wide operations master roles must appear once in every domain in the forest. .. RID master The RID master allocates sequences of relative IDs (RIDs) to each of the various domain controllers in its domain. At any time, there can be only one domain controller acting as the RID master in each domain in the forest. Whenever a domain controller creates a user, group, or computer object, it assigns the object a unique security ID (SID). The SID consists of a domain SID, which is the same for all SIDs created in the domain, and a RID, which is unique for each SID created in the domain. To move an object between domains (using Movetree.exe), you must initiate the move on the domain controller acting as the RID master of the domain that currently contains the object. http:// www.techrepublic.com/article/step-by-step-learn-how-to-transfer-and-seize-fsmo-roles-in- activedirectory/5081138 Step-By-Step: Learn how to transfer and seize FSMO roles in Active Directory http://www.petri.co.il/seizing_fsmo_roles.htm Seizing FSMO Roles