Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 291:

  Your network contains an Active Directory domain named contoso.com.

  The aging and scavenging settings of the contoso.com zone are configured as shown in the exhibit. (Click the Exhibit button.)

  

  Hot Area:

  

  

• Question 292:

  Your network contains an Active Directory forest named contoso.com. The forest contains an enterprise certification authority (CA). The enterprise CA is inaccessible from the internet.

  You have a server named Server1 that runs Windows Server 2008 R2. Server1 is accessible from the Internet. Server1 can communicate with the enterprise CA.

  You need to ensure that laptops that are joined to the domain can renew their certificates automatically from the Internet.

  Which two role services should you install on Server1? (To answer, select the two appropriate role services in the answer area.)

  Hot Area:

  

  

• Question 293:

  You add an Online Responder to an Online Responder Array. You need to ensure that the new Online Responder resolves synchronization conflicts for all members of the Array. What should you do?

  A. From Network Load Balancing Manager, set the priority ID of the new Online Responder to 1.
  B. From Network Load Balancing Manager, set the priority ID of the new Online Responder to 32.
  C. From the Online Responder Management Console, select the new Online Responder, and then select Set as Array Controller.
  D. From the Online Responder Management Console, select the new Online Responder, and then selectSynchronize Members with Array Controller.
  C. From the Online Responder Management Console, select the new Online Responder, and then select Set as Array Controller.

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc770413.aspx Managing Array members

  For each Array, one member is defined as the Array controller; the role of the Array controller is to help resolve synchronization conflicts and to apply updated revocation configuration information to all Array members.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc771281.aspx To designate an Array controller

  1.

  Open the Online Responder snap-in.

  2.

  In the console tree, click Array Configuration Members.

  3.

  Select the Online Responder that you want to designate as the Array controller.

  4.

  In the Actions pane, click Set as Array Controller.

• Question 294:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. DC1 has the DNS Server server role installed and hosts the zone for contoso.com.

  All host (A) records are registered in DNS by using dynamic updates.

  You deploy a new server named dns.contoso.com.

  You install the DNS Server server role on dns.contoso.com.

  The Name Servers list is shown in the Name Server exhibit. (Click the Exhibit button.)

  

  The Zone Transfers settings are shown in the Zone Transfers exhibit. (Click the Exhibit button.)

  

  On dns.contoso.com, you create a secondary zone for contoso.com and you specify DC1 as the master server.

  You discover that the zone fails to transfer to dns.contoso.com. You open DNS Manager as shown in the DNS Manager exhibit. (Click the Exhibit button.)

  

  You need to ensure that dns.contoso.com can transfer the contoso.com zone. What should you do?

  A. Modify the name servers list for the contoso.com zone.
  B. Change the A record for dns.contoso.com to use 10.0.0.2.
  C. Add an A record for contoso.com that has a value of 10.0.0.2.
  D. Allow zone transfers to the 10.0.0.2 IP address.
  E. Add a name server (NS) record for contoso.com that has a value of 10.0.0.2.
  A. Modify the name servers list for the contoso.com zone.

• Question 295:

  Your network contains a single Active Directory forest. The forest contains two domains named contoso.com and sales.contoso.com. The domain controllers are configured as shown in the following table.

  

  All domain controllers run Windows Server 2008 R2. All zones are configured as Active Directory- integrated zones.

  You need to ensure that contoso.com records are available on DC3.

  Which command should you run?

  A. dnscmd.exe DC1.contoso.com /ZoneChangeDirectoryPartition contoso.com /domain
  B. dnscmd.exe DC1.contoso.com /ZoneChangeDirectoryPartition contoso.com /forest
  C. dnscmd.exe DC3.contoso.com /ZoneChangeDirectoryPartition contoso.com /domain
  D. dnscmd.exe DC3.contoso.com /ZoneChangeDirectoryPartition contoso.com /forest
  B. dnscmd.exe DC1.contoso.com /ZoneChangeDirectoryPartition contoso.com /forest

  ---

  http://technet.microsoft.com/en-us/library/cc772069%28v=ws.10%29.aspx#BKMK_23 Dnscmd A command-line interface for managing DNS servers. This utility is useful in scripting batch files to help automate routine DNS management tasks,

  or to perform simple unattended setup and configuration of new DNS servers on your network.

  dnscmd /zonechangedirectorypartition

  Changes the directory partition on which the specified zone resides.

  Syntax

  dnscmd [] /zonechangedirectorypartition ] {[] | []

  }

  Parameters

  Specifies the DNS server to manage, represented by IP address, FQDN, or host name. If this parameter is omitted, the local server is used.

  The FQDN of the current directory partition on which the zone resides. The FQDN of the directory partition that the zone will be moved to. Specifies the type of directory partition that the zone

  will be moved to. /domain Moves the zone to the built-in domain directory partition. /forest Moves the zone to the built-in forest directory partition. /legacy Moves the zone to the directory partition that is created for preActive Directory domain

  controllers. These directory partitions are not necessary for native mode.

• Question 296:

  Your network contains an Active Directory domain. The domain is configured as shown in the following table.

  

  Users in Branch2 sometimes authenticate to a domain controller in Branch1.

  You need to ensure that users inBranch2 only authenticate to the domain controllers in Main.

  What should you do?

  A. On DC3, set the AutoSiteCoverage value to 0.
  B. On DC3, set the AutoSiteCoverage value to 1.
  C. On DC1 and DC2, set the AutoSiteCoverage value to 0.
  D. On DC1 and DC2, set the AutoSiteCoverage value to 1.
  A. On DC3, set the AutoSiteCoverage value to 0.

• Question 297:

  One of the remote branch offices is running a Windows Server 2008 read only domain controller (RODC). For security reasons you don't want some critical credentials like (passwords, encryption keys) to be stored on RODC.

  What should you do so that these credentials are not replicated to any RODC's in the forest? (Select 2)

  A. Configure RODC filtered attribute set on the server
  B. Configure RODC filtered set on the server that holds Schema Operations Master role.
  C. Delegate local administrative permissions for an RODC to any domain user without granting that user any user rights for the domain
  D. Configure forest functional level server for Windows server 2008 to configure filtered attribute set.
  E. None of the above
  B. Configure RODC filtered set on the server that holds Schema Operations Master role.
  D. Configure forest functional level server for Windows server 2008 to configure filtered attribute set.

  ---

  http://technet.microsoft.com/en-us/library/cc753223.aspx Adding attributes to the RODC filtered attribute set

  The RODC filtered attribute set is a dynamic set of attributes that is not replicated to any RODCs in the forest. You can configure the RODC filtered attribute set on a schema master that runs Windows Server 2008. When the attributes are

  prevented from replicating to RODCs, that data cannot be exposed unnecessarily if an RODC is stolen or compromised.

  A malicious user who compromises an RODC can attempt to configure it in such a way that it tries to replicate attributes that are defined in the RODC filtered attribute set. If the RODC tries to replicate those attributes from a domain controller

  that is running Windows Server 2008, the replication request is denied.

  However, if the RODC tries to replicate those attributes from a domain controller that is running Windows Server 2003, the replication request could succeed.

  Therefore, as a security precaution, ensure that forest functional level is Windows Server 2008 if you plan to configure the RODC filtered attribute set. When the forest functional level is Windows Server 2008, an RODC that is compromised

  cannot be exploited in this manner because domain controllers that are running Windows Server 2003 are not allowed in the forest.

• Question 298:

  Your company has an Active Directory forest. The company has servers that run Windows Server 2008 R2 and client computers that run Windows 7. The domain uses a set of GPO administrative templates that have been approved to support regulatory compliance requirements.

  Your partner company has an Active Directory forest that contains a single domain. The company has servers that run Windows Server 2008 R2 and client computers that run Windows 7.

  You need to configure your partner company's domain to use the approved set of administrative templates.

  What should you do?

  A. Use the Group Policy Management Console (GPMC) utility to back up the GPO to a file. In each site, import the GPO to the default domain policy.
  B. Copy the ADMX files from your company's PDC emulator to the PolicyDefinitions folder on the partner company's PDC emulator.
  C. Copy the ADML files from your company's PDC emulator to the PolicyDefinitions folder on the partner company's PDC emulator.
  D. Download the conf.adm, system.adm, wuau.adm, and inetres.adm files from the Microsoft Updates Web site. Copy the ADM files to the PolicyDefinitions folder on thr partner company's emulator.
  B. Copy the ADMX files from your company's PDC emulator to the PolicyDefinitions folder on the partner company's PDC emulator.

  ---

  http://support.microsoft.com/kb/929841

  How to create the Central Store for Group Policy Administrative Template files in Windows Vista Windows Vista uses a new format to display registry-based policy settings. These registry-based policy settings appear under Administrative

  Templates in the Group Policy Object Editor. In Windows Vista, these registry-based policy settings are defined by standards-based XML files that have an .admx file name extension. The .admx file format replaces the legacy .adm file format.

  The .adm file format uses a proprietary markup language.

  In Windows Vista, Administrative Template files are divided into .admx files and language-specific .adml files that are available to Group Policy administrators.

  ..

  Administrative Template file storage

  In earlier operating systems, all the default Administrative Template files are added to the ADM folder of a Group Policy object (GPO) on a domain controller. The GPOs are stored in the SYSVOL folder. The SYSVOL folder is automatically

  replicated to other domain controllers in the same domain. A policy file uses approximately 2 megabytes (MB) of hard disk space. Because each domain controller stores a distinct version of a policy, replication traffic is increased. Windows

  Vista uses a Central Store to store Administrative Template files. In Windows Vista, the ADM folder is not created in a GPO as in earlier versions of Windows.

  Therefore, domain controllers do not store or replicate redundant copies of .adm files.

  The Central Store

  To take advantage of the benefits of .admx files, you must create a Central Store in the SYSVOL folder on a domain controller. The Central Store is a file location that is checked by the Group Policy tools. The Group Policy tools use any

  .admx files that are in the Central Store. The files that are in the Central Store are later replicated to all domain controllers in the domain. To create a Central Store for .admx and .adml files, create a folder that is named PolicyDefinitions in the

  following location:

  \\FQDN\SYSVOL\FQDN\policies

  Note: FQDN is a fully qualified domain name.

  ...

  http://www.frickelsoft.net/blog/?p=31

  How can I export local Group Policy settings made in gpedit.msc? Mark Heitbrink, MVP for Group Policy??came up with a good solution on how you ca"t;expo"t;

  the Group

  Policy and Security??settings you made in on a machine with the Local Group Policy Editor (gpedit.msc) to other machines pretty easy:

  Normal settings can be copied like this:

  1.) Open %systemroot%\system32\grouppolicy\

  Within this folder, there are two folders - "machine" and "user". Copy these to folders to the "%systemroot%

  \system32\grouppolicy - folder on the target machine. All it needs now is a reboot or a "gpupdate /force".

  Note: If you cannot see the "grouppolicy" folder on either the source or the target machine, be sure to have your explorer folder options set to "Show hidden files and folders"...

  For security settings:

  1.) Open MMC and add the Snapin "Security Templates".

  2.) Create your own customized template and save it as an "*inf" file. 3.) Copy the file to the target machine and import it via command line tool "secedit": secedit /configure /db %temp%\temp.sdb /cfg yourcreated.inf

  Further information on secedit can be found here: http://www.microsoft.com/resources/documentation/ windows/xp/all/proddocs/en-us/secedit_cmds.mspx?mfr=true If you're building custom installations, you can pretty easy script the

  "overwriting" of the "machine"/"user"- folders or the import via secedit by copying these file to a share and copy and execute them with a script.

• Question 299:

  Your network contains an Active Directory forest. The forest contains two domains named contoso.com and woodgrovebank.com.

  You have a custom attribute named Attribute 1 in Active Directory. Attribute 1 is associated to User objects.

  You need to ensure that Attribute1 is included in the global catalog.

  What should you do?

  A. From the Active Directory Schema snap-in, modify the properties of the Attribute 1 attributeSchema object.
  B. In Active Directory Users and Computers, configure the permissions on the Attribute 1 attribute for User objects.
  C. From the Active Directory Schema snap-in, modify the properties of the User classSchema object.
  D. In Active Directory Sites and Services, configure the Global Catalog settings for all domain controllers in the forest.
  A. From the Active Directory Schema snap-in, modify the properties of the Attribute 1 attributeSchema object.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/how-global-catalog-servers-work.aspx Global Catalog Partial Attribute Set

  The attributes that are replicated to the global catalog by default include a base set that have been defined by Microsoft as the attributes that are most likely to be used in searches. Administrators can use the Microsoft Management Console

  (MMC) Active Directory Schema snap-in to specify additional attributes to meet the needs of their installation. In the Active Directory Schema snap-in, you can select the Replicate this attribute to the global catalog check box to designate an

  attributeSchema object as a member of the PAS, which sets the value of the isMemberOfPartialAttributeSet attribute to TRUE. Global Catalog Replication of Additions to the Partial Attribute Set Each global catalog server in an AD DS forest

  hosts a copy of every existing object in that forest. For the objects of its own domain, a global catalog server has information related to all attributes that are associated with those objects. For the objects in domains other than its own, a global

  catalog server has only information that is related to the set of attributes that are marked in the AD DS schema to be included in the partial attribute set (PAS). As described earlier, the PAS is defined by Microsoft as those attributes that are

  most likely to be used for searches.

  These attributes are replicated to every global catalog server in an AD DS forest. If you want to add an attribute to the PAS, you can mark the attribute by using the Active Directory Schema snap-in to edit the isMemberOfPartialAttributeSet

  value on the respective attributeSchema object. You mark the attribute by placing a checkmark next to isMemberOfPartialAttributeSet. If the isMemberOfPartialAttributeSet value is checked (set to TRUE), the attribute is replicated to the

  global catalog.

  If the value is not checked (set to FALSE), the attribute is not replicated to the global catalog.

• Question 300:

  You have a domain controller named Server1 that runs Windows Server 2008 R2. You need to determine the size of the Active Directory database on Server1.

  What should you do?

  A. Run the Active Directory Sizer tool.
  B. Run the Active Directory Diagnostics data collector set.
  C. From Windows Explorer, view the properties of the %systemroot%\ntds\ntds.dit file.
  D. From Windows Explorer, view the properties of the %systemroot%\sysvol\domain folder.
  C. From Windows Explorer, view the properties of the %systemroot%\ntds\ntds.dit file.

  ---

  http://technet.microsoft.com/en-us/library/cc961761.aspx

  Directory Data Store

  Active Directory data is stored in the Ntds.dit ESE database file. Two copies of Ntds.dit are present in separate locations on a given domain controller:

  %SystemRoot%\NTDS\Ntds.dit This file stores the database that is in use on the domain controller. It contains the values for the domain and a replica of the values for the forest (the Configuration container data).

  %SystemRoot%\System32\Ntds.dit This file is the distribution copy of the default directory that is used when you promote a Windows 2000 based computer to a domain controller. The availability of this file allows you to run the Active

  Directory Installation Wizard (Dcpromo.exe) without your having to use the Windows 2000 Server operating system CD. During the promotion process, Ntds.dit is copied from the %SystemRoot% \System32 directory into the %SystemRoot%

  \NTDS directory. Active Directory is then started from this new copy of the file, and replication updates the file from other domain controllers.