Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 31:

  Your network contains an Active Directory domain named contoso.com.

  You need to identify whether the Active Directory Recycle Bin is enabled.

  What should you do?

  A. From Ldp, search for the Reanimate-Tombstones object.
  B. From Ldp, search for the LostAndFound container.
  C. From Windows PowerShell, run the Get-ADObject cmdlet.
  D. From Windows PowerShell, run the Get-ADOptionalFeature cmdlet.
  D. From Windows PowerShell, run the Get-ADOptionalFeature cmdlet.

  ---

  Reference:

  http://www.frickelsoft.net/blog/?p=224

  How can I check whether the AD Recycle-Bin is enabled in my R2 forest? [He shows how to use the PowerShell cmdlet Get- ADOptionalFeature to determine if the AD Recycle Bin is enabled.]

• Question 32:

  Domains provide which of the following functions?

  A. Creating logical boundaries
  B. Easing the administration of users, groups, computers, and other objects
  C. Providing a central database of network objects
  D. All of the above
  D. All of the above

  ---

  http://technet.microsoft.com/en-us/library/cc756901%28v=ws.10%29.aspx Active Directory Logical Structure Background Information Before you design your Active Directory logical structure, it is important to understand the Active Directory logical model. Active Directory is a distributed database that stores and manages information about network resources, as well as application-specific data from directory enabled applications. Active Directory allows administrators to organize elements of a network (such as users, computers, devices, and so on) into a hierarchical containment structure. The top-level container is the forest. Within forests are domains, and within domains are organizational units. This is called the logical model because it is independent of the physical aspects of the deployment, such as the number of domain controllers required within each domain and network topology. Figure 2.2 Relationship Between Active Directory Forests, Domains, and OUs.

  

• Question 33:

  Your network contains an Active Directory domain.

  You create and mount an Active Directory snapshot.

  You run dsamain.exe as shown in the exhibit. (Click the Exhibit button.)

  

  You need to ensure that you can browse the contents of the Active Directory snapshot. What should you?

  A. Stop Active Directory Domain Services (AD DS), and then rerun dsamain.exe.
  B. Change the value of the dbpath parameter, and then rerun dsamain.exe.
  C. Change the value of the ldapport parameter, and then rerun dsamain.exe.
  D. Restart the Volume Shadow Copy Service (VSS), and then rerun dsamain.exe.
  B. Change the value of the dbpath parameter, and then rerun dsamain.exe.

  ---

  The path in the exhibit points to the running Active Directory database, not to the snapshot.

  Reference:

  http://technet.microsoft.com/en-us/library/cc772168.aspx

  For the dbpath parameter, you must specify a mounted snapshot or a backup that you want to view along with the complete path to the Ntds.dit file, for example:

  /dbpath E:\$SNAP_200704181137_VOLUMED$\WINDOWS\NTDS\ntds.dit

• Question 34:

  Your network contains a single Active Directory domain. The domain contains five read-only domain controllers (RODCs) and five writable domain controllers. All servers run Windows Server 2008.

  You plan to install a new read-only domain controllerRODC that runs Windows Server 2008 R2. You need to ensure that you can add the new RODC to the domain.You want to achieve this goal by using the minimum amount of administrative effort.

  Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

  A. At the command prompt, run adprep.exe /rodcprep.
  B. At the command prompt, run adprep.exe /forestprep.
  C. At the command prompt, run adprep.exe /domainprep.
  D. From Active Directory Domains and Trusts, raise the functional level of the domain.
  E. From Active Directory Users and Computers, pre-stage the RODC computer account.
  B. At the command prompt, run adprep.exe /forestprep.
  C. At the command prompt, run adprep.exe /domainprep.

• Question 35:

  Your network contains an Active Directory domain. The domain contains five sites. One of the sites contains a read-only domain controller (RODC) named RODC1.

  You need to identify which user accounts can have their password cached on RODC1.

  Which tool should you use?

  A. Ntdsutil
  B. Dcdiag
  C. Repadmin
  D. Get-ADAccountResultantPasswordReplicationPolicy
  A. Ntdsutil

• Question 36:

  Your network contains an Active Directory domain named contoso.com.

  You need to create one password policy for administrators and another password policy for all other users.

  Which tool should you use?

  A. Group Policy Management Editor
  B. Group Policy Management Console (GPMC)
  C. Authorization Manager
  D. Ldifde
  D. Ldifde

  ---

  Reference: http://technet.microsoft.com/en-US/library/cc754461.aspx

  Creating a PSO using ldifde You can use the ldifde command as a scriptable alternative for creating PSOs. To create a PSO using ldifde

  1.

  Define the settings of a new PSO by saving the following sample code as a file, for example, pso.ldf: dn: CN=PSO1, CN=Password Settings Container,CN=System,DC=dc1,DC=contoso,DC=com changetype: add objectClass: msDS-PasswordSettings msDS-MaximumPasswordAge:-1728000000000 msDS-MinimumPasswordAge:-864000000000 msDS-MinimumPasswordLength:8 msDS-PasswordHistoryLength:24 msDS-PasswordComplexityEnabled:TRUE msDS-PasswordReversibleEncryptionEnabled:FALSE msDS-LockoutObservationWindow:-18000000000 msDS-LockoutDuration:-18000000000 msDS-LockoutThreshold:0 msDS-PasswordSettingsPrecedence:20

  msDS-PSOAppliesTo:CN=user1,CN=Users,DC=dc1,DC=contoso,DC=com

  2.

  Open a command prompt. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  3.

  Type the following command, and then press ENTER: ldifde i f pso.ldf

• Question 37:

  Your company has three Active Directory domains in a single forest. You install a new Active Directory enabled application. The application ads new user attributes to the Active Directory schema.

  You discover that the Active Directory replication traffic to the Global Catalogs has increased.

  You need to prevent the new attributes from being replicated to the Global Catalog.

  You must achieve this goal without affecting application functionality.

  What should you do?

  A. Change the replication interval for the DEFAULTIPSITELINK object to 9990.
  B. Change the cost for the DEFAULTIPSITELINK object to 9990.
  C. Make the new attributes in the Active Directory as defunct.
  D. Modify the properties in the Active Directory schema for the new attributes.
  D. Modify the properties in the Active Directory schema for the new attributes.

  ---

  http://support.microsoft.com/kb/248717

  How to Modify Attributes That Replicate to the Global Catalog The Global Catalog (GC) contains a partial replica of every object in the enterprise. This article discusses how to manipulate the attributes which make up the set values replicated to the GC. Deciding which attributes will replicate (in addition to the default attributes) requires careful planning with consideration for network traffic and necessary disk space. Before describing how to set an attribute to replicate in the GC, it is important to note the effects this has on network replication traffic. After an attributeSchema object is created, marking an additional attribute to replicate to the GC causes a full replication (also known as a "full sync") of all objects to the GC as described below. This behavior occurs on the versions of Windows 2000 listed in this article. Every server has a full and write-able copy of its own domain. If that server is also a GC, the remaining domains in the forest are held as read-only, partial copies. "Partial" means that only a subset of the attributes is kept. When an attribute is added to the GC, it is added to the partial copy subset (partial attribute set). This causes the GC to perform a "full sync" of all the read-only copies again to repopulate itself with only the partial attributes that it needs to hold. This full sync occurs even if the attribute property isMemberOfPartialAttributeSet is set to "True." Thus, it only does a full sync on the read-only partial copy domains and not its own write-able domain, the configuration directory partition or schema directory partition. In order to modify the attributes that replicate to the Active Directory GC, you must modify the schema. To modify the schema, an administrator must be made a member of the "Schema Admins" group. In addition to being a member of this group, a registry key must be set on the Schema master.

• Question 38:

  Your network contains an Active Directory domain named contoso.com. A partner company has an Active Directory domain named nwtraders.com. The networks for contoso.com and nwtraders.com connect to each other by using a WAN link. You need to ensure that users in contoso.com can access resources in nwtraders.com and resources on the Internet.

  What should you do first?

  A. Modify the Trusted Root Certification Authorities store.
  B. Modify the Intermediate Certification Authorities store.
  C. Create conditional forwarders.
  D. Add a root hint to the DNS server.
  C. Create conditional forwarders.

  ---

  Reference:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) pages 114-115

  Conditional Forwarders

  You can configure a DNS server as a conditional forwarder. This is a DNS server that handles name resolution for specified domains only. In other words, the local DNS server will forward all the queries that it receives for names ending with

  a specific domain name to the conditional forwarder. This is especially useful in situations where users in your company need access to resources in another company with a separate AD DS forest and DNS zones, such as a partner

  company.

  In such a case, specify a conditional forwarder that directs such queries to the DNS server in the partner company while other queries are forwarded to the Internet. Doing so reduces the need for adding secondary zones for partner

  companies on your DNS servers.

• Question 39:

  You have an enterprise subordinate certification authority (CA) configured for key archival. Three key recovery agent certificates are issued. The CA is configured to use two recovery agents. You need to ensure that all of the recovery agent certificates can be used to recover all new private keys.

  What should you do?

  A. Add a data recovery agent to the Default Domain Policy.
  B. Modify the value in the Number of recovery agents to use box.
  C. Revoke the current key recovery agent certificates and issue three new key recovery agent certificates.
  D. Assign the Issue and Manage Certificates permission to users who have the key recovery agent certificates.
  B. Modify the value in the Number of recovery agents to use box.

  ---

  Reference: MS Press - Self-Paced Training Kit (Exams 70-648 and 70-649) (Microsoft Press, 2009) page 357 You enable key archival on the Recovery Agents tab of the CA Properties in the CA console by selecting the Archive The Key option and specifying a key recovery agent. In the number of recovery agents to use, select the number of key recovery agent (KRA) certificates you have added to the CA. This ensures that each KRA can be used to recover a private key. If you specify a smaller number than the number of KRA certificates installed, the CA will randomly select that number of KRA certificates from the available total and encrypt the private key, using those certificates. This complicates recovery because you then have to figure out which recovery agent certificate was used to encrypt the private key before beginning recovery.

• Question 40:

  Your network contains an Active Directory forest named adatum.com. The forest contains four child domains named europe.adatum.com, northamerica.adatum.com, asia.adatum.com, and africa.adatum.com.

  You need to create four new groups in the forest root domain. The groups must be configured as shown in the following table.

  

  What should you do?

  To answer, drag the appropriate group type to the correct group name in the answer area.

  Select and Place:

  

  

  ---

  Reference:

  Windows Server 2008 R2 Unleashed (SAMS, 2010) page 128

  Domain local groups

  Domain local groups are essentially the same thing as local groups in Windows NT, and are used to administer resources located only on their own domain. They can contain users and groups from any other trusted domain. Most typically,

  these types of groups are used to grant access to resources for groups in different domains.

  Global groups Global groups are on the opposite side from domain local groups. They can contain users only in the domain in which they exist but are used to grant access to resources in other trusted domains. These types of groups are

  best used to supply security membership to user accounts that share a similar function, such as the sales global group.

  Universal groups

  Universal groups can contain users and groups from any domain in the forest and can grant access to any resource in the forest. Along with this added power come a few caveats. First,

  universal groups are available only in domains with a functional level of Windows 2000 Native or later. Second, all members of each universal group are stored in the global catalog, increasing the replication load. It is important to note,

  however, that universal group membership replication has been noticeably streamlined and optimized in Windows Server 2008 R2 because the membership is incrementally replicated.