Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 351:

  A user attempts to join a computer to the domain, but the attempt fails. You need to ensure that the user can join fifty computer to the domain. You must ensure that the user is denied any additional rights beyond those required to complete the task.

  What should you do?

  A. Prestage each computer account in the Active Directory domain.
  B. Deploy a Group Policy Object (GPO) that modifies the user rights settings.
  C. Add the user to the Domain Administrators group for one day.
  D. Deploy a Group Policy object (GPO) that modifies the Restricted Groups settings.
  A. Prestage each computer account in the Active Directory domain.

• Question 352:

  Your network contains an Active Directory domain. The domain contains two domain controllers named DC1 and DC2.

  You perform a full backup of the domain controllers every night by using Windows Server Backup.

  You update a script in the 5YSVOL folder. The new script fails to run properly. You need to restore the previous version of the script in the SYSVOL folder. The solution must minimize the amount of time required to restore the script.

  What should you do first?

  A. Run the Restore-ADObject cmdlet.
  B. Attach the VHD file created by Windows Server Backup.
  C. Run the NTDSUtil.exe command-line tool.
  D. Restore the system state to its original location.
  B. Attach the VHD file created by Windows Server Backup.

• Question 353:

  Your network contains an Active Directory domain.

  You need to restore a deleted computer account from the Active Directory Recycle Bin.

  What should you do?

  A. From the command prompt, run recover.exe.
  B. From the command prompt, run ntdsutil.exe.
  C. From the Active Directory Module for Windows PowerShell, run the Restore-Computer cmdlet.
  D. From the Active Directory Module for Windows PowerShell, run the Restore-ADObject cmdlet.
  D. From the Active Directory Module for Windows PowerShell, run the Restore-ADObject cmdlet.

  ---

  http://technet.microsoft.com/en-us/library/dd379509%28v=ws.10%29.aspx Step 2: Restore a Deleted Active Directory Object

  Applies To: Windows Server 2008 R2 This step provides instructions for completing the following tasks with Active Directory Recycle Bin: Displaying the Deleted Objects container Restoring a deleted Active Directory object using Ldp.exe Restoring a deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets Restoring multiple, deleted Active Directory objects ... To restore a single, deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets

  1.

  Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.

  2.

  At the Active Directory module for Windows PowerShell command prompt, type the following command, and then press ENTER:

  Get-ADObject -Filter {String} -IncludeDeletedObjects | Restore-ADObject For example, if you want to restore an accidentally deleted user object with the display name Mary, type the following command, and then press ENTER:

  Get-ADObject -Filter {displayName -eq "Mary"} -IncludeDeletedObjects | Restore-ADObject http://blogs.msdn.com/b/dsadsi/archive/2009/08/26/restoring-object-from-the-active-directory-recycle- binusing-ad-powershell.aspx

  Restoring object from the Active Directory Recycle Bin using AD Powershell

• Question 354:

  Your company has a server that runs Windows Server 2008 R2. Active Directory Certificate Services (AD CS) is configured as a standalone Certification Authority (CA) on the server.

  You need to audit changes to the CA configuration settings and the CA security settings.

  Which two tasks should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Configure auditing in the Certification Authority snap-in.
  B. Enable auditing of successful and failed attempts to change permissions on files in the %SYSTEM32%\CertSrv directory.
  C. Enable auditing of successful and failed attempts to write to files in the %SYSTEM32%\CertLog directory.
  D. Enable the Audit object access setting in the Local Security Policy for the Active Directory Certificate Services (AD CS) server.
  A. Configure auditing in the Certification Authority snap-in.
  D. Enable the Audit object access setting in the Local Security Policy for the Active Directory Certificate Services (AD CS) server.

  ---

  http://technet.microsoft.com/en-us/library/cc772451.aspx Configure CA Event Auditing

  You can audit a variety of events relating to the management and activities of a certification authority (CA):

  Back up and restore the CA database.

  Change the CA configuration.

  Change CA security settings.

  Issue and manage certificate requests.

  Revoke certificates and publish certificate revocation lists (CRLs).

  Store and retrieve archived keys.

  Start and stop Active Directory Certificate Services (AD CS).

  To configure CA event auditing

  1.

  Open the Certification Authority snap-in.

  2.

  In the console tree, click the name of the CA.

  3.

  On the Action menu, click Properties.

  4.

  On the Auditing tab, click the events that you want to audit, and then click OK.

  5.

  On the Action menu, point to All Tasks, and then click Stop Service.

  6.

  On the Action menu, point to All Tasks, and then click Start Service.

  Additional considerations To audit events, the computer must also be configured for auditing of object access. Audit policy options can be viewed and managed in local or domain Group Policy under Computer Configuration\Windows Settings\Security Settings\Local Policies.

• Question 355:

  Your network contains an Active Directory forest named contoso.com. The forest contains six domains.

  You need to ensure that the administrators of any of the domains can specify a user principal name (UPN) suffix of litwareinc.com when they create user accounts by using Active Directory Users and Computers.

  Which tool should you use?

  A. New-ADObject
  B. Active Directory Sites and Services
  C. Active Directory Domains and Trusts
  D. Set-ADAccountControl
  C. Active Directory Domains and Trusts

  ---

  Many thanks to Camel73 for supplying this new question!

  Reference: http://technet.microsoft.com/en-us/library/cc772007.aspx To add UPN suffixes

  1.

  Open Active Directory Domains and Trusts.

  2.

  In the console tree, right-click Active Directory Domains and Trusts, and then click Properties.

  3.

  On the UPN Suffixes tab, type an alternative UPN suffix for the forest, and then click Add.

  4.

  Repeat step 3 to add additional alternative UPN suffixes.

• Question 356:

  You need to deactivate the UGMC option on some of your domain controllers.

  At which level in Active Directory would you deactivate UGMC?

  A. Server
  B. Site
  C. Domain
  D. Forest
  B. Site

  ---

  http://www.ntweekly.com/?p=788

  Question:How To Enable Or Disable Universal Group Membership Caching Windows Server 2008 Answer: Universal Group Membership Caching enables us to allow users to log on to the network without contacting a Global Catalog server,

  this is recommended to use in remote sites without global a catalog server.

  To enable or disable Universal Group Membership Caching follow the steps below:

  Open Active Directory Sites And Service -> Go to the site you need to enable or disable the feature -> Right click on the NTDS Site Settings and Click on Properties

  

  Tick the Box next to Enable Universal Group Membership Caching to Enable or Disable.

  

  http://gallery.technet.microsoft.com/scriptcenter/c1bd08d2-1440-40f8-95be-ad2050674d91 Script to Disable Universal Group Membership Caching in all Sites How to Disable Universal Group Membership Caching in all Sites using a Script Starting with Windows Server 2003, a new feature called Universal Group Membership Caching (UGMC) caches a user's membership in Universal Groups on domain controllers authenticating the user. This feature allows a domain controller to have knowledge of Universal Groups a user is member of rather than contacting a Global Catalog.

  Unlike Global group memberships, which are stored in each domain, Universal Group memberships are only stored in a Global Catalog. For example, when a user who belongs to a Universal Group logs on to a domain that is set to the Windows 2000 native domain functional level or higher, the Global Catalog provides Universal Group membership information for the user's account at the time the user logs on to the domain to the authenticating domain controller.

  UGMC is generally a good idea for multiple domain forests when:

  1.

  Universal Group membership does not change frequently.

  2.

  Low WAN bandwidth between Domain Controllers in different sites. It is also recommended to disable UGMC if all Domain Controllers in a forest are Global Catalogs.

• Question 357:

  The Company has a Windows 2008 domain controller server. This server is routinely backed up over the network from a dedicated backup server that is running Windows 2003 OS. You need to prepare the domain controller for disaster recovery apart from the routine backup procedures.

  You are unable to launch the backup utility while attempting to back up the system state data for the data controller.

  You need to backup system state data from the Windows Server 2008 domain controller server.

  What should you do?

  A. Add your user account to the local Backup Operators group
  B. Install the Windows Server backup feature using the Server Manager feature.
  C. Install the Removable Storage Manager feature using the Server Manager feature
  D. Deactivating the backup job that is configured to backup Windows 2008 server domain controller on the Windows 2003 server.
  E. None of the above
  B. Install the Windows Server backup feature using the Server Manager feature.

  ---

  http://technet.microsoft.com/en-us/library/cc770266%28v=ws.10%29.aspx Windows Server Backup Step-by-Step Guide for Windows Server 2008 The Windows Server Backup feature provides a basic backup and recovery solution for computers running the Windows Server?2008 operating system. Windows Server Backup introduces new backup and recovery technology and replaces the previous Windows Backup (Ntbackup.exe) feature that was available with earlier versions of the Windows operating system.

  What is Windows Server Backup? The Windows Server Backup feature in Windows Server 2008 consists of a Microsoft Management Console (MMC) snap-in and command-line tools that provide a complete solution for your day-to-day backup and recovery needs. You can use four wizards to guide you through running backups and recoveries. You can use Windows Server Backup to back up a full server (all volumes), selected volumes, or the system state. You can recover volumes, folders, files, certain applications, and the system state. And, in case of disasters like hard disk failures, you can perform a system recovery, which will restore your complete system onto the new hard disk, by using a full server backup and the Windows Recovery Environment.

  You can use Windows Server Backup to create and manage backups for the local computer or a remote computer. You can also schedule backups to run automatically and you can perform one-time backups to augment the scheduled backups.

• Question 358:

  Your network contains an Active Directory domain named litwareinc.com. The domain contains two sites named Sitel and Site2. Site2 contains a read-only domain controller (RODC).

  You need to identify which user accounts attempted to authenticate to the RODC.

  Which tool should you use?

  A. Active Directory Users and Computers
  B. Ntdsutil
  C. Get-ADAccountResultantPasswordReplicationPolicy
  D. Adtest
  A. Active Directory Users and Computers

  ---

  Original answer was C ("Get-ADAccountResultantPasswordReplicationPolicy").

  Ntdsutil cannot be used for this.

  http://technet.microsoft.com/en-us/library/cc753343.aspx

  Get-ADAccountResultantPasswordReplicationPolicy is used to get the members of the allowed list or denied list of a read-only domain controller's password replication policy. Get- ADDomainControllerPasswordReplicationPolicyUsage could

  be used, but is not listed.

  http://technet.microsoft.com/en-us/library/ee617207.aspx

  Adtest is used for perfomance testing.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc755310.aspx

  Review whose accounts have been authenticated to an RODC

  Periodically, you should review whose accounts have been authenticated to an RODC. (...) You can use Active Directory Users and Computers or repadmin /prp to review whose accounts have been authenticated to an RODC.

  Reference 2:

  http://technet.microsoft.com/en-us/library/83a6daba-cdde-4606-97a3- ebb9d7fa6bf(v=ws.10)#BKMK_Auth2

  Gives a step by step explanation on using Active Directory Users and Computers.

  Old explanation:

  Get-ADDomainControllerPasswordReplicationPolicyUsage o get accounts that are authenticated by the RODC, use the AuthenticatedAccounts parameter. To get the accounts that have passwords stored on the RODC, use the

  RevealedAccounts parameter.

  http://technet.microsoft.com/en-us/library/ee617194.aspx

• Question 359:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2003.

  You upgrade all domain controllers to Windows Server 2008 R2.

  You need to ensure that the Sysvol share replicates by using DFS Replication (DFS-R).

  What should you do?

  A. From the command prompt, run dfsutil /addroot:sysvol.
  B. From the command prompt, run netdom /reset.
  C. From the command prompt, run dcpromo /unattend:unattendfile.xml.
  D. Raise the functional level of the domain to Windows Server 2008 R2.
  D. Raise the functional level of the domain to Windows Server 2008 R2.

  ---

  http://technet.microsoft.com/en-us/library/cc794837%28v=ws.10%29.aspx Introduction to Administering DFS-Replicated SYSVOL

  SYSVOL is a collection of folders that contain a copy of the domain's public files, including system policies, logon scripts, and important elements of Group Policy objects (GPOs). The SYSVOL directory must be present and the appropriate

  subdirectories must be shared on a server before the server can advertise itself on the network as a domain controller. Shared subdirectories in the SYSVOL tree are replicated to every domain controller in the domain.

  Note:

  For Group Policy, only the Group Policy template (GPT) is replicated through SYSVOL replication.

  The Group Policy container (GPC), which is stored in the domain, is replicated through Active Directory replication. For Group Policy to be effective, both parts must be available on a domain controller. Using DFS Replication for replicating

  SYSVOL in Windows Server 2008 Distributed File System (DFS) Replication is a replication service that is available for replicating SYSVOL to all domain controllers in domains that have the Windows Server 2008 domain functional level.

  DFS Replication was introduced in Windows Server 2003 R2. However, on domain controllers that are running Windows Server 2003 R2, SYSVOL replication is performed by the File Replication Service (FRS).

• Question 360:

  Your company has a main office and a branch office.

  The network contains an Active Directory forest. The forest contains three domains. The branch office contains one domain controller named DC5. DC5 is configured as a global catalog server, a DHCP server, and a file server.

  You remove the global catalog from DC5.

  You need to reduce the size of the Active Directory database on DC5.

  The solution must minimize the impact on all users in the branch office.

  What should you do first?

  A. Start DC5 in Safe Mode.
  B. Start DC5 in Directory Services Restore Mode.
  C. On DC5, start the Protected Storage service.
  D. On DC5, stop the Active Directory Domain Services service.
  D. On DC5, stop the Active Directory Domain Services service.

  ---

  http://allcomputers.us/windows_server/windows-server-2008-r2---manage-the-active-directory- database-%28part-2%29---defragment-the-directory-database---audit-active-directory-service.aspx Windows Server 2008 R2 : Manage the Active Directory Database (part 2) - Defragment the Directory Database and Audit Active Directory Service

  3. Defragment the Directory Database A directory database gets fragmented as you add, change, and delete objects to your database. Like any file systembased storage, as the directory database is changed and updated, fragments of disk space will build up so it needs to be defragmented on a routine basis to maintain optimal operation. By default, Active Directory performs an online defragmentation of the directory database every 12 hours with the garbage collection process, an automated directory database cleanup, and IT pros should be familiar with it. However, online defragmentation does not decrease the size of the NTDS.DIT database file. Instead, it shuffles the data around for easier access. Depending on how much fragmentation you actually have in the database, running an offline defragmentation--which does decrease the size of the database--could have a significant effect on the overall size of your NTDS.DIT database file. There is a little problem associated with defragmenting databases. They have to be taken offline in order to have the fragments removed and the database resized. In Windows Server 2008 R2, there is a great feature that allows you to take the database offline without shutting down the server. It's called Restartable Active Directory, and it could not be much easier to stop and start your directory database than this. Figure 4 shows the Services tool and how you can use it to stop the Active Directory service.

  1.

  Start the Services tool from the Control Panel.

  2.

  Right-click Active Directory Domain Services, and select Stop.

  

  Figure 4. You can use the Services tool to stop and restart Active Directory. That's it! Now when you stop Active Directory Domain Services, any other dependent services will also be stopped. Keep in mind that while the services are stopped, they cannot fulfill their assigned role in your network. The really cool thing about Restartable AD is that while the directory services and its dependent services are stopped, other services on the local machine are not. So, perhaps you have a shared printer running on your DC. Print services still run, and print operations do not stop. Nice! 3.1. Offline Directory Defragmentation Now that you have stopped Active Directory services, it is time to get down to the business of offline defragmentation of the directory database:

  1.

  Back up the database.

  2.

  Open a command prompt, and type NTDSUTIL.

  3.

  Type ACTIVATE INSTANCE NTDS.

  4.

  Type FILES, and press Enter.

  5.

  Type INFO, and press Enter. This will tell you the current location of the directory database, its size, and the size of the associated log files. Write all this down.

  6.

  Make a folder location that has enough drive space for the directory to be stored.

  7.

  Type COMPACT TO DRIVE:\DIRECTORY, and press Enter. The drive and directory are the locations you set up in step 5. If the drive path contains spaces, put the whole path in quotation marks, as in "C:\database defrag". A new defragmented and compacted NTDS.DIT is created in the folder you specified.

  8.

  Type QUIT, and press Enter.

  9.

  Type QUIT again, and press Enter to return to the command prompt. 10.If defragmentation succeeds without errors, follow the NTDSUTIL prompts. 11.Delete all log files by typing DEL x:\pathtologfiles\*.log where x is the drive letter of your drive. 12.Overwrite the old NTDS.DIT file with the new one. Remember, you wrote down its location in step 4. 13.Close the command prompt. 14.Open the Services tool, and start Active Directory Domain Services. Defragmenting your directory database using the offline NTDSUTIL process can significantly reduce the size of your database depending on how long it has been since your last offline defrag. The hard thing about offline defrag is that every network is different, so making recommendations about how often to use the offline defrag process is somewhat spurious. I recommend you get to know your directory database. Monitor its size and growth. When you think it is appropriate to defragment offline, then do it. A pattern will emerge for you, and you will find yourself using offline defragmentation on a frequency that works well for your network and your directory database. One of the cool things about offline defragmentation is that if you should happen to have an error occur during the defragmentation process, you still have your original NTDS.DIT database in place and can continue using it with no problems until you can isolate and fix any issues.