Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 401:

  Your network contains a server named Server1 that runs Windows Server 2008 R2. You create an Active Directory Lightweight Directory Services (AD LDS) instance on Server1. You need to create an additional AD LDS application directory partition in the existing instance.

  Which tool should you use?

  A. Adaminstall
  B. Dsadd
  C. Dsmod
  D. Ldp
  D. Ldp

  ---

  http://technet.microsoft.com/en-us/library/cc755251.aspx Create an Application Directory Partition

  You use Ldp.exe to add a new application directory partition to an existing instance of Active Directory Lightweight Directory Services (AD LDS).

• Question 402:

  Your network contains an Active Directory domain named contoso.com. You create a GlobalNames zone. You add an alias (CNAME) resource record named Server1 to the zone. The target host of the record is server2.contoso.com.

  When you ping Server1, you discover that the name fails to resolve. You successfully resolve server2.contoso.com.

  You need to ensure that you can resolve names by using the GlobalNames zone. What should you do?

  A. From the command prompt, use the netsh tool.
  B. From the command prompt, use the dnscmd tool.
  C. From DNS Manager, modify the properties of the GlobalNames zone.
  D. From DNS Manager, modify the advanced settings of the DNS server.
  B. From the command prompt, use the dnscmd tool.

  ---

  http://technet.microsoft.com/en-us/library/cc731744.aspx Enable GlobalNames zone support

  The GlobalNames zone is not available to provide name resolution until GlobalNames zone support is explicitly enabled by using the following command on every authoritative DNS server in the forest: dnscmd /config /enableglobalnamessupport 1

• Question 403:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain. The domain contains 10 domain controllers. The domain controllers run Windows Server 2008 R2 and are configured as DNS servers.

  You plan to create an Active Directory-integrated zone.

  You need to ensure that the new zone is replicated to only four of the domain controllers.

  What should you do first?

  A. Use the dnscmd tool with the /enlistdirectorypartition parameter.
  B. Create a new delegation in the ForestDnsZones application directory partition.
  C. Use the dnscmd tool with the /createdirectorypartition parameter.
  D. Use the dnscmd tool with the /createbuiltindirectorypartitions parameter.
  D. Use the dnscmd tool with the /createbuiltindirectorypartitions parameter.

• Question 404:

  Your network contains an Active Directory domain. The domain contains two Active Directory sites named Site1 and Site2. Site1 contains two domain controllers named DC1 and DC2. Site2 contains two domain controller named DC3 and DC4, The functional level of the domain is Windows Server 2008 R2. The functional level of the forest is Windows Server 2003.

  Active Directory replication between Site1 and Site2 occurs from 20:00 to 01:00 every day. At 07:00, an administrator deletes a user account while he is logged on to DC1.

  You need to restore the deleted user account. You want to achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. On DC3, stop Active Directory Domain Services, perform an authoritative restore, and then start Active Directory Domain Services.
  B. On DC3, run the Restore-ADObject cmdlet.
  C. On DC1, run the Restore-ADObject cmdlet.
  D. On DC1, stop Active Directory Domain Services, restore the SystemState, and then start Active Directory Domain Services.
  A. On DC3, stop Active Directory Domain Services, perform an authoritative restore, and then start Active Directory Domain Services.

  ---

  We cannot use Restore-ADObject, because Restore-ADObject is a part of the Recycle Bin feature, and you can only use Recycle Bin when the forest functional level is set to Windows Server 2008 R2. In the question text it says "The

  functional level of the forest is Windows Server 2003."

  See http://technet.microsoft.com/nl-nl/library/dd379481.aspx Performing an authoritative restore on DC3 updates the Update Sequence Number (USN) on that DC, which causes it to replicate the restored user account to other DC's.

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 692 "An authoritative restore restores data that was lost and updates the Update Sequence Number (USN) for the data to make it authoritative and ensure that

  it is replicated to all other servers."

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc755296.aspx

  Authoritative restore of AD DS has the following requirements:

  (...)

  You must stop the Active Directory Domain Services service before you run the ntdsutil authoritative restore command and restart the service after the command is complete.

• Question 405:

  Your network contains two Active Directory forests named contoso.com and nwtraders.com. Active Directory Rights Management Services (AD RMS) is deployed in each forest. You need to ensure that users from the nwtraders.com forest can access AD RMS protected content in the contoso.com forest.

  What should you do?

  A. Add a trusted user domain to the AD RMS cluster in the nwtraders.com domain.
  B. Create an external trust from nwtraders.com to contoso.com.
  C. Add a trusted user domain to the AD RMS cluster in the contoso.com domain.
  D. Create an external trust from contoso.com to nwtraders.com.
  C. Add a trusted user domain to the AD RMS cluster in the contoso.com domain.

  ---

  Reference: http://technet.microsoft.com/en-us/library/hh311036.aspx

  Using AD RMS trust It is not necessary to create trust or federation relationships between the Active Directory forests of organizations to be able to share rights-protected information between separate organizations. AD RMS provides two types of trust relationships that provide this kind of rights-protected information exchange. A trusted user domain (TUD) allows the AD RMS root cluster to process requests for client licensor certificates or use licenses from users whose rights account certificates (RACs) were issued by a different AD RMS root cluster. You add a trusted user domain by importing the server licensor certificate of the AD RMS cluster to trust.

• Question 406:

  You have a Windows PowerShell script that contains the following code:

  import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword $_. password}

  When you run the script, you receive an error message indicating that the format of the password is incorrect.The script fails.

  You need to run a script that successfully creates the user accounts by using the password contained in accounts.csv.

  Which script should you run?

  A. import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword(ConvertTo-SecureString "Password" -AsPlainText -force)}
  B. import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword(ConvertTo-SecureString $_.Password -AsPlainText -force)}
  C. import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword(Read-Host -AsSecureString "Password")}
  D. import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword(Read-Host -AsSecureString $_.Password)}
  B. import-csv Accounts.csv | Foreach {New-ADUser -Name $_.Name -Enabled $true - AccountPassword(ConvertTo-SecureString $_.Password -AsPlainText -force)}

  ---

  import-csv Accounts.csv | Foreach { New-ADUser -Name $_.Name -Enabled $true - AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -force)} Personal comment: import comma separated values file (most probably containing a column for Name and one for Password) for each line of values create a new AD user with the name contained in the Name column enable the account and set the password with the value contained in the Password column; import the password from plain text as a secure string and ignore warnings/errors http://technet.microsoft.com/en-us/library/hh849818.aspx ConvertTo-SecureString .. Parameters -AsPlainText Specifies a plain text string to convert to a secure string. The secure string cmdlets help protect confidential text. The text is encrypted for privacy and is deleted from computer memory after it is used. If you use this parameter to provide plain text as input, the system cannot protect that input in this manner. To use this parameter, you must also specify the Force parameter. -Force Confirms that you understand the implications of using the AsPlainText parameter and still want to use it.

• Question 407:

  Your company asks you to implement Windows Cardspace in the domain.

  You want to use Windows Cardspace at your home.

  Your home and office computers run Windows Vista Ultimate.

  What should you do to create a backup copy of Windows Cardspace cards to be used at home?

  A. Log on with your administrator account and copy \Windows\ServiceProfiles folder to your USB drive
  B. Backup \Windows\Globalization folder by using backup status and save the folder on your USB drive
  C. Back up the system state data by using backup status tool on your USB drive
  D. Employ Windows Cardspace application to backup the data on your USB drive.
  E. Reformat the C: Drive
  F. None of the above
  D. Employ Windows Cardspace application to backup the data on your USB drive.

  ---

  http://windows.microsoft.com/en-us/windows7/windows-cardspace-for-itpros# BKMK_HowdoIbackupmycardsortransferthemtoanothercomputer Windows

  CardSpace for IT pros

  Microsoft Windows CardSpaceTM is a system for creating relationships with websites and online services.

  Windows CardSpace provides a consistent way for:

  Sites to request information from you.

  You to review the identity of a site.

  You to manage your information by using Information Cards.

  You to review card information before you send it.

  Windows CardSpace can replace the user names and passwords that you use to register with and log on to websites and online services.

  15. How do I back up my cards or transfer them to another computer? Cards are stored on your computer in an encrypted format. To save a backup file containing some or all of your cards or to use a card on a different computer, you can

  save cards to a backup card file.

  To back up your cards:

  1.

  Start Windows CardSpace.

  2.

  View all your cards.

  3.

  In the pane on the right of your screen, click Back up cards.

  4.

  Select the cards that you want to back up.

  5.

  Browse to the folder where you want to save the backup card file, and then give it a name. When you complete these steps, you save a file containing some or all of your cards. You can copy the backup card file to media such as a

  Universal Serial Bus (USB) storage device, CD, or other digital media. You can restore the backup card file on this computer or on another computer.

  To restore your cards

  1.

  Save the backup card file to the computer.

  2.

  Browse to the location of the file on the computer.

  3.

  Double-click the file, and then follow the instructions to restore the cards.

• Question 408:

  Your company purchases a new application to deploy on 200 computers. The application requires that you modify the registry on each target computer before you install the application.

  The registry modifications are in a file that has an .adm extension.

  You need to prepare the target computers for the application.

  What should you do?

  A. Import the .adm file into a new Group Policy Object (GPO). Edit the GPO and link it to an organizational unit that contains the target computers.
  B. Create a Microsoft Windows PowerShell script to copy the .adm file to each computer. Run the REDIRUsr CONTAINER-DN command on each target computer.
  C. Create a Microsoft Windows PowerShell script to copy the .adm file to the startup folder of each target computer.
  D. Create a Microsoft Windows PowerShell script to copy the .adm file to each computer. Run the REDIRCmp CONTAINER-DN command on each target computer.
  A. Import the .adm file into a new Group Policy Object (GPO). Edit the GPO and link it to an organizational unit that contains the target computers.

  ---

  http://www.petri.co.il/adding_new_administrative_templates_to_gpo.htm Adding New Administrative Templates to a GPO

  Adding .ADM files to the Administrative Templates in a GPO In order to add additional .ADM files to the existing Administrative Templates section in GPO please follow the next steps:

  1.

  Open the Group Policy Management Console (or GPMC) from the Administrative Tools folder in the Stat menu, or by typing gpmc.msc in the Run command.

  2.

  Right-click an existing GPO (or create an new GPO, then right-click on it) and select Edit.

• Question 409:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. DC1 has the DNS Server server role installed and hosts an Active Directory- integrated zone for contoso.com. The no-refresh interval and the refresh interval are both set to three days. The Advanced DNS settings of DC1 are shown in the Advanced DNS Settings exhibit. (Click the Exhibit button.)

  

  You open the properties of a static record named Server1 as shown in the Server1 Record exhibit.(Click the Exhibit button.)

  

  You discover that the scavenging process ran today, but the record for Server1 was not deleted.

  You run dnscmd.exe and specify the age all records parameter.

  You need to identify when the record for Server1 will be deleted from the zone.

  In how many days will the record be deleted?

  A. 13
  B. 10
  C. 23
  D. 7
  D. 7

  ---

  The blank Record time stamp field indicates a static record. That's the reason it wasn't deleted. The timestamp has been set using dnscmd /ageallrecords.

  The Time to live setting means that the server will hold a cached record for 10 days, so it has nothing to do with this question. The record will become stale in six days (no-refresh interval + refresh interval, that's 3 + 3 days), so now that the

  timestamp has been set it will be deleted when the next scavenging operation occurs, in seven days.

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc772069.aspx

  dnscmd /ageallrecords Sets the current time on all time stamps in a zone or node. Record scavenging does not occur unless the records are time stamped. Name server (NS) resource records, start of authority (SOA) resource records, and

  Windows Internet Name Service (WINS) resource records are not included in the scavenging process, and they are not time stamped even when the ageallrecords command runs.

  Reference 2:

  http://www.windowsitpro.com/article/dns/scavenging-stale-dns-records

  When a record is older than the sum of the no-refresh interval and the refresh interval, the scavenging feature considers the record stale and deletes it. So, when you set No-refresh interval to 3 days and Refresh interval to 5 days, scavenging

  will delete records that are more than 8 days old.

• Question 410:

  Your network contains two Active Directory forests named contoso.com and nwtraders.com. Active Directory Rights Management Services (AD RMS) is deployed in each forest. You need to ensure that users from the nwtraders.com forest can access AD RMS protected content in the contoso.com forest.

  What should you do?

  A. Add a trusted user domain to the AD RMS cluster in the nwtraders.com domain.
  B. Add a trusted user domain to the AD RMS cluster in the contoso.com domain.
  C. Create an external trust from nwtraders.com to contoso.com.
  D. Create an external trust from contoso.com to nwtraders.corn.
  B. Add a trusted user domain to the AD RMS cluster in the contoso.com domain.

  ---

  Reference: http://technet.microsoft.com/en-us/library/hh311036.aspx

  Using AD RMS trust It is not necessary to create trust or federation relationships between the Active Directory forests of organizations to be able to share rights-protected information between separate organizations. AD RMS provides two types of trust relationships that provide this kind of rights-protected information exchange. A trusted user domain (TUD) allows the AD RMS root cluster to process requests for client licensor certificates or use licenses from users whose rights account certificates (RACs) were issued by a different AD RMS root cluster. You add a trusted user domain by importing the server licensor certificate of the AD RMS cluster to trust.

  http://technet.microsoft.com/en-us/library/dd772648(v=ws.10).aspx