Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 311:

  Your network contains an Active Directory domain named contoso.com. The domain contains the servers shown in the following table.

  

  The functional level of the forest is Windows Server 2003. The functional level of the domain is Windows Server 2003.

  DNS1 and DNS2 host the contoso.com zone. All client computers run Windows 7 Enterprise.

  You need to ensure that all of the names in the contoso.com zone are secured by using DNSSEC.

  What should you do first?

  A. Change the functional level of the forest.
  B. Change the functional level of the domain.
  C. Upgrade DC1 to Windows Server 2008 R2.
  D. Upgrade DNS1 to Windows Server 2008 R2.
  D. Upgrade DNS1 to Windows Server 2008 R2.

  ---

  http://technet.microsoft.com/en-us/library/ee683904%28v=ws.10%29.aspx DNS Security Extensions (DNSSEC)

  What are the major changes?

  Support for Domain Name System Security Extensions (DNSSEC) is introduced in Windows Server?2008 R2 and Windows?7. With Windows Server 2008 R2 DNS server, you can now sign and host DNSSECsigned zones to provide security

  for your DNS infrastructure. The following changes are available in DNS server in Windows Server 2008 R2:

  Ability to sign a zone and host signed zones.

  Support for changes to the DNSSEC protocol.

  Support for DNSKEY, RRSIG, NSEC, and DS resource records. The following changes are available in DNS client in Windows 7:

  Ability to indicate knowledge of DNSSEC in queries.

  Ability to process the DNSKEY, RRSIG, NSEC, and DS resource records. Ability to check whether the DNS server with which it communicated has performed validation on the client's behalf.

  The DNS client's behavior with respect to DNSSEC is controlled through the Name Resolution Policy Table (NRPT), which stores settings that define the DNS client's behavior. The NRPT is typically managed through Group Policy.

  What does DNSSEC do?

  DNSSEC is a suite of extensions that add security to the DNS protocol. The core DNSSEC extensions are specified in RFCs 4033, 4034, and 4035 and add origin authority, data integrity, and authenticated denial of existence to DNS. In

  addition to several new concepts and operations for both the DNS server and the DNS client, DNSSEC introduces four new resource records (DNSKEY, RRSIG, NSEC, and DS) to DNS.

  In short, DNSSEC allows for a DNS zone and all the records in the zone to be cryptographically signed.

  When a DNS server hosting a signed zone receives a query, it returns the digital signatures in addition to the records queried for. A resolver or another server can obtain the public key of the public/private key pair and validate that the

  responses are authentic and have not been tampered with. In order to do so, the resolver or server must be configured with a trust anchor for the signed zone, or for a parent of the signed zone.

• Question 312:

  Your network contains a server named Server1 that runs Windows Server 2008 R2 Standard. Server1 has the Active Directory Certificate Services (AD CS) role installed. You configure a certificate template named Template1 for autoenrollment. You discover that certificates are not being issued to any client computers.

  The event logs on the client computers do not contain any autoenrollment errors.

  You need to ensure that all of the client computers automatically receive certificates based on Template1.

  What should you do?

  A. Modify the Default Domain Policy Group Policy object (GPO).
  B. Modify the Default Domain Controllers Policy Group Policy object (GPO).
  C. Upgrade Server1 to Windows Server 2008 R2 Enterprise.
  D. Restart Certificate Services on Server1.
  A. Modify the Default Domain Policy Group Policy object (GPO).

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc731522.aspx

  Configure Certificate Autoenrollment

  Many certificates can be distributed without the client even being aware that enrollment is taking place. These can include most types of certificates issued to computers and services, as well as many certificates issued to users.

  To automatically enroll clients for certificates in a domain environment, you must:

  Configure a certificate template with Autoenroll permissions.

  Configure an autoenrollment policy for the domain.

  To configure autoenrollment Group Policy for a domain

  1.

  On a domain controller running Windows Server 2008 R2 or Windows Server 2008, click Start, point to Administrative Tools, and then click Group Policy Management.

  2.

  In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy Group Policy object (GPO) that you want to edit.

• Question 313:

  Your network contains an Active Directory domain. The domain contains 5,000 user accounts. You need to disable all of the user accounts that have a description of Temp. You must achieve this goal by using the minimum amount of administrative effort.

  Which tools should you use? (Each correct answer presents part of the solution. Choose two.)

  A. Find
  B. Dsget
  C. Dsmod
  D. Dsadd
  E. Net accounts
  F. Dsquery
  C. Dsmod
  F. Dsquery

  ---

  Here we can use Dsquery to find the accounts that have "Temp" as their description and pipe it through to Dsmod to disable them. Should look like this:

  dsquery user domainroot -desc "Temp" | dsmod user -disabled yes

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc725702.aspx

  Dsquery user Finds users in the directory who match the search criteria that you specify.If the predefined search criteria in this command are insufficient, use the more general version of the query command, dsquery *.

  Syntax

  dsmod user

  Parameters

  domainroot

  Specifies the node in the console tree where the search starts. You can specify the forest root (forestroot), domain root (domainroot), or distinguished name of a

  node as the start node (). If you specify forestroot, dsquery searches by using the global catalog. The default value is domainroot.

  -desc

  Specifies the descriptions of the user objects you want to modify.

  Remarks

  The results from a dsquery search can be piped as input to one of the other directory service command- line tools, such as Dsget, Dsmod, Dsmove, or Dsrm.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc732954.aspx

  Dsmod user Modifies attributes of one or more existing users in the directory.

  Syntax

  dsmod user

  Parameter-disabled {yes | no} Specifies whether AD DS disables user accounts for logon. The available values are yes and no. Yes indicates that AD DS disables

  user accounts for logon and no indicates that AD DS does not disable user accounts for logon.

• Question 314:

  Your network contains an Active Directory domain. All domain controller run Windows Server 2003.

  You replace all domain controllers with domain controllers that run Windows Server 2008 R2. You raise the functional level of the domain to Windows Server 2008 R2. You need to minimize the amount of SYSVOL replication traffic on the network.

  What should you do?

  A. Raise the functional level of the forest to Windows Server 2008 R2.
  B. Modify the path of the SYSVOL folder on all of the domain controllers.
  C. On a global catalog server, run repadmin.exe and specify the KCC parameter.
  D. On the domain controller that holds the primary domain controller (PDC) emulator FSMO role, run dfsrmig.exe.
  D. On the domain controller that holds the primary domain controller (PDC) emulator FSMO role, run dfsrmig.exe.

  ---

  Now that the domain controllers have been upgraded to Windows Server 2008 R2 and the domain functional level has been upgraded to Windows Server 2008 R2 we can use DFS Replication for replicating SYSVOL, instead of File

  Replication Service (FRS) of previous Windows Server versions. The migration takes place on a domain controller holding the PDC Emulator role.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc794837.aspx

  Using DFS Replication for replicating SYSVOL in Windows Server 2008 DFS Replication technology significantly improves replication of SYSVOL. In Windows 2000 Server, Windows Server 2003, and Windows Server 2003 R2, FRS is used

  to replicate the contents of the SYSVOL share.

  When a change to a file occurs, FRS replicates the entire updated file. With DFS Replication, for files larger than 64 KB, only the updated portion of the file is replicated.

  Reference 2:

  http://technet.microsoft.com/en-us/library/dd639809.aspx

  Migrating to the Prepared State

  The following sections provide an overview of the procedures that you perform when you migrate SYSVOL replication from File Replication Service (FRS) to Distributed File System (DFS Replication).

  This migration phase includes the tasks in the following list. Running the dfsrmig /SetGlobalState 1 command on the PDC emulator to start the migration to the Prepared state.

• Question 315:

  Your network contains a domain controller that runs Windows Server 2008 R2.

  You run the following command on the domain controller:

  dsamain.exe C dbpath c:\$SNAP_201006170326_VOLUMEC$\Windows\NTDS\ntds.dit C ldapport 389 -allowNonAdminAccess

  The command fails.

  You need to ensure that the command completes successfully.

  How should you modify the command?

  A. Change the value of the -dbpath parameter.
  B. Include the path to Dsamain.
  C. Change the value of the -ldapport parameter.
  D. Remove the CallowNonAdminAccess parameter.
  C. Change the value of the -ldapport parameter.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 690 Use the AD DS database mounting tool to load the snapshot as an LDAP server. dsamain -dbpath c:\$SNAP_datetime_VOLUMEC$\windows\ntds\ntds.dit

  -ldapport portnumber

  Be sure to use ALL CAPS for the -dbpath value and use any number beyond 40,000 for the -ldapport value to ensure that you do not conflict with AD DS.

  Also note that you can use the minus () sign or the slash (/) for the options in the command.

• Question 316:

  Your network contains an Active Directory forest. All client computers run Windows 7. The network contains a high-volume enterprise certification authority (CA).

  You need to minimize the amount of network bandwidth required to validate a certificate.

  What should you do?

  A. Configure an LDAP publishing point for the certificate revocation list (CRL).
  B. Configure an Online Certification Status Protocol (OCSP) responder.
  C. Modify the settings of the delta certificate revocation list (CRL).
  D. Replicate the certificate revocation list (CRL) by using Distributed File System (DFS).
  B. Configure an Online Certification Status Protocol (OCSP) responder.

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 779

  Online responder

  This service is designed to respond to specific certificate validation requests through the Online Certificate

  Status Protocol (OCSP). Using an online responder (OR), the system relying on PKI does not need to obtain a full CRL and can submit a validation request for a specific certificate. The online responder decodes the validation request and

  determines whether the certificate is valid. When it determines the status of the requested certificate, it sends back an encrypted response containing the information to the requester. Using online responders is much faster and more efficient

  than using CRLs. AD CS includes online responders as a new feature in Windows Server 2008 R2.

• Question 317:

  A corporate network includes an Active Directory-integrated zone. All DNS servers that host the zone are domain controllers.

  You add multiple DNS records to the zone.

  You need to ensure that the new records are available on all DNS servers as soon as possible.

  Which tool should you use?

  A. Ntdsutil
  B. Dnscmd
  C. Repadmin
  D. Nslookup
  C. Repadmin

  ---

  To make sure that the new DNS records are replicated to all DNS servers we can use the repadmin tool.

  Reference:

  http://technet.microsoft.com/en-us/library/cc811569.aspx

  Forcing Replication

  Sometimes it becomes necessary to forcefully replicate objects and entire partitions between domain controllers that may or may not have replication agreements.

  Force a replication event with all partners

  The repadmin /syncall command synchronizes a specified domain controller with all replication partners.

  Syntax

  repadmin /syncall [] []

  Parameters

  Specifies the host name of the domain controller to synchronize with all replication partners.

  Specifies the distinguished name of the directory partition.

  Performs specific actions during the replication.

• Question 318:

  Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise.

  You enable key archival on the CA. The CA is configured to use custom certificate templates for Encrypted File System (EFS) certificates.

  You need to archive the private key for all new EFS certificates.

  Which snap-in should you use?

  A. Active Directory Users and Computers
  B. Authorization Manager
  C. Group Policy Management
  D. Enterprise PKI
  E. Security Templates
  F. TPM Management
  G. Certificates
  H. Certification Authority
  I. Certificate Templates
  I. Certificate Templates

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753826.aspx Configure a Certificate Template for Key Archival The key archival process takes place when a certificate is issued. Therefore, a certificate template must be modified to archive keys before any certificates are issued based on this template. Key archival is strongly recommended for use with the Basic Encrypting File System (EFS) certificate template in order to protect users from data loss, but it can also be useful when applied to other types of certificates.

  To configure a certificate template for key archival and recovery

  1.

  Open the Certificate Templates snap-in.

  2.

  In the details pane, right-click the certificate template that you want to change, and then click Duplicate Template.

  3.

  In the Duplicate Template dialog box, click Windows Server 2003 Enterprise unless all of your certification authorities (CAs) and client computers are running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.

  4.

  In Template, type a new template display name, and then modify any other optional properties as needed.

  5.

  On the Security tab, click Add, type the name of the users or groups you want to issue the certificates to, and then click OK.

  6.

  Under Group or user names, select the user or group names that you just added. Under Permissions, select the Read and Enroll check boxes, and if you want to automatically issue the certificate, also select the Autoenroll check box.

  7.

  On the Request Handling tab, select the Archive subject's encryption private key check box.

  Original explanation: http://technet.microsoft.com/en-us/library/cc730721 Original explanation: http://technet.microsoft.com/en-us/library/cc730721

• Question 319:

  

  A domain controller named DC4 runs Windows Server 2008 R2. DC4 is configured as a DNS server for fabrikam.com.

  You install the DNS Server server role on a member server named DNS1 and then you create a standard secondary zone for fabrikam.com. You configure DC4 as the master server for the zone.

  You need to ensure that DNS1 receives zone updates from DC4.

  What should you do?

  A. Add the DNS1 computer account to the DNSUpdateProxy group.
  B. On DC4, modify the permissions offabrikam.com zone.
  C. On DNS1, add a conditional forwarder.
  D. On DC4, modify the zone transfer settings for the fabrikam.com zone.
  D. On DC4, modify the zone transfer settings for the fabrikam.com zone.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc771652.aspx

  Modify Zone Transfer Settings

  You can use the following procedure to control whether a zone will be transferred to other servers and which servers can receive the zone transfer.

  To modify zone transfer settings using the Windows interface

  1.

  Open DNS Manager.

  2.

  Right-click a DNS zone, and then click Properties.

  3.

  On the Zone Transfers tab, do one of the following:

  To disable zone transfers, clear the Allow zone transfers check box. To allow zone transfers, select the Allow zone transfers check box.

  4.

  If you allowed zone transfers, do one of the following:

  To allow zone transfers to any server, click To any server. To allow zone transfers only to the DNS servers that are listed on the Name Servers tab, click Only to servers listed on the Name Servers tab.

  To allow zone transfers only to specific DNS servers, click Only to the following servers, and then add the IP address of one or more DNS servers.

• Question 320:

  Your network contains a server that has the Active Directory Lightweight Directory Services (AD LDS) role installed.

  You need to perform an automated installation of an AD LDS instance.

  Which tool should you use?

  A. Dism.exe
  B. Servermanagercmd.exe
  C. Adaminstall.exe
  D. Ocsetup.exe
  C. Adaminstall.exe

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc816774.aspx To perform an unattended install of an AD LDS instance

  1.

  Create a new text file by using any text editor.

  2.

  Specify the installation parameters.

  3.

  At a command prompt (or in a batch or script file), change to the drive and directory that contains the AD LDS setup files.

  4.

  At the command prompt, type the following command, and then press ENTER: %systemroot %\ADAM\adaminstall.exe /answer:drive:\\.txt"