Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 301:

  You need to relocate the existing user and computer objects in your company to different organizational units.

  What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.)

  A. Run the move-item command in the Microsoft Windows PowerShell utility.
  B. Run the Active Directory Users and Computers utility.
  C. Run the Dsmove utility.
  D. Run the Active Directory Migration Tool (ADMT).
  B. Run the Active Directory Users and Computers utility.
  C. Run the Dsmove utility.

  ---

  Personal note:

  You can simply drag and drop objects when using the Active Directory Users and Computers utility or use the dsmove command.

  http://technet.microsoft.com/en-us/library/cc731094%28v=ws.10%29.aspx Dsmove Moves a single object, within a domain, from its current location in the directory to a new location, or renames a single object without moving it in the directory

  tree.

• Question 302:

  Company has servers on the main network that run Windows Server 2008. It also has two domain controllers.

  Active Directory services are running on a domain controller named CKDC1. You have to perform critical updates of Windows Server 2008 on CKDC1 without rebooting the server.

  What should you do to perform offline critical updates on CKDC1 without rebooting the server?

  A. Start the Active Directory Domain Services on CKDC1
  B. Disconnect from the network and start the Windows update feature
  C. Stop the Active Directory domain services and install the updates. Start the Active Directory domain services after installing the updates.
  D. Stop Active Directory domain services and install updates. Disconnect from the network and then connect again.
  E. None of the above
  C. Stop the Active Directory domain services and install the updates. Start the Active Directory domain services after installing the updates.

  ---

  Personal comment: I don't believe you can avoid restarting the server when installing some (not all) updates

  http://class10e.com/Microsoft/what-should-you-do-to-perform-offline-critical-updates-on-ckdc1- withoutrebooting-the-server/

  To perform offline critical updates on CKDC1 without rebooting the server, you should stop the Active Directory domain services and install the updates. Start the Active Directory domain services after installing the updates.

  By stopping the Active Directory domain services, you don't need to reboot the server. The updates are related to the Windows Server 2008 on CKDC1 so when you stop the Active Directory domain services and start it again after the

  installation of the updates, the Server will perform in a normal way.

• Question 303:

  You are the network administrator for the ABC Company.

  The ABC Company has all Windows Server 2008 R2 Active Directory domains and uses an Enterprise Root certificate server.

  You need to verify that revoked certificate data is highly available.

  What should you do?

  A. Implement a Group Policy Object(GPO) that has the Certificate Verification Enabled option.
  B. Using Network Load Balancing, implement an Online Certificate Status Protocol(OCSP) responder.
  C. Implement a Group Policy object(GPO) that enables the Online Certificate Status Protocol(OCSP) responder.
  D. Using Network Load Balancing, implement the Certificate Verification Enabled option.
  B. Using Network Load Balancing, implement an Online Certificate Status Protocol(OCSP) responder.

  ---

  Answer: Implement an Online Certificate Status Protocol (OCSP) responder by using Network Load Balancing.

  http://technet.microsoft.com/en-us/library/cc731027%28v=ws.10%29.aspx AD CS: Online Certificate Status Protocol Support

  Certificate revocation is a necessary part of the process of managing certificates issued by certification authorities (CAs). The most common means of communicating certificate status is by distributing certificate revocation lists (CRLs). In the

  Windows Server?2008 operating system, public key infrastructures (PKIs) where the use of conventional CRLs is not an optimal solution, an Online Responder based on the Online Certificate Status Protocol (OCSP) can be used to manage

  and distribute revocation status information.

  What does OCSP support do?

  The use of Online Responders that distribute OCSP responses, along with the use of CRLs, is one of two common methods for conveying information about the validity of certificates. Unlike CRLs, which are distributed periodically and

  contain information about all certificates that have been revoked or suspended, an Online Responder receives and responds only to requests from clients for information about the status of a single certificate. The amount of data retrieved per

  request remains constant no matter how many revoked certificates there might be.

  In many circumstances, Online Responders can process certificate status requests more efficiently than by using CRLs.

  ..

  Adding one or more Online Responders can significantly enhance the flexibility and scalability of an organization's PKI.

  ..

  Further information:

  http://blogs.technet.com/b/askds/archive/2009/08/20/implementing-an-ocsp-responder-part-v- highavailability.aspx

  Implementing an OCSP Responder: Part V High Availability

  There are two major pieces in implementing the High Availability Configuration. The first step is to add the OCSP Responders to what is called an Array. When OCSP Responders are configured in an Array, the configuration of the OCSP

  responders can be easily maintained, so that all Responders in the Array have the same configuration. The configuration of the Array Controller is used as the baseline configuration that is then applied to other members of the Array. The

  second piece is to load balance the OCSP Responders. Load balancing of the OCSP responders is what actually provides fault tolerance.

• Question 304:

  Your network contains two servers named Server1 and Server2 that run Windows Server 2008 R2. Server1 has the Active Directory Federation Services (AD FS) Federation Service role service installed.

  You plan to deploy AD FS 2.0 on Server2.

  You need to export the token-signing certificate from Server1, and then import the certificate to Server2.

  Which format should you use to export the certificate?

  A. Base-64 encoded X.509 (.cer)
  B. Cryptographic Message Syntax Standard PKCS #7 (.p7b)
  C. DER encoded binary X.509 (.cer)
  D. Personal Information Exchange PKCS #12 (.pfx)
  D. Personal Information Exchange PKCS #12 (.pfx)

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/ff678038.aspx

  Checklist: Migrating Settings in the AD FS 1.x Federation Service to AD FS 2.0 If the AD FS 1.x Federation Service has a token-signing certificate that was issued by a trusted certification authority (CA) and you want to reuse it, you will have

  to export it from AD FS 1.x.

  [The site provides also a link for instructions on how to export the token-signing certificate. That link point to the site mentioned in reference 2.]

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc784075.aspx

  Export the private key portion of a token-signing certificate

  To export the private key of a token-signing certificate

  1.

  Click Start, point to Administrative Tools, and then click Active Directory Federation Services.

  2.

  Right-click Federation Service, and then click Properties.

  3.

  On the General tab, click View.

  4.

  In the Certificate dialog box, click the Details tab.

  5.

  On the Details tab, click Copy to File.

  6.

  On the Welcome to the Certificate Export Wizard page, click Next.

  7.

  On the Export Private Key page, select Yes, export the private key, and then click Next.

  8.

  On the Export File Format page, select Personal Information Exchange = PKCS #12 (.PFX), and then click Next.

  9.

  (...)

• Question 305:

  Your network contains an Active Directory domain. The domain contains two domain controllers named DC1 and DC2. DC1 hosts a standard primary DNS zone for the domain. Dynamic updates are enabled on the zone. DC2 hosts a standard secondary DNS zone for the domain.

  You need to configure DNS to allow only secure dynamic updates.

  What should you do first?

  A. On DC1 and DC2, configure a trust anchor.
  B. On DC1 and DC2, configure a connection security rule.
  C. On DC1, configure the zone transfer settings.
  D. On DC1, configure the zone to be stored in Active Directory.
  D. On DC1, configure the zone to be stored in Active Directory.

  ---

  http://www.tutorialspoint.com/shorttutorials/configuring-dns-server-for-secure-only-dynamic-updates/ Configuring DNS Server for Secure Only Dynamic Updates About Dynamic Updates

  During the installation of Active Directory Domain Services on Windows Server 2008 R2, the installation process automatically installs the DNS server on the computer, in case it does not already exist in the network.

  After the successful installation of Active Directory Domain Services, the DNS server is by default configured to automatically update the records of only the domain client computers as soon as it receives the registration request from them.

  This automatic update of DNS records in the DNS database is technically known as `Dynamic Updates'.

  Types of DNS Updates

  Dynamic updates that DNS server in Windows Server 2008 R2 supports include:

  Nonsecure and Secure When this type of dynamic update is selected, any computer can send registration request to the DNS server. The DNS server in return automatically adds the record of the requesting computer in the DNS database,

  even if the computer does not belong to the same DNS domain.

  Although this configuration remarkably reduces administrative overhead, this setting is not recommended for the organizations that have highly sensitive information available in the computers. Secure only When this type of dynamic update is

  selected, only the computers that are members of the DNS domain can register themselves with the DNS server. The DNS server automatically rejects the requests from the computers that do not belong to the domain. This protects the DNS

  server from getting automatically populated with records of unwanted, suspicious and/or fake computers. None When this option is selected, the DNS server does not accept any registration request from any computers whatsoever. In such

  cases, DNS administrators must manually add the IP addresses and the Fully Qualified Domain Names (FQDNs) of the client computers to the DNS database. In most production environments, systems administrators configure Secure Only

  dynamic updates for DNS.

  This remarkably reduces the security risks by allowing only the authentic domain client computers to register themselves with the DNS server automatically, and decreases the administrative overhead at the same time.

  However in some scenarios, administrators choose to have non-Active Directory integrated zone to stay compliant with the policies of the organization. This configuration is not at all recommended because it does not allow administrators to

  configure DNS server for Secure only updates, and it does not allow the DNS database to get replicated automatically to the other DNS servers along with the Active Directory replication process. When DNS zone is not Active Directory

  integrated, DNS database replication process must be performed manually by the administrators. Configure Secure Only Dynamic Updates in Windows Server 2008 R2 DNS Server To configure Secure Only dynamic DNS updates in

  Windows Server 2008 R2, administrators must follow the steps given as below:

  1.

  Log on to Windows Server 2008 R2 DNS server computer with the domain admin or enterprise admin account on which `Secure only' dynamic updates are to be configured.

  2.

  On the desktop screen, click Start.

  3.

  From the Start menu, go to Administrator Tools > DNS.

  4.

  On DNS Manager snap-in, from the console tree in the left, double-click to expand the DNS server name.

  5.

  From the expanded list, double-click Forward Lookup Zones.

  6.

  From the displayed zones list, right-click the DNS zone on which secure only dynamic updates are to be configured.

  7.

  From the displayed context menu, click Properties.

  8.

  On the zone's properties box, make sure that the General tab is selected.

  9.

  On the selected tab, choose Secure only option from the Dynamic updates drop-down list. Note: Secure only option is available only if the DNS zone is Active Directory integrated.

  

  

  Secure Only Dynamic Update

  10.

  Click OK to apply the modified changes.

  11.

  Close DNS Manager snap-in when done.

• Question 306:

  Your network contains an Active Directory domain named contoso.com. You have an organizational unit (OU) named Sales and an OU named Engineering.

  You have a Group Policy object (GPO) linked to the domain.

  You need to ensure that the settings in the GPO are not processed by user accounts or computer accounts in the Sales OU. You must achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Sales OU.
  J. Link the GPO to the Engineering OU.
  B. Enable block inheritance.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc731076.aspx

  Block Inheritance You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

• Question 307:

  You have an enterprise subordinate certification authority (CA).

  You have a custom Version 3 certificate template.

  Users can enroll for certificates based on the custom certificate template by using the Certificates console. The certificate template is unavailable for Web enrollment.

  You need to ensure that the certificate template is available on the Web enrollment pages.

  What should you do?

  A. Run certutil.exe pulse.
  B. Run certutil.exe installcert.
  C. Change the certificate template to a Version 2 certificate template.
  D. On the certificate template, assign the Autoenroll permission to the users.
  C. Change the certificate template to a Version 2 certificate template.

  ---

  Identical to F/Q33.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc732517.aspx

  Certificate Web enrollment cannot be used with version 3 certificate templates.

  Reference 2:

  http://blogs.technet.com/b/ad/archive/2008/06/30/2008-web-enrollment-and-version-3-templates.aspx The reason for this blog post is that one of our customers called after noticing some unexpected behavior when they were trying to use the

  Server 2008 certificate web enrollment page to request a Version 3 Template based certificate. The problem was that no matter what they did the Version 3 Templates would not appear as certificates which could be requested via the web

  page. On the other hand, version 1 and 2 templates did appear in the page and requests could be done successfully using those templates.

• Question 308:

  Your company, Contoso Ltd, has offices in North America and Europe. Contoso has an Active Directory forest that has three domains.

  You need to reduce the time required to authenticate users from the labs.eu.contoso.com domain when they access resources in the eng.na.contoso.com domain.

  What should you do?

  A. Decrease the replication interval for all Connection objects.
  B. Decrease the replication interval for the DEFAULTIPSITELINK site link.
  C. Set up a one-way shortcut trust from eng.na.contoso.com to labs.eu.contoso.com.
  D. Set up a one-way shortcut trust from labs.eu.contoso.com to eng.na.contoso.com.
  C. Set up a one-way shortcut trust from eng.na.contoso.com to labs.eu.contoso.com.

  ---

  http://technet.microsoft.com/en-us/library/cc754538.aspx Understanding When to Create a Shortcut Trust

  When to create a shortcut trust

  Shortcut trusts are one-way or two-way, transitive trusts that administrators can use to optimize the authentication process.

  Authentication requests must first travel a trust path between domain trees. In a complex forest this can take time, which you can reduce with shortcut trusts. A trust path is the series of domain trust relationships that authentication requests

  must traverse between any two domains. Shortcut trusts effectively shorten the path that authentication requests travel between domains that are located in two separate domain trees.

  Shortcut trusts are necessary when many users in a domain regularly log on to other domains in a forest.

  Using the following illustration as an example, you can form a shortcut trust between domain B and domain D, between domain A and domain 1, and so on.

  

  Using one-way trusts A one-way, shortcut trust that is established between two domains in separate domain trees can reduce the time that is necessary to fulfill authentication requests--but in only one direction. For example, when a oneway, shortcut trust is established between domain A and domain B, authentication requests that are made in domain A to domain B can use the new one-way trust path. However, authentication requests that are made in domain B to domain A must still travel the longer trust path.

  Using two-way trusts A two-way, shortcut trust that is established between two domains in separate domain trees reduces the time that is necessary to fulfill authentication requests that originate in either domain. For example, when a two-way trust is established between domain A and domain B, authentication requests that are made from either domain to the other domain can use the new, two-way trust path.

• Question 309:

  Your network contains an Active Directory domain named contoso.com.

  You need to create one password policy for administrators and another password policy for all other users.

  Which tool should you use?

  A. Ntdsutil
  B. Active Directory Users and Computers
  C. ADSI Edit
  D. Group Policy Management Console (GPMC)
  C. ADSI Edit

  ---

  Reference: http://technet.microsoft.com/en-US/library/cc754461.aspx

  Creating a PSO using ADSI Edit Active Directory Service Interfaces Editor (ADSI Edit) provides a view of every object and attribute in an Active Directory Domain Services (AD DS) forest. You can use ADSI Edit to query, view, and edit AD DS objects and attributes. To create a PSO using ADSI Edit

  1.

  Click Start, click Run, type adsiedit.msc, and then click OK.

  2.

  In the ADSI Edit snap-in, right-click ADSI Edit, and then click Connect to.

  3.

  In Name, type the fully qualified domain name (FQDN) of the domain in which you want to create the PSO, and then click OK.

  4.

  Double-click the domain.

  5.

  Double-click DC=.

  6.

  Double-click CN=System.

  7.

  Click CN=Password Settings Container. All the PSO objects that have been created in the selected domain appear.

  8.

  Right-click CN=Password Settings Container, click New, and then click Object.

  9.

  In the Create Object dialog box, under Select a class, click msDS-PasswordSettings, and then click Next.

  10.

  In Value, type the name of the new PSO, and then click Next.

  11.

  Continue with the wizard, and enter appropriate values for all mustHave attributes.

• Question 310:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains two domain controllers. The domain controllers are configured as shown in the following table.

  

  All client computers have IP addresses in the 10.1.2.1 to 10.1.2.240 range. You need to minimize the number of client authentication requests sent to DC2. What should you do?

  A. Create a new site named Site1. Create a new subnet object that has the 10.1.1.0/24 prefix and assign the subnet to Site1. Move DC1 to Site1.
  B. Create a new site named Site1. Create a new subnet object that has the 10.1.1.1/32 prefix and assign the subnet to Site1. Move DC1 to Site1.
  C. Create a new site named Site1. Create a new subnet object that has the 10.1.1.2/32 prefix and assign the subnet to Site1. Move DC2 to Site1.
  D. Create a new site named Site1. Create a new subnet object that has the 10.1.2.0/24 prefix and assign the subnet to Site1. Move DC2 to Site1.
  C. Create a new site named Site1. Create a new subnet object that has the 10.1.1.2/32 prefix and assign the subnet to Site1. Move DC2 to Site1.

  ---

  Creating a new site and assigning a subnet of 10.1.1.2 with subnet mask of 255.255.255.255, it means only ONE ip (the DC2 ip) will be included on the site1 subnet coverage. Therefore all the request will be processed from the DC1 in the default-first-site and dc2 will authenticate only itself.