Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 391:

  A corporate network includes a single Active Directory Domain Services (AD DS) domain. All regular user accounts reside in an organizational unit (OU) named Employees. All administrator accounts reside in an OU named Admins.

  You need to ensure that any time an administrator modifies an employee's name in AD DS, the change is audited.

  What should you do first?

  A. Use the Auditpol.exe command-line tool to enable the directory services access auditing subcategory.
  B. Use the Auditpol.exe command-line tool to enable the directory services changes auditing subcategory.
  C. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Admins OU.
  D. Modify the searchFlags property for the Name attribute in the schema.
  B. Use the Auditpol.exe command-line tool to enable the directory services changes auditing subcategory.

• Question 392:

  Your network contains an Active Directory forest named adatum.com. All domain controllers currently run Windows Server 2003 Service Pack 2 (SP2). The functional level of the forest and the domain is Windows Server 2003.

  You need to deploy a read-only domain controller (RODC) that runs Windows Server 2008 R2.

  What should you do first?

  A. Deploy a writable domain controller that runs Windows Server 2008 R2.
  B. Raise the functional level of the forest to Windows Server 2008.
  C. Run adprep.exe.
  D. Raise the functional level of the domain to Windows Server 2003.
  C. Run adprep.exe.

  ---

  An RODC requires a writable domain controller running Windows Server 2008 or Windows Server 2008 R2.

  So, whether you install the writable domain controller first or the Windows Server 2008 R2 server (your future RODC), you have to run adprep.exe first to prepare the domain/forest for either domain controller.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731243.aspx

  Prerequisites for Deploying an RODC

  Complete the following prerequisites before you deploy a read-only domain controller (RODC):

  Ensure that the forest functional level is Windows Server 2003 or higher, so that linked-value replication

  (LVR) is available. This provides a higher level of replication consistency. The domain functional level must be Windows Server 2003 or higher, so that Kerberos constrained delegation is available. If the forest functional level is Windows

  Server 2003, the domain functional level of all domains in the forest is Windows Server 2003 or higher.

  Run Adprep.exe commands to prepare your existing forest and domains for domain controllers that run Windows Server 2008 or Windows Server 2008 R2. The adprep commands extend the Active Directory schema and update security

  descriptors so that you can add the new domain controllers. Deploy at least one writable domain controller running Windows Server 2008 or Windows Server 2008 R2 in the same domain as the RODC and ensure that the writable domain

  controller is also a DNS server that has registered a name server (NS) resource record for the relevant DNS zone. An RODC must replicate domain updates from a writable domain controller running Windows Server 2008 or Windows Server

  2008 R2.

• Question 393:

  You have an Active Directory domain named contoso.com.

  You have a domain controller named Server1 that is configured as a DNS server. Server1 hosts a standard primary zone for contoso.com. The Zone Aging/Scavenging Properties of the contoso.com zone are shown in the exhibit. (Click the Exhibit button.)

  

  You discover that stale resource records are not automatically removed from the contoso.com zone. You need to ensure that the stale resource records are automatically removed from the contoso.com zone.

  What should you do?

  A. Convert the contoso.com zone to an Active Directory-integrated zone.
  B. set the scavenging period of Server1 to 0 days.
  C. Configure the aging properties for the contoso.com zone.
  D. Modify the Server Aging/Scavenging properties.
  D. Modify the Server Aging/Scavenging properties.

• Question 394:

  Your network contains an Active Directory domain. The domain is configured as shown in the exhibit, (Click the Exhibit button.)

  

  You need to ensure that when users log on to client computers, they are added automatically to the local Administrators group.

  The users must be removed from the group when they log off of the client computers.

  What should you do?

  A. Modify the Group Policy permissions.
  B. Enable block inheritance.
  C. Configure the link order.
  D. Enable loopback processing in merge mode.
  E. Enable loopback processing in replace mode.
  F. Configure WMI filtering.
  G. Configure Restricted Groups.
  H. Configure Group Policy Preferences.
  I. Link the Group Policy object (GPO) to the Finance organizational unit (OU).
  J. Link the Group Policy object (GPO) to the Human Resources organizational unit (OU).
  H. Configure Group Policy Preferences.

  ---

  Reference:

  http://daniel.streefkerkonline.com/managing-local-admins-using-gpp/ http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/

• Question 395:

  Your network contains an Active Directory domain. The domain contains a domain controller named DC1 that runs Windows Server 208 R2 Service Pack 1 (SP1).

  You need to implement a central store for domain policy templates.

  What should you do? To answer, select the source content that should be copied to the destination folder in the answer area.

  Hot Area:

  

  

• Question 396:

  A corporate network contains a Windows Server 2008 R2 Active Directory forest.

  You need to add a User Principle Name (UPN) suffix to the forest.

  What tool should you use?

  A. Dsmgmt.
  B. Active Directory Domains and Trusts console.
  C. Active Directory Users and Computers console.
  D. Active Directory Sites and Services console.
  B. Active Directory Domains and Trusts console.

  ---

  Reference:

  http://www.kassapoglou.com/windows-server-2008-lesson-23-video-creating-a-user/

  Demonstration adding a UPN Suffix

  To add or modify a UPN suffix for your forest, open Active Directory Domains and Trusts from the start menu.

  Right click Active Directory Domains and Trusts at the top and open the properties. From here you can add and remove additional domain UPN suffixes for the forest.

• Question 397:

  Your company has two Active Directory sites named New York and Los Angeles.

  When you disable IPv4 on a computer in the Los Angeles site, the computer authenticates by using a domain controller in the New York site.

  You need to ensure that IPv6-only computers in the Los Angeles site authenticate to domain controllers in the same site.

  What should you do?

  A. Install an Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) router in the Los Angeles site.
  B. Create Active Directory Domain Services connection objects between the two sites.
  C. Create Active Directory subnet objects for the Los Angeles site.
  D. Configure the NTDS Site Settings object for the Los Angeles site.
  C. Create Active Directory subnet objects for the Los Angeles site.

• Question 398:

  You are decommissioning one of the domain controllers in a child domain.

  You need to transfer all domain operations master roles within the child domain to a newly installed domain controller in the same child domain.

  Which three domain operations master roles should you transfer? (Each correct answer presents part of the solution. Choose three.)

  A. RID master
  B. PDC emulator
  C. Schema master
  D. Infrastructure master
  E. Domain naming master
  A. RID master
  B. PDC emulator
  D. Infrastructure master

  ---

  http://technet.microsoft.com/en-us/library/cc781578%28v=ws.10%29.aspx Transferring operations master roles

  Transferring an operations master role means moving it from one domain controller to another with the cooperation of the original role holder. Depending upon the operations master role to be transferred, you perform the role transfer using one of the three Active Directory consoles in Microsoft Management Console (MMC).

  

• Question 399:

  Your network contains an Active Directory domain named contoso.com. You run nslookup.exe as shown in the following Command Prompt window.

  

  You need to ensure that you can use Nslookup to list all of the service location (SRV) resource records for contoso.com.

  What should you modify?

  A. the root hints of the DNS server
  B. the security settings of the zone
  C. the Windows Firewall settings on the DNS server
  D. the zone transfer settings of the zone
  D. the zone transfer settings of the zone

  ---

  http://www.c3.hu/docs/oreilly/tcpip/dnsbind/ch11_07.htm 11.7 Troubleshooting nslookup Problems

  11.7.4 Query Refused Refused queries can cause problems at startup, and they can cause lookup failures during a session. Here's what it looks like when nslookup exits on startup because of a refused query: % nslookup *** Can't find server name for address 192.249.249.3: Query refused *** Default servers are not available % This one has two possible causes. Either your name server does not support inverse queries (older nslookups only), or zone security is stopping the lookup. Zone security is not limited to causing nslookup to fail to start up. It can also cause lookups and zone transfers to fail in the middle of a session when you point nslookup to a remote name server. This is what you will see: % nslookup Default Server: hp.com Address: 15.255.152.4 > server terminator.movie.edu Default Server: terminator.movie.edu Address: 192.249.249.3 > carrie.movie.edu. Server: terminator.movie.edu Address: 192.249.249.3 *** terminator.movie.edu can't find carrie.movie.edu.: Query refused > ls movie.edu - This attempts a zone transfer [terminator.movie.edu] *** Can't list domain movie.edu: Query refused

• Question 400:

  Your network contains an Active Directory domain. The domain contains 20 domain controllers. You need to identify which domain controllers are global catalog servers. Which tool should you use?

  A. Dcdiag
  B. Get-ADComputer
  C. Net computer
  D. Netsh
  D. Netsh

  ---

  The FSMO role holders can be easily found by use of the Netdom command. On any domain controller, click Start, click Run, type CMD in the Open box, and then click OK. In the Command Prompt window, type netdom query / domain: fsmo (where is the name of YOUR domain).

  Note: netsh is also known as the command prompt.