Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 331:

  You need to compact an Active Directory database on a domain controller that runs Windows Server 2008 R2.

  What should you do?

  A. Run defrag.exe /a /c.
  B. Run defrag.exe /c /u.
  C. From Ntdsutil, use the Files option.
  D. From Ntdsutil, use the Metadata cleanup option.
  C. From Ntdsutil, use the Files option.

  ---

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc794920.aspx

  Compact the Directory Database File (Offline Defragmentation) You can use this procedure to compact the Active Directory database offline. Offline defragmentation returns free disk space in the Active Directory database to the file system.

  As part of the offline defragmentation procedure, check directory database integrity. Performing offline defragmentation creates a new, compacted version of the database file in a different location.

  Reference 2:

  Mastering Windows Server 2008 R2 (Sybex, 2010) page 805

  Performing Offline Defragmentation of Ntds.dit

  These steps assume that you will be compacting the Ntds.dit file to a local folder. If you plan to defragment and compact the database to a remote shared folder, map a drive letter to that shared folder before you begin these steps, and use

  that drive letter in the path where appropriate.

  1.

  Open an elevated command prompt. Click Start, and then right-click Command Prompt. Click Run as Administrator.

  2.

  Type ntdsutil, and then press Enter.

  3.

  Type Activate instance NTDS, and press Enter.

  4.

  At the resulting ntdsutil prompt, type Files (case sensitive), and then press Enter.

  5.

  At the file maintenance prompt, type compact to followed by the path to the destination folder for the defragmentation, and then press Enter.

• Question 332:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. The domain contains 50 domain controllers that run Windows Server 2008 R2.

  The domain contains a group named Computer_Location.

  You plan to create 1,000 computer accounts in the domain in several organizational units (OUs). You need to ensure that the members of the Computer_Location group can modify the description of each computer account as soon as the

  account is created.

  The solution must use permissions that are applied explicitly to the new computer accounts.

  What should you do?

  A. Run the dsadd.exe command
  B. Run the nltest.exe command.
  C. Run the Set-AdDomain cmdlet.
  D. Run the dsmove.exe command.
  E. Run the dcpromo.exe command.
  F. Run the Move-AdDirectoryServer cmdlet.
  G. Use the Active Directory Schema snap-in.
  H. Use the Active Directory Users and Computers console.
  G. Use the Active Directory Schema snap-in.

• Question 333:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain.

  The HR department has a dedicated organizational unit (OU) named HR. The HR OU has two sub- OUs: HR Users and HR Computers. User accounts for the HR department reside in the HR Users OU. Computer accounts for the HR department reside in the HR Computers OU. All HR department employees belong to a security group named HR Employees. All HR department computers belong to a security group named HR PCs.

  Company policy requires that passwords are a minimum of 6 characters. You need to ensure that, the next time HR department employees change their passwords, the passwords are required to have at least 8 characters. The password length requirement should not change for employees of any other department.

  What should you do?

  A. Modify the password policy in the GPO that is applied to the domain.
  B. Create a new GPO, with the necessary password policy, and link it to the HR Users OU.
  C. Create a new GPO, with the necessary password policy, and link it to the HR Computers OU.
  D. Modify the password policy in the GPO that is applied to the domain controllers OU.
  C. Create a new GPO, with the necessary password policy, and link it to the HR Computers OU.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc770394.aspx

  What do fine-grained password policies do?

  You can use fine-grained password policies to specify multiple password policies within a single domain. You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of

  users in a domain.

  For example, you can apply stricter settings to privileged accounts and less strict settings to the accounts of other users. In other cases, you might want to apply a special password policy for accounts whose passwords are synchronized with

  other data sources.

  Are there any special considerations?

  Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups. By default, only members of the Domain Admins group can set fine-grained password

  policies. However, you can also delegate the ability to set these policies to other users. The domain functional level must be Windows Server 2008.

  Fine-grained password policy cannot be applied to an organizational unit (OU) directly. To apply fine-grained password policy to users of an OU, you can use a shadow group

• Question 334:

  You are decommissioning domain controllers that hold all forest-wide operations master roles.

  You need to transfer all forest-wide operations master roles to another domain controller.

  Which two roles should you transfer? (Each correct answer presents part of the solution. Choose two.)

  A. Domain naming master
  B. Infrastructure master
  C. RID master
  D. PDC emulator
  E. Schema master
  A. Domain naming master
  E. Schema master

  ---

  Answer: Schema master Domain naming master http://social.technet.microsoft.com/wiki/contents/articles/832.transferring-fsmo-roles-in-indows-server- 2008.aspx

  Transferring FSMO Roles in Windows Server 2008 One of any system administrator duties, would be to upgrade a current domain controller to a new hardware server. One of the crucial steps required to successfully migrate your domain controller, is to be able to successfully transfer the FSMO roles to the new hardware server. FSMO stands for Flexible Single Master Operations, and in a forest there are at least five roles. The five FSMO roles are: Schema Master Domain Naming Master Infrastructure Master Relative ID (RID) Master PDC Emulator The first two roles above are forest-wide, meaning there is one of each for the entire forest. The last three are domain-wide, meaning there is one of each per domain. If there is one domain in your forest, you will have five FSMO roles. If you have three domains in your forest, there will be 11 FSMO roles.

• Question 335:

  Your network contains an Active Directory domain named contoso.com.

  You create two global groups named Group1 and Group2. The group membership of each group is shown in the following table.

  

  You create the Password Settings objects (PSOs) shown in the following table.

  

  In the table below, identify which PSOs will apply to User1 and User2. Make only one selection in each column.

  Hot Area:

  

  

  ---

  Note:

  * PSO2 has the lowest precedence. PSO2 is linked to GROUP1. Both User1 and User2 are members of Group1.

  * Precedence. This is an integer value that is used to resolve conflicts if multiple PSOs are applied to a user or group object.

  * Each PSO has an additional attribute named msDS-PasswordSettingsPrecedence, which assists in the calculation of RSOP. The msDS-PasswordSettingsPrecedence attribute has an integer value of 1 or greater. A lower value for the precedence attribute indicates that the PSO has a higher rank, or a higher priority, than other PSOs. For example, suppose an object has two PSOs linked to it. One PSO has a precedence value of 2 and the other PSO has a precedence value of 4.

  In this case, the PSO that has the precedence value of 2 has a higher rank and, hence, is applied to the object.

  * If multiple PSOs are linked to a user or group, the resultant PSO that is applied is determined as follows:

  1. A PSO that is linked directly to the user object is the resultant PSO. (Multiple PSOs should not be directly linked to a user object.)

  2. If no PSO is linked directly to the user object, the global security group memberships of the user, and all PSOs that are applicable to the user based on those global group memberships, are compared. The PSO with the lowest precedence value is the resultant PSO.

  3. If no PSO is obtained from conditions (1) and (2), the Default Domain Policy is applied.

• Question 336:

  Your network contains a single Active Directory domain. The domain contains an enterprise certification authority (CA).

  You need to ensure that the encryption keys for e-mail certificates can be recovered from the CA database.

  You modify the e-mail certificate template to support key archival.

  What should you do next?

  A. Issue the key recovery agent certificate template.
  B. Run certutil.exe -recoverkey.
  C. Run certreq.exe-policy.
  D. Modify the location of the Authority Information Access (AIA) distribution point.
  A. Issue the key recovery agent certificate template.

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc770588.aspx

  Identify a Key Recovery Agent

  A key recovery agent is a person who is authorized to recover a certificate on behalf of an end user. Because the role of key recovery agents can involve sensitive data, only highly trusted individuals should be assigned to this role.

  To identify a key recovery agent, you must configure the Key Recovery Agent certificate template to allow the person assigned to this role to enroll for a key recovery agent certificate.

• Question 337:

  Your network contains a single Active Directory domain. The functional level of the forest is Windows Server 2008 R2.

  You need to enable the Active Directory Recycle Bin.

  What should you use?

  A. the Dsmod tool
  B. the Enable-ADOptionalFeature cmdlet
  C. the Ntdsutil tool
  D. the Set-ADDomainMode cmdlet
  B. the Enable-ADOptionalFeature cmdlet

  ---

  Similar question to question L/Q5.

  Reference:

  http://technet.microsoft.com/en-us/library/dd379481.aspx

  Enabling Active Directory Recycle Bin

  After the forest functional level of your environment is set to Windows Server 2008 R2, you can enable Active

  Directory Recycle Bin by using the following methods:

  Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.) Ldp.exe

• Question 338:

  Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. Server1 has the Active Directory Federation Services (AD FS) role installed. You have an application named App1 that is configured to use Server1 for AD FS authentication. You deploy a new server named Server2. Server2 is configured as an AD FS 2.0 server.

  You need to ensure that App1 can use Server2 for authentication.

  What should you do on Server2?

  A. Add an attribute store.
  B. Create a relying party trust.
  C. Create a claims provider trust.
  D. Create a relaying provider trust.
  B. Create a relying party trust.

  ---

  http://technet.microsoft.com/en-us/library/dd807132%28v=ws.10%29.aspx Create a Relying Party Trust Using Federation Metadata http://pipe2text.com/?page_id=815 Setting up a Relying Party Trust in ADFS 2.0 http://blogs.msdn.com/b/card/archive/2010/06/25/using-federation-metadata-to-establish-a-relying- party-trustin-ad-fs-2-0.aspx Using Federation Metadata to establish a Relying Party Trust in AD FS 2.0

• Question 339:

  Your network contains an Active Directory domain. The domain contains five sites. One of the sites contains a read-only domain controller (RODC) named RODC1.

  You need to identify which user accounts can have their password cached on RODC1.

  Which tool should you use?

  A. Get-ADFineGrainedPasswordPolicy
  B. Dcdiag
  C. Get-ADDomamControllerPasswordReplicationPolicy
  D. Get-ADAccountResultantPasswordReplicationPolicy
  A. Get-ADFineGrainedPasswordPolicy

• Question 340:

  ABC.com has a network that is comprise of a single Active Directory Domain. As an administrator at ABC.com, you install Active Directory Lightweight Directory Services (AD LDS) on a server that runs Windows Server 2008. To enable Secure Sockets Layer (SSL) based connections to the AD LDS server, you install certificates from a trusted Certification Authority (CA) on the AD LDS server and client computers.

  Which tool should you use to test the certificate with AD LDS?

  A. Ldp.exe
  B. Active Directory Domain services
  C. ntdsutil.exe
  D. Lds.exe
  E. wsamain.exe
  F. None of the above
  A. Ldp.exe

  ---

  http://technet.microsoft.com/en-us/library/cc725767%28v=ws.10%29.aspx Appendix A: Configuring LDAP over SSL Requirements for AD LDS The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory Lightweight Directory Services (AD LDS). By default, LDAP traffic is not transmitted securely. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology. Step 3: Connect to the AD LDS instance over LDAPS using Ldp.exe To test your server authentication certificate, you can open Ldp.exe on the computer that is running the AD LDS instance and then connect to this AD LDS instance that has the SSL option enabled.