Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 21:

  Your network contains a single Active Directory domain. The functional level of the forest is Windows Server 2008. The functional level of the domain is Windows Server 2008 R2. All DNS servers run Windows Server 2008. All domain controllers run Windows Server 2008 R2.

  You need to ensure that you can enable the Active Directory Recycle Bin.

  What should you do?

  A. Change the functional level of the forest.
  B. Change the functional level of the domain.
  C. Modify the Active Directory schema.
  D. Modify the Universal Group Membership Caching settings.
  A. Change the functional level of the forest.

  ---

  Reference: http://technet.microsoft.com/en-us/library/dd392261.aspx Active Directory Recycle Bin Step-by-Step Guide By default, Active Directory Recycle Bin in Windows Server 2008 R2 is disabled. To enable it, you must first raise the forest functional level of your AD DS or AD LDS environment to Windows Server 2008 R2, which in turn requires all forest domain controllers or all servers that host instances of AD LDS configuration sets to be running Windows Server 2008 R2.

• Question 22:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1 and a domain controller named DC1.

  On Server1, you configure a collector-initiated subscription for the Application log of DC1. The subscription is configured to collect all events.

  After several days, you discover that Server1 failed to collect any events from DC1, although there are more than 100 new events in the Application log of DC1.

  You need to ensure that Server1 collects events from DC1.

  What should you do?

  A. On Server1, run wecutil quick-config.
  B. On Server1, run winrm quickconfig.
  C. On DC1, run wecutil quick-config.
  D. On DC1, run winrm quickconfig.
  D. On DC1, run winrm quickconfig.

  ---

  Since the subscription has been created, wecutil quick-config has already run on Server1. Only thing left is to configure DC1 to forward the events, using winrm quickconfig.

  Reference1: Mastering Windows Server 2008 R2 (Sybex, 2010) page 773 Windows event Collector Service The first time you select the Subscriptions node of Event Viewer or the Subscription tab of any log, a dialog box will appear stating that the Windows Event Collector Service must be running and configured. It then asks whether you want to start and configure the service. If you click Yes, it starts the service and changes the startup type from Manual to Automatic (Delayed Start), causing it to start each time Windows starts.

  Reference 2: http://technet.microsoft.com/en-us/library/cc748890.aspx To configure computers in a domain to forward and collect events

  1.

  Log on to all collector and source computers. It is a best practice to use a domain account with administrative privileges.

  2.

  On each source computer, type the following at an elevated command prompt: winrm quickconfig

• Question 23:

  Your network contains an Active Directory domain that has two sites. You need to identify whether logon scripts are replicated to all domain controllers.

  Which folder should you verify?

  A. GroupPolicy
  B. NTDS
  C. SoftwareDistribution
  D. SYSVOL
  D. SYSVOL

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc794837.aspx

  SYSVOL is a collection of folders that contain a copy of the domain's public files, including system policies, logon scripts, and important elements of Group Policy objects (GPOs).

• Question 24:

  You have a Windows Server 2008 R2 Enterprise Root certification authority (CA). You need to grant members of the Account Operators group the ability to only manage Basic EFS certificates.

  You grant the Account Operators group the Issue and Manage Certificates permission on the CA.

  Which three tasks should you perform next? (Each correct answer presents part of the solution. Choose three.)

  A. Enable the Restrict Enrollment Agents option on the CA.
  B. Enable the Restrict Certificate Managers option on the CA.
  C. Add the Basic EFS certificate template for the Account Operators group.
  D. Grant the Account Operators group the Manage CA permission on the CA.
  E. Remove all unnecessary certificate templates that are assigned to the Account Operators group.
  B. Enable the Restrict Certificate Managers option on the CA.
  C. Add the Basic EFS certificate template for the Account Operators group.
  E. Remove all unnecessary certificate templates that are assigned to the Account Operators group.

  ---

  http://technet.microsoft.com/en-us/library/cc779954%28v=ws.10%29.aspx Role-based administration

  Role explanation

  Role-based administration involves CA roles, users, and groups. To assign a role to a user or group, you must assign the role's corresponding security permissions, group memberships, or user rights to the user or group.

  These security permissions, group memberships, and user rights are used to distinguish which users have which roles. The following table describes the CA roles of role-based administration and the groups relevant to role-based

  administration.

  

  Certificate Manager: Delete multiple rows in database (bulk deletion) Issue and approve certificates Deny certificates Revoke certificates Reactivate certificates placed on hold Renew certificates Recover archived key Read CA database Read CA configuration information ... http://technet.microsoft.com/en-us/library/cc753372.aspx Restrict Certificate Managers A certificate manager can approve certificate enrollment and revocation requests, issue certificates, and manage certificates. This role can be configured by assigning a user or group the Issue and Manage Certificatespermission. When you assign this permission to a user or group, you can further refine their ability to manage certificates by group and by certificate template. For example, you might want to implement a restriction that they can only approve requests or revoke smart card logon certificates for users in a certain office or organizational unit that is the basis for a security group. This restriction is based on a subset of the certificate templates enabled for the certification authority (CA) and the user groups that have Enroll permissions for that certificate template from that CA. .. To configure certificate manager restrictions for a CA:

  1.

  Open the Certification Authority snap-in, and right-click the name of the CA.

  2.

  Click Properties, and then click the Security tab.

  3.

  Verify that the user or group that you have selected has Issue and Manage Certificates permission. If they do not yet have this permission, select the Allow check box, and then click Apply.

  4.

  Click the Certificate Managers tab.

  5.

  Click Restrict certificate managers, and verify that the name of the group or user is displayed.

  6.

  Under Certificate Templates, click Add, select the template for the certificates that you want this user or group to manage, and then click OK. Repeat this step until you have selected all certificate templates that you want to allow this certificate manager to manage.

  7.

  Under Permissions, click Add, type the name of the client for whom you want the certificate manager to manage the defined certificate types, and then click OK.

  8.

  If you want to block the certificate manager from managing certificates for a specific user, computer, or group, under Permissions, select this user, computer, or group, and click Deny.

  9.

  When you are finished configuring certificate manager restrictions, click OK or Apply.

• Question 25:

  You have a Windows Server 2008 R2 that has the Active Directory Certificate Services server role installed.

  You need to minimize the amount of time it takes for client computers to download a certificate revocation list (CRL).

  What should you do?

  A. Install and configure an Online Responder.
  B. Import the Issuing CA certificate into the Trusted Root Certification Authorities store on all client workstations.
  C. Install and configure an additional domain controller.
  D. Import the Root CA certificate into the Trusted Root Certification Authorities store on all client workstations.
  A. Install and configure an Online Responder.

  ---

  http://technet.microsoft.com/en-us/library/cc725958.aspx What Is an Online Responder?

  An Online Responder is a trusted server that receives and responds to individual client requests for information about the status of a certificate.

  The use of Online Responders is one of two common methods for conveying information about the validity of certificates. Unlike certificate revocation lists (CRLs), which are distributed periodically and contain information about all certificates

  that have been revoked or suspended, an Online Responder receives and responds only to individual requests from clients for information about the status of a certificate. The amount of data retrieved per request remains constant no matter

  how many revoked certificates there might be.

  In many circumstances, Online Responders can process certificate status requests more efficiently than by using CRLs.

• Question 26:

  Your network contains an Active Directory domain named contoso.com. The contoso.com DNS zone is stored in Active Directory. All domain controllers run Windows Server 2008 R2.

  You need to identify if all of the DNS records used for Active Directory replication are correctly registered.

  What should you do?

  A. From the command prompt, use netsh.exe.
  B. From the command prompt, use dnslint.exe.
  C. From the Active Directory Module for Windows PowerShell, run the Get-ADRootDSE cmdlet.
  D. From the Active Directory Module for Windows PowerShell, run the Get-ADDomainController cmdlet.
  B. From the command prompt, use dnslint.exe.

  ---

  http://technet.microsoft.com/en-us/library/dd197560.aspx Dnslint.exe

  DNSLint is a Microsoft Windows tool that can be used to help diagnose common DNS name resolution issues.

  It can be targeted to look for specific DNS record sets and ensure that they are consistent across multiple DNS servers. It can also be used to verify that DNS records used specifically for Active Directory replication are correct.

• Question 27:

  Your company uses shared folders. Users are granted access to the shared folders by using domain local groups. One of the shared folders contains confidential data.

  You need to ensure that unauthorized users are not able to access the shared folder that contains confidential data.

  What should you do?

  A. Enable the Do not trust this computer for delegation property on all the computers of unauthorized users by using the Dsmod utility.
  B. Instruct the unauthorized users to log on by using the Guest account. Configure the Deny Full control permission on the shared folders that hold the confidential data for the Guest account.
  C. Create a Global Group named Deny DLG. Place the global group that contains the unauthorized users in to the Deny DLG group. Configure the Allow Full control permission on the shared folder that hold the confidential data for the Deny DLG group.
  D. Create a Domain Local Group named Deny DLG. Place the global group that contains the unauthorized users in to the Deny DLG group. Configure the Deny Full control permission on the shared folder that hold the confidential data for the Deny DLG group.
  D. Create a Domain Local Group named Deny DLG. Place the global group that contains the unauthorized users in to the Deny DLG group. Configure the Deny Full control permission on the shared folder that hold the confidential data for the Deny DLG group.

  ---

  

  

  http://technet.microsoft.com/en-us/library/cc755692%28v=ws.10%29.aspx Any group, whether it is a security group or a distribution group, is characterized by a scope that identifies the extent to which the group is applied in the domain tree or forest. The boundary, or reach, of a group scope is also determined by the domain functional level setting of the domain in which it resides. There are three group scopes: universal, global, and domain local. The following table describes the differences between the scopes of each group.

  

  When to use groups with domain local scope

  Groups with domain local scope help you define and manage access to resources within a single domain. For example, to give five users access to a particular printer, you can add all five user accounts in the printer permissions list. If,

  however, you later want to give the five users access to a new printer, you must again specify all five accounts in the permissions list for the new printer.

• Question 28:

  Your network contains an Active Directory forest named contoso.com.

  You need to identify whether a fine-grained password policy is applied to a specific group.

  Which tool should you use?

  A. Credential Manager
  B. Group Policy Management Editor
  C. Active Directory Users and Computers
  D. Active Directory Sites and Services
  C. Active Directory Users and Computers

  ---

  Use Active Directory Users and Computers to determine the value of the msDS-PSOApplied attribute of the specific group:

  1.

  Open the Properties windows for the group in Active Directory Users and Computers

  2.

  Click the Attribute Editor tab, and then click Filter

  3.

  Ensure that the Show attributes/Optional check box is selected.

  4.

  Ensure that the Show read-only attributes/Backlinks check box is selected.

  5.

  Locate the value of msDS-PSOApplied in the Attributes list.

  Reference: http://technet.microsoft.com/en-us/library/cc754544.aspx

  Defining the scope of fine-grained password policies A PSO can be linked to a user (or inetOrgPerson) or a group object that is in the same domain as the PSO: (...) A new attribute named msDS-PSOApplied has been added to the user and group objects in Windows Server 2008. The msDS-PSOApplied attribute contains a back-link to the PSO. Because the msDSPSOApplied attribute has a back-link, a user or group can have multiple PSOs applied to it. As stated previously, in Windows Server 2008, a user or group can have multiple PSOs applied to it since the msDS-PSOApplied attribute of the user and group objects has a back-link to the PSO.

• Question 29:

  Your network contains an Active Directory forest named contoso.com. The forest contains two domains named contoso.com and child.contoso.com. The forest contains two sites named Seattle and Denver. Both sites contain users, client computers, and domain controllers from both domains.

  The Seattle site contains the first domain controller deployed to the forest. The Seattle site also contains the primary domain controller (PDC) emulator for both domains. All of the domain controllers are configured as DNS servers. All DNS zones are replicated to all of the domain controllers in the forest.

  The users in the Denver site report that is takes a long time to log on to their client computer when they use their user principal name (UPN). The users in the Seattle site do not experience the same issue. You need to reduce the amount of time it takes for the Denver users to log on to their client computer by using their UPN.

  What should you do?

  A. Reduce the cost of the site link between the Denver site and the Seattle site.
  B. Enable the global catalog on a domain controller in the Denver site.
  C. Enable universal group membership caching in the Denver site.
  D. Move a PDC emulator to the Denver site.
  E. Reduce the replication interval of the site link between the Denver site and the Seattle site.
  F. Add an additional domain controller to the Denver site.
  B. Enable the global catalog on a domain controller in the Denver site.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc728188.aspx

  Common Global Catalog Scenarios

  The following events require a global catalog server:

  (...) User logon. In a forest that has more than one domain, two conditions require the global catalog during user authentication:

  1.

  When a user principal name (UPN) is used at logon and the forest has more than one domain, a global catalog server is required to resolve the name.

  2.

  (...)

• Question 30:

  Your company has an Active Directory forest. The company has three locations. Each location has an organizational unit and a child organizational unit named Sales.

  The Sales organizational unit contains all users and computers of the sales department. The company plans to deploy a Microsoft Office 2007 application on all computers within the three Sales organizational units.

  You need to ensure that the Office 2007 application is installed only on the computers in the Sales organizational units.

  What should you do?

  A. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the domain.
  B. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  C. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  D. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to publish the application to the user account. Link the SalesAPP GPO to the Sales organizational unit in each location.
  C. Create a Group Policy Object (GPO) named SalesAPP GPO. Configure the GPO to assign the application to the computer account. Link the SalesAPP GPO to the Sales organizational unit in each location.