Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 321:

  A company has an Active Directory forest. You plan to install an offline Enterprise root certification authority (CA) on a server named CA1. CA1 is a member of the PerimeterNetwork workgroup and is attached to a hardware security module for private key storage.

  You attempt to add the Active Directory Certificate Services (AD CS) server role to CA1. The Enterprise CA option is not available.

  You need to install the AD CS server role as an Enterprise CA on CA1.

  What should you do first?

  A. Add the DNS Server server role to CA1.
  B. Add the Web Server (IIS) server role and the AD CS server role to CA1.
  C. Add the Active Directory Lightweight Directory Services (AD LDS) server role to CA1.
  D. Join CA1 to the domain.
  D. Join CA1 to the domain.

  ---

  Reference 1:

  http://kazmierczak.eu/itblog/2012/09/23/enterprise-ca-option-is-greyed-out-unavailable/ Many times, administrators ask me what to do when installing Active Directory Certificate Services they cannot choose to install Enterprise Certification

  Authority, because it's unavailable.

  Well, you need to fulfill basic requirements:

  1.

  Server machine has to be a member server (domain joined).

  2.

  (...)

  Reference 2:

  http://social.technet.microsoft.com/Forums/en/w7itproSP/thread/34f95b81-b196-4211-9a99- a06108521268

• Question 322:

  You are the systems administrator for a medium-sized Active Directory domain. Currently, the environment supports many different domain controllers, some of which are running Windows NT 4 and others that are running Windows 2003 and Server 2008 R2.

  When you are running domain controllers in this type of environment, which of the following types of groups can you not use? (Choose Two)

  A. Universal security groups
  B. Global groups
  C. Domain local groups
  D. Computer groups
  A. Universal security groups
  D. Computer groups

  ---

  http://support.microsoft.com/kb/231273

  Group Type and Scope Usage in Windows

  Windows 2000 and later extends the Microsoft Windows NT 4.0 concept of user groups by adding Universal and Distribution groups. In Windows NT 4.0, there are only Global and Local groups, and both are considered Security groups.

• Question 323:

  Company has a single domain network with Windows 2000, Windows 2003, and Windows 2008 servers. Client computers running Windows XP and Windows Vista. All domain controllers are running Windows server 2008.

  

  You need to deploy Active Directory Rights Management System (AD RMS) to secure all documents, spreadsheets and to provide user authentication.

  What do you need to configure, in order to complete the deployment of AD RMS?

  A. Upgrade all client computers to Windows Vista. Install AD RMS on domain controller Company _DC1
  B. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all systems. Install AD RMS on domain controller Company _DC1
  C. Upgrade all client computers to Windows Vista. Install AD RMS on Company _SRV5
  D. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all systems. Install AD RMS on domain controller Company _SRV5
  E. None of the above
  D. Ensure that all Windows XP computers have the latest service pack and install the RMS client on all systems. Install AD RMS on domain controller Company _SRV5

  ---

  http://technet.microsoft.com/en-us/library/dd772753%28v=ws.10%29.aspx AD RMS Client Requirements Windows AD RMS Client Windows 7, all editions Windows Server 2008 R2, all editions except Core Editions Windows Vista, all editions Windows Server 2008, all editions except Core Editions Windows XP SP3 32-bit Edition Windows XP SP3 64-bit Edition Windows Server 2003 with SP1 32-bit Edition Windows Server 2003 with SP1 64-bit Edition Windows Server 2003 for Itanium-based systems with SP1 Windows Server 2003 R2 32-bit Edition Windows Server 2003 R2 64-bit Edition Windows Server 2003 R2 for Itanium-based systems Windows Small Business Server 2003 32-bit Edition Windows Server 2000 SP4 32-bit Edition

  http://technet.microsoft.com/en-us/library/dd772659%28v=ws.10%29.aspx AD RMS Prerequisites Before you install AD RMS Before you install Active Directory Rights Management Services (AD RMS) on Windows Server?2008 R2 for the first time, there are several requirements that must be met. Install the AD RMS server as a member server in the same Active Directory Domain Services (AD DS) forest as the user accounts that will be using rights-protected content.

• Question 324:

  Your network contains an Active Directory domain named contoso.com. All domain controllers run a Server Core installation of Windows Server 2008 R2.

  You need to identify which domain controller holds the PDC emulator role.

  Which tool should you run?

  A. Get AdDomain
  B. Query.exe
  C. Netsh.exe
  D. Search-AdAccount
  A. Get AdDomain

  ---

  Get-ADDomain Gets an Active Directory domain. Example output (see last line): Get-ADDomain AllowedDNSSuffixes : {} ChildDomains : {} ComputersContainer : CN=Computers,DC=Fabrikam,DC=com DeletedObjectsContainer : CN=Deleted Objects,DC=Fabrikam,DC=com DistinguishedName : DC=Fabrikam,DC=com DNSRoot : Fabrikam.com DomainControllersContainer : OU=Domain Controllers,DC=Fabrikam,DC=com DomainMode : Windows2003Domain DomainSID : S-1-5-21-41432690-3719764436-1984117282 ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=Fabrikam,DC=com Forest : Fabrikam.com InfrastructureMaster : Fabrikam-DC1.Fabrikam.com LastLogonReplicationInterval : LinkedGroupPolicyObjects : {CN={31B2F340-016D-11D2-945F00C04FB984F9},CN=Policies,CN=System,DC=Fabrikam,DC=com} LostAndFoundContainer : CN=LostAndFound,DC=Fabrikam,DC=com ManagedBy : Name : Fabrikam NetBIOSName : FABRIKAM ObjectClass : domainDNS ObjectGUID : b63b4f44-58b9-49cf-8911-b36e8575d5eb ParentDomain : PDCEmulator : Fabrikam-DC1.Fabrikam.com Etc...

• Question 325:

  Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2. You have four Active Directory sites. Each site has multiple Active Directory subnets.

  You need to identify all of the authentication requests that originate from client computers that are not associated to an Active Directory subnet.

  What should you use?

  A. The System log
  B. The %Systemroot%\Debug\Netsetup.log log file
  C. The Authentication User Interface operational log
  D. The %Systemroot%\Security\Logs\Winlogon.log log file
  B. The %Systemroot%\Debug\Netsetup.log log file

• Question 326:

  You are installing an application on a computer that runs Windows Server 2008 R2. During installation, the application will need to install new attributes and classes to the Active Directory database.

  You need to ensure that you can install the application.

  What should you do?

  A. Change the functional level of the forest to Windows Server 2008 R2.
  B. Log on by using an account that has Server Operator rights.
  C. Log on by using an account that has Schema Administrator rights and the appropriate rights to install the application.
  D. Log on by using an account that has the Enterprise Administrator rights and the appropriate rights to install the application.
  C. Log on by using an account that has Schema Administrator rights and the appropriate rights to install the application.

  ---

  http://technet.microsoft.com/en-us/library/cc756898%28v=ws.10%29.aspx Default groups

  Default groups, such as the Domain Admins group, are security groups that are created automatically when you create an Active Directory domain. You can use these predefined groups to help control access to shared resources and

  delegate specific domain-wide administrative roles.

  ..

  Groups in the Builtin container

  The following table provides descriptions of the default groups located in the Builtin container and lists the assigned user rights for each group.

  

  Groups in the Users container

  The following table provides a description of the default groups located in the Users container and lists the assigned user rights for each group.

  

• Question 327:

  Your network contains an Active Directory domain. The domain contains an organizational unit (OU) named OU1. OU1 contains all managed service accounts in the domain.

  You need to prevent the managed service accounts from being deleted accidentally from OU1.

  Which cmdlet should you use?

  A. Set-ADUser
  B. Set-ADOrganizationalUnit
  C. Set-ADServiceAccount
  D. Set-ADObject
  D. Set-ADObject

  ---

  You can use Set-ADOrganizationalUnit and the -ProtectedFromAccidentalDeletion $true parameter to prevent OU1 from being deleted accidentally, but you would still be able to delete the accounts inside it. Use Set-ADObject to protect the accounts.

  Reference: http://technet.microsoft.com/en-us/library/hh852326.aspx Set-ADObject Modifies an Active Directory object.

  Parameter -ProtectedFromAccidentalDeletion Specifies whether to prevent the object from being deleted. When this property is set to true, you cannot delete the corresponding object without changing the value of the property. Possible values for this parameter include: $false or 0 $true or 1 The following example shows how to set this parameter to true. -ProtectedFromAccidentalDeletion $true

• Question 328:

  Your company has an Active Directory domain named contoso.com. The company network has two DNS servers named DNS1 and DNS2.

  The DNS servers are configured as shown in the following table.

  

  Domain users, who are configured to use DNS2 as the preferred DNS server, are unable to connect to Internet Web sites.

  You need to enable Internet name resolution for all client computers.

  What should you do?

  A. Update the list of root hints servers on DNS2.
  B. Create a copy of the .(root) zone on DNS1.
  C. Delete the .(root) zone from DNS2. Configure conditional forwarding on DNS2.
  D. Update the Cache.dns file on DNS2. Configure conditional forwarding on DNS1.
  C. Delete the .(root) zone from DNS2. Configure conditional forwarding on DNS2.

  ---

  http://support.microsoft.com/kb/298148

  How To Remove the Root Zone (Dot Zone)

  When you install DNS on a Windows 2000 server that does not have a connection to the Internet, the zone for the domain is created and a root zone, also known as a dot zone, is also created. This root zone may prevent access to the

  Internet for DNS and for clients of the DNS. If there is a root zone, there are no other zones other than those that are listed with DNS, and you cannot configure forwarders or root hint servers. For these reasons, you may have to remove the

  root zone.

• Question 329:

  You have an enterprise subordinate certification authority (CA). The CA issues smart card logon certificates.

  Users are required to log on to the domain by using a smart card.

  Your company's corporate security policy states that when an employee resigns, his ability to log on to the network must be immediately revoked.

  An employee resigns.

  You need to immediately prevent the employee from logging on to the domain.

  What should you do?

  A. Revoke the employee's smart card certificate.
  B. Disable the employee's Active Directory account.
  C. Publish a new delta certificate revocation list (CRL).
  D. Reset the password for the employee's Active Directory account.
  B. Disable the employee's Active Directory account.

  ---

  http://blog.imanami.com/blog/bid/68864/Delete-or-disable-an-Active-Directory-account-One-best- practice

  Delete or disable an Active Directory account? One best practice. I was recently talking to a customer about the best practice for deprovisioning a terminated employee in Active Directory. Delete or disable? Microsoft doesn't give the clearest direction on this but common sense does. The case for deleting an account is that, BOOM, no more access. No ifs ands or buts, if there is no account it cannot do anything. The case for disabling an account is that all of the SIDs are still attached to the account and you can bring it back and get the same access right away. And then the reason for MSFT's lack of direction came into play. Individual needs of the customer. This particular customer is a public school system and they often lay off an employee and have to re-hire them the next month or semester. They need that account back.

• Question 330:

  Active Directory Rights Management Services (AD RMS) is deployed on your network. Users who haveWindows Mobile 6 devices report that they cannot access documents that are protected by AD RMS.

  You need to ensure that all users can access AD RMS protected content by using Windows Mobile 6 devices.

  What should you do?

  A. Modify the security of the ServerCertification.asmx file.
  B. Modify the security of the MobileDeviceCertification.asmx file.
  C. Enable anonymous authentication for the _wmcs virtual directory.
  D. Enable anonymous authentication for the certification virtual directory.
  B. Modify the security of the MobileDeviceCertification.asmx file.

  ---

  http://technet.microsoft.com/en-us/library/ff608252%28v=ws.10%29.aspx Windows Mobile Considerations for AD RMS

  AD RMS and Windows Mobile Requirements Active Directory Rights Management Services (AD RMS) integrates with Microsoft Windows Mobile?in Windows Mobile 6 and later devices. End users can create and consume protected e-mail messages and can read protected Microsoft Office documents on their Windows Mobile device. ... AD RMS client capabilities are embedded in the operating system of Windows Mobile 6 and later devices. There is no AD RMS client available for Windows Mobile 5.0 or earlier; AD RMS can be used only on devices with Windows Mobile 6 and later. There is full interoperability when sharing AD RMS protected content between the different versions and editions of Windows Mobile 6 or later. By default the Discretionary access control lists (DACLs) of the AD RMS mobile certification pipeline is restricted and must be enabled for Windows Mobile 6 or later devices to obtain certificates and licenses to create and consume AD RMS protected content. You can enable the certification of mobile devices by giving the AD RMS Service Group and the user account objects of the AD RMS-enabled application Read and Read and Execute permissions to the MobileDeviceCertification.asmx file. This file is located under %systemdrive%\Inetpub\wwwroot \_wmcs \Certification by default. You must complete this process on each AD RMS server in the cluster.