Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 381:

  Your network contains an Active Directory forest named contoso.com. The forest contains two domains named contoso.com and fabrikam.com. The relevant domain controllers are configured as shown in the following table.

  

  You need to configure the zone storage settings for each zone. The solution must meet the following requirements:

  The contoso.com zone must be replicated to all of the domain controllers in the domain.

  The fabrikam.com zone must be replicated to all of the domain controllers in the forest that have the DNS Server server role installed.

  In the table below, identify in which partition each zone must be stored. Make only one selection in each column. Each correct selection is worth one point.

  Hot Area:

  

  

• Question 382:

  Your network contains an Active Directory forest named adatum.com. The DNS infrastructure fails.

  You rebuild the DNS infrastructure.

  You need to force the registration of the Active Directory Service Locator (SRV) records in DNS.

  Which service should you restart on the domain controllers?

  A. Netlogon
  B. DNS Server
  C. Network Location Awareness
  D. Network Store Interface Service
  E. Online Responder Service
  A. Netlogon

  ---

  Reference: MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 62 The SRV resource records for a domain controller are important in enabling clients to locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a domain controller is restarted. You can also re-register a domain controller's SRV resource records by restarting this service from the Services branch of Server Manager or by typing net start netlogon. An exam question might ask you how to troubleshoot the nonregistration of SRV resource records.

• Question 383:

  Your network contains an Active Directory forest named contoso.com. You need to identify whether a fine-grained password policy is applied to a specific group. Which tool should you use?

  A. Group Policy Management Editor
  B. Authorization Manager
  C. Local Security Policy
  D. ADSI Edit
  A. Group Policy Management Editor

• Question 384:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to receive a notification when more than 100 Active Directory objects are deleted per second.

  What should you do?

  A. Create custom views from Event Viewer.
  B. Run the Get-ADForest cmdlet.
  C. Run the ntdsutil.exe command.
  D. Configure the Active Directory Diagnostics Data Collector Set (DCS).
  E. Create a Data Collector Set (DCS).
  F. Run the dsamain.exe command.
  G. Run the dsquery.exe command.
  H. Run the repadmin.exe command.
  I. Configure subscriptions from Event Viewer.
  J. Run the eventcreate.exe command.
  E. Create a Data Collector Set (DCS).

  ---

  Reference: http://technet.microsoft.com/en-us/magazine/ff458614.aspx

  Configure Windows Server 2008 to Notify you when Certain Events Occur You can configure alerts to notify you when certain events occur or when certain performance thresholds are reached. You can send these alerts as network messages and as events that are logged in the application event log. You can also configure alerts to start applications and performance logs.

  To configure an alert, follow these steps:

  1.

  In Performance Monitor, under the Data Collector Sets node, right-click the User-Defined node in the left pane, point to New, and then choose Data Collector Set.

  2.

  (...)

  3.

  In the Performance Counters panel, select the first counter, and then use the Alert When Value Is text box to set the occasion when an alert for this counter is triggered. Alerts can be triggered when the counter is above or below a specific value. Select Above or Below, and then set the trigger value. The unit of measurement is whatever makes sense for the currently selected counter or counters. For example, to generate an alert if processor time is over 95 percent, select Over, and then type 95. Repeat this process to configure other counters you've selected.

• Question 385:

  Your network contains two standalone servers named Server1 and Server2 that have Active Directory Lightweight Directory Services (AD LDS) installed.

  Server1 has an AD LDS instance.

  You need to ensure that you can replicate the instance from Server1 to Server2.

  What should you do on both servers?

  A. Obtain a server certificate.
  B. Import the MS-User.ldf file.
  C. Create a service user account for AD LDS.
  D. Register the service location (SRV) resource records.
  C. Create a service user account for AD LDS.

  ---

  http://technet.microsoft.com/en-us/library/cc794857%28v=ws.10%29.aspx Administering AD LDS Instances

  Each AD LDS instance runs as an independent--and separately administered--service on a computer. You can configure the account under which an AD LDS instance runs, stop and restart an AD LDS instance, and change the AD LDS instance service display name and service description. In addition, you can enable Secure Sockets Layer (SSL) connections in AD LDS by installing certificates. In Active Directory environments, each AD LDS instance attempts to create a Service Principal Name (SPN) object in the directory to be used for replication authentication. Depending on the network environment into which you install AD LDS, you may have to create SPNs manually.

  AD LDS service account The service account that an AD LDS instance uses determines the access that the AD LDS instance has on the local computer and on other computers in the network. AD LDS instances also use the service account to authenticate other AD LDS instances in their configuration set, to ensure replication security. You determine the AD LDS service account during AD LDS installation.

• Question 386:

  Your network contains an Active Directory domain named contoso.com. Contoso.com contains two sites named Site1 and Site2. Site1 contains a domain controller named DC1.

  In Site1, you install a new domain controller named DC2. You ship DC2 to Site2.

  You discover that certain users in Site2 authenticate to DC1. You need to ensure that the users in Site2 always attempt to authenticate to DC2 first.

  What should you do?

  A. From Active Directory Users and Computers, modify the Location settings of the DC2 computer object.
  B. From Active Directory Sites and Services, modify the Location attribute for Site2.
  C. From Active Directory Sites and Services, move the DC2 server object.
  D. From Active Directory Users and Computers, move the DC2 computer object.
  C. From Active Directory Sites and Services, move the DC2 server object.

  ---

  DC2 may be shipped to Site2, but it's not yet associated properly with Site2 in Active Directory.

  Reference1: http://technet.microsoft.com/en-us/library/cc816674.aspx To move a server object to a new site

  1.

  Open Active Directory Sites and Services.

  2.

  In the console tree, expand Sites and the site in which the server object resides.

  3.

  Expand Servers to display the domain controllers that are currently configured for that site.

  4.

  Right-click the server object that you want to move, and then click Move.

  5.

  In Site Name, click the destination site, and then click OK.

  6.

  Expand the site object to which you moved the server, and then expand the Servers container.

  7.

  Verify that an object for the server that you moved exists.

  8.

  Expand the server object, and verify that an NTDS Settings object exists.

  Reference2:

  http://technet.microsoft.com/en-us/library/cc754697.aspx

  Using sites

  Sites help facilitate several activities, including:

  (...)

  Authentication. Site information helps make authentication faster and more efficient. When a client logs on to a domain, it first requests a domain controller in its local site for authentication. By establishing sites, you can ensure that clients use

  domain controllers that are nearest to them for authentication, which reduces authentication latency and traffic on wide area network (WAN) connections.

• Question 387:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit. (Click the Exhibit button.)

  

  You have a Group Policy object (GPO) linked to the domain. The GPO is used to deploy a number of software packages.

  You need to ensure that the GPO is applied only to client computers that have sufficient free disk space.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Modify the Group Policy permissions.
  G. Enable block inheritance.
  H. Configure the link order.
  I. Enable loopback processing in merge mode.
  J. Enable loopback processing in replace mode.
  F. Modify the Group Policy permissions.

• Question 388:

  You are decommissioning a child domain. The child domain contains five operations master roles.

  You need to transfer the forest operations master roles to a newly installed domain controller in a different child domain.

  Which two domain operations master roles should you transfer? (Each correct answer presents part of the solution. Choose two.)

  A. RID master
  B. PDC emulator
  C. Schema master
  D. Domain naming master
  E. Infrastructure master
  C. Schema master
  D. Domain naming master

  ---

  Forestwide Operations Master Roles

  The schema master and domain naming master are forestwide roles, meaning that there is only one schema master and one domain naming master in the entire forest.

  Note:

  *

  Operations Master Roles

  The five operations master roles are assigned automatically when the first domain controller in a given domain is created. Two forest-level roles are assigned to the first domain controller created in a forest and three domain-level roles are

  assigned to the first domain controller created in a domain.

  *

  The five FSMO roles [in Windows 2003] are:

  Schema master - Forest-wide and one per forest.

  Domain naming master - Forest-wide and one per forest.

  RID master - Domain-specific and one for each domain.

  PDC - PDC Emulator is domain-specific and one for each domain. Infrastructure master - Domain-specific and one for each domain.

• Question 389:

  You have a single Active Directory domain. All domain controllers run Windows Server 2008 and are configured as DNS servers.

  The domain contains one Active Directory-integrated DNS zone. You need to ensure that outdated DNS records are automatically removed from the DNS zone.

  What should you do?

  A. From the properties of the zone, modify the TTL of the SOA record.
  B. From the properties of the zone, enable scavenging.
  C. From the command prompt, run ipconfig /flushdns.
  D. From the properties of the zone, disable dynamic updates.
  B. From the properties of the zone, enable scavenging.

  ---

  http://technet.microsoft.com/en-us/library/cc753217.aspx Set Aging and Scavenging Properties for the DNS Server

  The DNS Server service supports aging and scavenging features. These features are provided as a mechanism for performing cleanup and removal of stale resource records, which can accumulate in zone data over time. You can use this

  procedure to set the default aging and scavenging properties for the zones on a server.

  Further information:

  http://technet.microsoft.com/en-us/library/cc771677.aspx Understanding Aging and Scavenging

• Question 390:

  Your network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA). You need to deploy certificates based on Version 1 templates to all of the computers in the domain. The

  solution must minimize administrative effort.

  You create a Group Policy object (GPO) named GPO1 and link the GPO to the domain.

  What should you do next?

  A. In GPO1, configure Certificate Services Client - Certificate Enrollment Policy.
  B. In GPO1, configure Automatic Certificate Request Settings.
  C. In GPO1, configure Software installation.
  D. Duplicate the templates. In GPO1, configure Software installation.
  B. In GPO1, configure Automatic Certificate Request Settings.

  ---

  Automatic certificate request settings Certificate enrollment is the process of requesting, receiving, and installing a certificate. By using automatic certificate settings in public key policies, you can have computers that are associated with a Group Policy object (GPO) automatically enroll for certificates. This can save you the step of explicitly enrolling for computer-related certificates for each computer. After you establish an automatic certificate request, the actual certificate requests occur the next time the computers associated with the GPO log on to the network.