Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 341:

  Your network contains an Active Directory domain. The domain contains two domain controllers named DC1 and DC2.

  You perform a 　il backup of the domain controllers every night by using Windows Server Backup. You update a script in the SYSVOL folder. The new script fails to run properly. You need to restore the previous version of the script in the

  SYSVOL folder. The solution must minimize the amount of time required to restore the script.

  What should you do first?

  A. Run the Restore-ADObject cmdlet.
  B. Restore the system state to its original location.
  C. Attach the VHD file created by Windows Server Backup.
  D. Run the NTDSUtil.exe command-line tool.
  C. Attach the VHD file created by Windows Server Backup.

• Question 342:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain. All regular user accounts reside in an organizational unit (OU) named Employees. All administrator accounts reside in an OU named Admins.

  You need to ensure that any time an administrator modifies an employee's name in AD DS, the change is audited.

  What should you do first?

  A. Enable the Audit directory service access setting in the Default Domain Policy Group Policy Object.
  B. Use the Auditpol.exe command-line tool to enable the directory services changes auditing subcategory.
  C. Modify the searchFlags property for the User class in the schema.
  D. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Admins OU.
  D. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Admins OU.

• Question 343:

  Your network contains an Active Directory domain named contoso.com. The Active Directory sites are configured as shown in the Sites exhibit. (Click the Exhibit button.)

  

  You need to ensure that DC1 and DC4 are the only servers that replicate Active Directory changes between the sites.

  What should you do?

  A. Configure DC1 as a preferred bridgehead server for IP transport.
  B. Configure DC4 as a preferred bridgehead server for IP transport.
  C. From the DC4 server object, create a Connection object for DC1.
  D. From the DC1 server object, create a Connection object for DC4.
  B. Configure DC4 as a preferred bridgehead server for IP transport.

  ---

  Reference: MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) pages 193, 194 Bridgehead Servers A bridgehead server is the domain controller designated by each site's KCC to take control of intersite replication. The bridgehead server receives information replicated from other sites and replicates it to its site's other domain controllers. It ensures that the greatest portion of replication occurs within sites rather than between them. In most cases, the KCC automatically decides which domain controller acts as the bridgehead server. However, you can use Active Directory Sites and Services to specify which domain controller will be the preferred bridgehead server by using the following steps:

  1.

  In Active Directory Sites and Services, expand the site in which you want to specify the preferred bridgehead server.

  2.

  Expand the Servers folder to locate the desired server, right-click it, and then choose Properties.

  3.

  From the list labeled Transports available for intersite data transfer, select the protocol(s) for which you want to designate this server as a preferred bridgehead server and then click Add.

  Original explanation: Please Check Answer Connections. The KCC creates connections that enable domain controllers to replicate with each other. A connection defines a one-way, inbound route from one domain controller, the source, to another domain controller, the destination. The KCC reuses existing connections where it can, deletes unused connections, and creates new connections if none exist that meet the current need. Bridgehead Servers. To communicate across site links, the KCC automatically designates a single server, called the bridgehead server, in each site to perform site-to-site replication. Subsequent replication occurs by replication within a site. When site links are established, authorized administrators can designate the bridgehead servers that they want to receive replication between sites. By designating a specific server to receive replication between sites, rather than using any available server, authorized administrators can specify the most beneficial conditions for the connection between sites. Bridgehead servers ensure that most replication occurs within sites rather than between sites.

  http://technet.microsoft.com/library/dd277429.aspx

• Question 344:

  Your company has a main office and 10 branch offices. Each branch office has an Active Directory site that contains one domain controller. Only domain controllers in the main office are configured as Global Catalog servers.

  You need to deactivate the Universal Group Membership Caching (UGMC) option on the domain controllers in the branch offices.

  At which level should you deactivate UGMC?

  A. Server
  B. Connection object
  C. Domain
  D. Site
  D. Site

  ---

  http://www.ntweekly.com/?p=788

  Question:How To Enable Or Disable Universal Group Membership Caching Windows Server 2008 Answer: Universal Group Membership Caching enables us to allow users to log on to the network without contacting a Global Catalog server,

  this is recommended to use in remote sites without global a catalog server. To enable or disable Universal Group Membership Caching follow the steps below:

  Open Active Directory Sites And Service -> Go to the site you need to enable or disable the feature -> Right click on the NTDS Site Settings and Click on Properties

  

  Tick the Box next to Enable Universal Group Membership Caching to Enable or Disable.

  

  http://gallery.technet.microsoft.com/scriptcenter/c1bd08d2-1440-40f8-95be-ad2050674d91 Script to Disable Universal Group Membership Caching in all Sites How to Disable Universal Group Membership Caching in all Sites using a Script Starting with Windows Server 2003, a new feature called Universal Group Membership Caching (UGMC) caches a user's membership in Universal Groups on domain controllers authenticating the user. This feature allows a domain controller to have knowledge of Universal Groups a user is member of rather than contacting a Global Catalog.

  Unlike Global group memberships, which are stored in each domain, Universal Group memberships are only stored in a Global Catalog. For example, when a user who belongs to a Universal Group logs on to a domain that is set to the Windows 2000 native domain functional level or higher, the Global Catalog provides Universal Group membership information for the user's account at the time the user logs on to the domain to the authenticating domain controller. UGMC is generally a good idea for multiple domain forests when:

  1.

  Universal Group membership does not change frequently.

  2.

  Low WAN bandwidth between Domain Controllers in different sites. It is also recommended to disable UGMC if all Domain Controllers in a forest are Global Catalogs.

• Question 345:

  You work for an organization with a single Windows Server 2008 R2 Active Directory domain. The domain has OUs for Sales, Marketing, Admin, RandD and Finance.

  You need only the users in the Finance OU to get Windows Office 2010 installed automatically onto their computers.

  You create a GPO named OfficeApp.

  What is the next step in getting all the Finance users Office 2010?

  A. Edit the GPO and assign the Office application to the users account. Link the GPO to the Finance OU.
  B. Edit the GPO and assign the Office application to the users account. Link the GPO to the domain.
  C. Edit the GPO and assign the Office application to the computer account. Link the GPO to the domain.
  D. Edit the GPO and assign the Office application to the computer account. Link the GPO to the Finance OU.
  D. Edit the GPO and assign the Office application to the computer account. Link the GPO to the Finance OU.

• Question 346:

  Your network consists of an Active Directory forest that contains two domains. All servers run Windows Server 2008 R2. All domain controllers are configured as DNS Servers.

  You have a standard primary zone for dev.contoso.com that is stored on a member server. You need to ensure that all domain controllers can resolve names from the dev.contoso.com zone.

  What should you do?

  A. On the member server, create a stub zone.
  B. On the member server, create a NS record for each domain controller.
  C. On one domain controller, create a conditional forwarder. Configure the conditional forwarder to replicate to all DNS servers in the forest.
  D. On one domain controller, create a conditional forwarder. Configure the conditional forwarder to replicate to all DNS servers in the domain.
  C. On one domain controller, create a conditional forwarder. Configure the conditional forwarder to replicate to all DNS servers in the forest.

  ---

  http://technet.microsoft.com/en-us/library/cc730756.aspx Understanding Forwarders

  A forwarder is a Domain Name System (DNS) server on a network that forwards DNS queries for external DNS names to DNS servers outside that network. You can also forward queries according to specific domain names using conditional

  forwarders.

  You designate a DNS server on a network as a forwarder by configuring the other DNS servers in the network to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution

  for names outside your network, such as names on the Internet, and improve the efficiency of name resolution for the computers in your network. The following figure illustrates how external name queries are directed with forwarders.

  

  Conditional forwarders A conditional forwarder is a DNS server on a network that forwards DNS queries according to the DNS domain name in the query. For example, you can configure a DNS server to forward all the queries that it receives for names ending with corp.contoso.com to the IP address of a specific DNS server or to the IP addresses of multiple DNS servers.

  Further information: http://technet.microsoft.com/en-us/library/cc794735%28v=ws.10%29.aspx Assign a Conditional Forwarder for a Domain Name http://technet.microsoft.com/en-us/library/cc754941.aspx Configure a DNS Server to Use Forwarders

• Question 347:

  Your network contains an Active Directory domain named litwareinc.com. The domain contains two sites named Site1 and Site2. Site2 contains a read-only domain controller (RODC). You need to identify which user accounts attempted to authenticate to the RODC.

  Which tool should you use?

  A. Get-ADAccountResultantPasswordReplicationPolicy
  B. Get-ADFineGrainedPasswordPolicy
  C. Dcdiag
  D. Repadmin
  D. Repadmin

• Question 348:

  Your network contains two Active Directory forests named contoso.com and adatum.com. The functional level of both forests is Windows Server 2008 R2. Each forest contains one domain. Active Directory Certificate Services (AD CS) is configured in the contoso.com forest to allow users from both forests to automatically enroll user certificates.

  You need to ensure that all users in the adatum.com forest have a user certificate from the contoso.com certification authority (CA).

  What should you configure in the adatum.com domain?

  A. From the Default Domain Controllers Policy, modify the Enterprise Trust settings.
  B. From the Default Domain Controllers Policy, modify the Trusted Publishers settings.
  C. From the Default Domain Policy, modify the Certificate Enrollment policy.
  D. From the Default Domain Policy, modify the Trusted Root Certification Authority settings.
  C. From the Default Domain Policy, modify the Certificate Enrollment policy.

  ---

  http://technet.microsoft.com/en-us/library/dd851772.aspx Manage Certificate Enrollment Policy by Using Group Policy Configuring certificate enrollment policy settings by using Group Policy

• Question 349:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1 that runs Windows Server 2008 R2.

  You need to increase the amount of Active Directory diagnostic information logged to the Event Viewer on DC1.

  What should you do?

  A. Modify the properties of the objects in the Active Directory Diagnostics Data Collector Set (DCS).
  B. Modify the properties of the System Log and the Application Log.
  C. Modify the flags attribute of DC1.
  D. Modify the settings in the HKey_Local_Machine\SYSTEM\CurrentControlSet\services\NTDS\Diagnostics registry key.
  D. Modify the settings in the HKey_Local_Machine\SYSTEM\CurrentControlSet\services\NTDS\Diagnostics registry key.

• Question 350:

  Your network contains a single Active Directory domain.

  You need to create an Active Directory Domain Services snapshot.

  What should you do?

  A. Use the Ldp tool.
  B. Use the NTDSUtil tool.
  C. Use the Wbadmin tool.
  D. From Windows Server Backup, perform a full backup.
  B. Use the NTDSUtil tool.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc753609.aspx To create an AD DS or AD LDS snapshot

  1.

  Log on to a domain controller as a member of the Enterprise Admins groups or the Domain Admins group.

  2.

  Click Start, right-click Command Prompt, and then click Run as administrator.

  3.

  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4.

  At the elevated command prompt, type the following command, and then press ENTER: ntdsutil

  5.

  At the ntdsutil prompt, type the following command, and then press ENTER: snapshot

  6.

  At the snapshot prompt, type the following command, and then press ENTER: activate instance ntds

  7.

  At the snapshot prompt, type the following command, and then press ENTER: create