Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 371:

  Your network contains 10 domain controllers that run Windows Server 2008 R2. The network contains a member server that is configured to collect all of the events that occur on the domain controllers.

  You need to ensure that administrators are notified when a specific event occurs on any of the domain controllers. You want to achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. From Event Viewer on the member server, create a subscription.
  B. From Event Viewer on each domain controller, create a subscription.
  C. From Event Viewer on the member server, run the Create Basic Task Wizard.
  D. From Event Viewer on each domain controller, run the Create Basic Task Wizard.
  C. From Event Viewer on the member server, run the Create Basic Task Wizard.

  ---

  Since the member server is collecting all domain controller events we just need to run the Create Basic Task Wizard on the member server, which enables us to send an e-mail when a specific event is logged. Running the wizard on every domain controller would work, but is much more work and we need to use the minimum amount of administrative effort.

  Reference: http://technet.microsoft.com/en-us/library/cc748900.aspx To Run a Task in Response to a Given Event

  1.

  Start Event Viewer.

  2.

  In the console tree, navigate to the log that contains the event you want to associate with a task.

  3.

  Right-click the event and select Attach Task to This Event.

  4.

  Perform each step presented by the Create Basic Task Wizard. In the Action step in the wizard you can decide to send an e-mail.

• Question 372:

  Your network contains an enterprise certification authority (CA) that runs Windows Server 2008 R2 Enterprise.

  You need to ensure that all of the members of a group named Group1 can view the event log entries for Certificate Services.

  Which snap-in should you use?

  A. Certificate Templates
  B. Certification Authority
  C. Authorization Manager
  D. Active Directory Users and Computers
  E. TPM Management
  F. Security Templates
  G. Group Policy Management
  H. Enterprise PKI
  I. Certificates
  G. Group Policy Management

  ---

  We can make the Group1 group a member of the Event Log Readers Group, giving them read access to all event logs, thus including the Certificate Services events. We can do that by using Group Policy Management.

  Reference 1:

  It's a bit hard to find some good, clear reference for this. There's nothing wrong with doing it yourself, so here's what I did in VMWare, using a domain controller and a member server. Click along if you want!

  In VMWare I have setup a domain controller, DC01 and a member server MEM01, both belonging to the contoso.com domain. I have placed MEM01 in an OU named Events. I have created a global security group, named TESTGROUP, and

  I want to make it a member of the built-in Event Log Readers group on MEM01.

  1.

  Start the Group Policy Management console on DC01.

  2.

  Right-click the Events OU and choose "Create a GPO in this domain, and Link it here..."

  3.

  I named the GPO "EventLog_TESTGROUP"

  4.

  Right-click the "EventLog_TESTGROUP" GPO and choose "Edit..."

  5.

  Go to Computer Configuration \ Policies\ Windows Settings \ Security Settings and select "Restricted Groups"

  6.

  Right-click "Restricted Groups" and choose "Add Group..."

  7.

  Now there are two ways to do this. We can select TESTGROUP and make it a member of the Event Log Readers group, or we can select the Event Log Readers group and add TESTGROUP as a member. Let's do the second one. Click the Browse button and go find the Event Log Readers group. Click OK.

  8.

  Click the Browse button next to "Members of this group", search for the TESTGROUP group and add it.

  9.

  Click OK. gpupdate /force.

  10.

  On MEM01 open a command prompt and run

  11.

  Check the Event Log Readers group properties and see that the TESTGROUP group is now a member.

  It should look like this now:

  

  

  Reference 2:

  http://blogs.technet.com/b/janelewis/archive/2010/04/30/giving-non-administrators-permission-to-read-event- logs-windows-2003-and-windows-2008.aspx

  Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

  So if you want to give Non-Administrator users access remotely to Event logs if the Servers or Domain Controllers they are accessing are Windows 2003 follow the steps below.

  (...)

  Windows 2008 is much easier as long as you are giving the users and groups in question read access to all event logs. If that is the case just add them to the Built in Event Log Readers group.

• Question 373:

  Your network contains an Active Directory forest. The forest contains two domains. The forest contains four domain controllers. The domain controllers are configured as shown in the following table.

  

  All user accounts are located in the child.contoso.com domain. Users in the child.contoso.com domain are members of several security groups in the contoso.com domain.

  Your company decides to change the naming standard of user accounts. You rename all of the user accounts to comply with the new standard. You discover that the old user names are listed in the members' list of the security groups in the

  contoso.com domain.

  You need to ensure that the members' list of the security groups in the contoso.com domain displays the new user names.

  What should you do?

  A. Transfer the PDC emulator role from DC2 to DC3.
  B. Configure DC5 as a global catalog server.
  C. Configure DC1 as a global catalog server.
  D. Transfer the infrastructure master role from DC3 to DC2.
  D. Transfer the infrastructure master role from DC3 to DC2.

• Question 374:

  Your company has an Active Directory domain and an organizational unit. The organizational unit is named Web.

  You configure and test new security settings for Internet Information Service (IIS) Servers on a server named IISServerA.

  You need to deploy the new security settings only on the IIS servers that are members of the Web organizational unit.

  What should you do?

  A. Run secedit /configure /db iis.inf from the command prompt on IISServerA, then run secedit /configure /db webou.inf from the comand prompt.
  B. Export the settings on IISServerA to create a security template. Import the security template into a GPO and link the GPO to the Web organizational unit.
  C. Export the settings on IISServerA to create a security template. Run secedit /configure /db webou.inf from the comand prompt.
  D. Import the hisecws.inf file template into a GPO and link the GPO to the Web organizational unit.
  B. Export the settings on IISServerA to create a security template. Import the security template into a GPO and link the GPO to the Web organizational unit.

  ---

  http://www.itninja.com/blog/view/using-secedit-to-apply-security-templates Using Secedit To Apply Security Templates

  Secedit /configure /db secedit.sdb /cfg"c:\temp\custom.inf" /silent >nul This command imports a security template file, "custom.inf" into the workstation's or server's local security database. /db must be specified. When specifying the default secuirty database (secedit.sdb,) I found that providing no path worked best. The /cfg option informs Secedit that it is to import the .inf file into the specified database, appending it to any existing .inf files that have already been imported to this system. You can optionally include an /overwrite switch to overwrite all previous configurations for this machine. The /silent option supresses any pop-ups and the >nul hides the command line output stating success or failure of the action.

• Question 375:

  Your network contains an Active Directory domain named adatum.com.

  The password policy of the domain requires that the passwords for all user accounts be changed every 50 days.

  You need to create several user accounts that will be used by services. The passwords for these accounts must be changed automatically every 50 days.

  Which tool should you use to create the accounts?

  A. Active Directory Administrative Center
  B. Active Directory Users and Computers
  C. Active Directory Module for Windows PowerShell
  D. ADSI Edit
  E. Active Directory Domains and Trusts
  C. Active Directory Module for Windows PowerShell

  ---

  Use the New-ADServiceAccount cmdlet in PowerShell to create the new accounts as managed service accounts. Managed service accounts offer Automatic password management, making password management easier.

  Reference 1:

  http://technet.microsoft.com/en-us/library/dd367859.aspx

  What are the benefits of new service accounts?

  In addition to the enhanced security that is provided by having individual accounts for critical services, there are four important administrative benefits associated with managed service accounts:

  (...)

  Unlike with regular domain accounts in which administrators must reset passwords manually, the network passwords for these accounts will be reset automatically.

  (...)

  Reference 2:

  http://technet.microsoft.com/en-us/library/dd391964.aspx

  Use the Active Directory module for Windows PowerShell to create a managed service account.

  Reference 3:

  http://technet.microsoft.com/en-us/library/dd548356.aspx

  To create a new managed service account

  1.

  On the domain controller, click Start, and then click Run. In the Open box, type dsa.msc, and then click OK to open the Active Directory Users and Computers snap-in. Confirm that the Managed Service Account container exists.

  2.

  Click Start, click All Programs, click Windows PowerShell 2.0, and then click the Windows PowerShell icon.

  3.

  Run the following command: New-ADServiceAccount [-SAMAccountName ] [-Path ].

  Reference 4:

  http://technet.microsoft.com/en-us/library/hh852236.aspx

  Use the -ManagedPasswordIntervalInDays parameter with New-ADServiceAccount to specify the number of days for the password change interval.

  -ManagedPasswordIntervalInDaysSpecifies the number of days for the password change interval. If set to 0 then the default is used. This can only be set on object creation. After that the setting is read only. This value returns the

  msDSManagedPasswordInterval of the group managed service account object.

  The following example shows how to specify a 90 day password changes interval:

  -ManagedPasswordIntervalInDays 90

• Question 376:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit. (Click the Exhibit button.)

  

  Each organizational unit (OU) contains over 500 user accounts. The Finance OU and the Human Resources OU contain several user accounts that are members of a universal group named Group1.

  You have a Group Policy object (GPO) linked to the domain.

  You need to prevent the GPO from being applied to the members of Group1 only.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the GPO to the Finance OU.
  J. Link the GPO to the Human Resources OU.
  A. Modify the Group Policy permissions.

  ---

  "GPOs are linked to OUs, not groups. Block inhertance blocks all inherited GPOs from being applied to the OU. The security filter will only help you specify groups.

  So you have two choices. You could remove authenticated users in the secuirty filter and add groups containing everyone except group1 members(messy solution) or you could leave authenticated users there, and specify group1 with deny

  apply gpo permission for the gpo(since deny will alwys win over allow)."

  The reference below explains a situation where the GPO only needs to be applied to one group, it's the other way around so to speak.

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 285, 286 Using Security Filtering to Modify GPO Scope

  By now, you've learned that you can link a GPO to a site, domain, or OU. However, you might need to apply GPOs only to certain groups of users or computers rather than to all users or computers within the scope of the GPO. Although you

  cannot directly link a GPO to a security group, there is a way to apply GPOs to specific security groups. The policies in a GPO apply only to users who have Allow Read and Allow Apply Group Policy permissions to the GPO.

  Each GPO has an access control list (ACL) that defines permissions to the GPO. Two permissions, Allow Read and Allow Apply Group Policy, are required for a GPO to apply to a user or computer. If a GPO is scoped to a computer (for

  example, by its link to the computer's OU), but the computer does not have Read and Apply Group Policy permissions, it will not download and apply the GPO. Therefore, by setting the appropriate permissions for security groups, you can

  filter a GPO so that its settings apply only to the computers and users you specify.

  Filtering a GPO to Apply to Specific Groups

  To apply a GPO to a specific security group, perform the following steps:

  4.

  Select the GPO in the Group Policy Objects container in the console tree.

  5.

  In the Security Filtering section, select the Authenticated Users group and click Remove.

  6.

  Click OK to confirm the change.

  7.

  Click Add.

  8.

  Select the group to which you want the policy to apply and click OK.

• Question 377:

  Your network contains two Active Directory forests named contoso.com and fabrikam.com. A two-way forest trust exists between the forests. Selective authentication is enabled on the trust.

  Fabrikam.com contains a server named Server1.

  You assign Contoso\Domain Users the Manage documents permission and the Print permission to a shared printer on Server1.

  You discover that users from contoso.com cannot access the shared printer on Server1. You need to ensure that the contoso.com users can access the shared printer on Server1.

  Which permission should you assign to Contoso\Domain Users.

  To answer, select the appropriate permission in the answer area.

  Hot Area:

  

  

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc816733.aspx

  Grant the Allowed to Authenticate Permission on Computers in the Trusting Domain or Forest For users in a trusted Windows Server 2008 or Windows Server 2003 domain or forest to be able to access resources in a trusting Windows Server 2008 or Windows Server 2003 domain or forest where the trust authentication setting has been set to selective authentication, each user must be explicitly granted the Allowed to Authenticate permission on the security descriptor of the computer objects (resource computers) that reside in the trusting domain or forest.

• Question 378:

  Your company has an Active Directory forest. The forest includes organizational units corresponding to the following four locations:

  

  London

  

  Chicago

  

  New York

  

  Madrid

  Each location has a child organizational unit named Sales. The Sales organizational unit contains all the users and computers from the sales department.

  The offices in London, Chicago, and New York are connected by T1 connections. The office in Madrid is connected by a 256-Kbps ISDN connection.

  You need to install an application on all the computers in the sales department. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. Create a Group Policy Object (GPO) named OfficeInstall that assigns the application to users. Link the GPO to each Sales organizational unit.
  B. Disable the slow link detection setting in the Group Policy Object (GPO).
  C. Configure the slow link detection threshold setting to 1,544 Kbps (T1) in the Group Policy Object (GPO).
  D. Create a Group Policy Object (GPO) named OfficeInstall that assigns the application to the computers. Link the GPO to each Sales organizational unit.
  B. Disable the slow link detection setting in the Group Policy Object (GPO).
  D. Create a Group Policy Object (GPO) named OfficeInstall that assigns the application to the computers. Link the GPO to each Sales organizational unit.

  ---

  http://technet.microsoft.com/en-us/library/cc781031%28v=ws.10%29.aspx Specifying Group Policy for Slow Link Detection

  Administrators can partially control which Group Policy extensions are processed over a slow link. By default, when processing over a slow link, not all components of Group Policy are processed. Table 2.6 shows the default settings for processing Group Policy over slow links.

  

  Administrators can use a Group Policy setting to define a slow link for the purposes of applying and updating Group Policy. The default value defines a rate slower than 500 Kbps as a slow link. http://technet.microsoft.com/en-us/library/

  cc783635%28v=ws.10%29.aspx Assigning and Publishing Software

  ..

  Assigning software to computers

  After you assign a software package to computers in a site, domain, or OU, the software is installed the next time the computer restarts or the user logs on.

  Further information:

  http://technet.microsoft.com/en-us/library/cc978717.aspx Group Policy slow link detection

• Question 379:

  Your network contains an Active Directory domain. All DNS servers are domain controllers. You view the properties of the DNS zone as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that DNS records can only be updated by the computer that registered the record. What should you do first?

  A. Modify the Dynamic updates setting.
  B. Create a trust anchor.
  C. Modify the zone type.
  D. Modify the Advanced properties of the DNS server.
  C. Modify the zone type.

• Question 380:

  Your company has two Active Directory forests named contoso.com and fabrikam.com. The company network has three DNS servers named DNS1, DNS2, and DNS3. The DNS servers are configured as shown in the following table.

  

  All computers that belong to the fabrikam.com domain have DNS3 configured as the preferred DNS server. All other computers use DNS1 as the preferred DNS server.

  Users from the fabrikam.com domain are unable to connect to the servers that belong to the contoso.com domain.

  You need to ensure users in the fabrikam.com domain are able to resolve all contoso.com queries.

  What should you do?

  A. Configure conditional forwarding on DNS1 and DNS2 to forward fabrikam.com queries to DNS3.
  B. Create a copy of the _msdcs.contoso.com zone on the DNS3 server.
  C. Create a copy of the fabrikam.com zone on the DNS1 server and the DNS2 server.
  D. Configure conditional forwarding on DNS3 to forward contoso.com queries to DNS1.
  D. Configure conditional forwarding on DNS3 to forward contoso.com queries to DNS1.

  ---

  http://technet.microsoft.com/en-us/library/cc730756.aspx Understanding Forwarders

  A forwarder is a Domain Name System (DNS) server on a network that forwards DNS queries for external DNS names to DNS servers outside that network. You can also forward queries according to specific domain names using conditional forwarders.

  You designate a DNS server on a network as a forwarder by configuring the other DNS servers in the network to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution for names outside your network, such as names on the Internet, and improve the efficiency of name resolution for the computers in your network. The following figure illustrates how external name queries are directed with forwarders.

  

  Conditional forwarders A conditional forwarder is a DNS server on a network that forwards DNS queries according to the DNS domain name in the query. For example, you can configure a DNS server to forward all the queries that it receives for names ending with corp.contoso.com to the IP address of a specific DNS server or to the IP addresses of multiple DNS servers.