Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 411:

  Your network contains an Active Directory domain named contoso.com. The domain contains an enterprise certification authority (CA). You need to deploy certificates based on Version 1 templates to all of the computers in the domain. The

  solution must minimize administrative effort.

  You create a Group Policy object (GPO) named GPOl and link the GPO to the domain.

  What should you do next?

  A. In GPOl, configure Certificate Services Client - Certificate Enrollment Policy.
  B. Duplicate the templates. In GPOl, configure Certificate Services Client - Auto-Enrollment.
  C. Duplicate the templates. In GPOl, configure Automatic Certificate Request Settings.
  D. In GPOl, configure Certificate Services Client - Auto-Enrollment.
  C. Duplicate the templates. In GPOl, configure Automatic Certificate Request Settings.

  ---

  Automatic certificate request settings

  Certificate enrollment is the process of requesting, receiving, and installing a certificate. By using automatic certificate settings in public key policies, you can have computers that are associated with a Group Policy object (GPO) automatically

  enroll for certificates. This can save you the step of explicitly enrolling for computer-related certificates for each computer. After you establish an automatic certificate request, the actual certificate requests occur the next time the computers

  associated with the GPO log on to the network.

  Incorrect:

  Not A: Certificate enrollment policy provides the locations of certification authorities (CAs) and the types of certificates that can be requested. Organizations that are using Active Directory Domain Services (AD DS) can use Group Policy to

  provide certificate enrollment policy to domain members by using the Group Policy Management Console to configure the certificate enrollment policy settings. The Certificates snap-in can be used to configure certificate enrollment policy

  settings for individual client computers unless the Group Policy setting is configured to disable user-configured enrollment policy.

• Question 412:

  Your network contains an Active Directory domain. The domain contains 20 domain controllers. You need to identify which domain controllers are global catalog servers. Which tool should you use?

  A. Netsh
  B. Dsquery
  C. Nltest
  D. Get-ADRootDSE
  D. Get-ADRootDSE

• Question 413:

  Your network contains two Active Directory forests named contoso.com and adatum.com. Active Directory Rights Management Services (AD RMS) is deployed in contoso.com. An AD RMS trusted user domain (TUD) exists between contoso.com and adatum.com.

  From the AD RMS logs, you discover that some clients that have IP addresses in the adatum.com forest are authenticating as users from contoso.com.

  You need to prevent users from impersonating contoso.com users.

  What should you do?

  A. Configure trusted e-mail domains.
  B. Enable lockbox exclusion in AD RMS.
  C. Create a forest trust between adatum.com and contoso.com.
  D. Add a certificate from a third-party trusted certification authority (CA).
  A. Configure trusted e-mail domains.

  ---

  http://technet.microsoft.com/en-us/library/cc753930.aspx Add a Trusted User Domain

  By default, Active Directory Rights Management Services (AD RMS) does not service requests from users whose rights account certificate (RAC) was issued by a different AD RMS installation. However, you can add user domains to the list

  of trusted user domains (TUDs), which allows AD RMS to process such requests.

  For each trusted user domain (TUD), you can also add and remove specific users or groups of users. In addition, you can remove a TUD; however, you cannot remove the root cluster for this Active Directory forest from the list of TUDs. Every

  AD RMS server trusts the root cluster in its own forest.

  You can add TUDs as follows:

  To support external users in general, you can trust Windows Live ID. This allows an AD RMS cluster that is in your company to process licensing requests that include a RAC that was issued by Microsoft's online RMS service. For more

  information about trusting Windows Live ID in your organization, see Use Windows Live ID to Establish RACs for Users.

  To trust external users from another organization's AD RMS installation, you can add the organization to the list of TUDs. This allows an AD RMS cluster to process a licensing request that includes a RAC that was issued by an AD RMS

  server that is in the other organization. In the same manner, to process licensing requests from users within your own organization who reside in a different Active Directory forest, you can add the AD RMS installation in that forest to the list of

  TUDs. This allows an AD RMS cluster in the current forest to process a licensing request that includes a RAC that was issued by an AD RMS cluster in the other forest. For each TUD, you can specify which e-mail domains are trusted. For

  trusted Windows Live ID sites and services, you can specify which e-mail users or domains are not trusted.

• Question 414:

  Your network contains an Active Directory forest. The forest contains one domain named contoso.com.

  You discover the following event in the Event log of domain controllers: "The request for a new accountidentifier pool failed. The operation will be retried until the request succeeds. The error is " %1 ""

  You need to ensure that the domain controllers can acquire new account-identifier pools successfully.

  What should you do?

  A. Move the domain naming master role.
  B. Move the global catalog server.
  C. Restart the Active Directory Domain Services (AD DS) service.
  D. Deploy an additional global catalog server.
  E. Move the infrastructure master role.
  F. Move the PDC emulator role.
  G. Install a read-only domain controller (RODC).
  H. Move the RID master role.
  I. Move the bridgehead server.
  J. Move the schema master role.
  H. Move the RID master role.

  ---

  This error can occur when the server holding the RID master role is not available to provide a new RID pool. Moving the RID master role to another domain controller will resolve this.

  Reference: http://technet.microsoft.com/en-us/library/cc756699.aspx

  Event ID 16651 -- RID Pool Request Users, computers, and groups stored in Active Directory are collectively known as security principals. Each security principal is assigned a unique alphanumeric string called a SID. The SID includes a domain prefix identifier that uniquely identifies the domain and a relative identifier (RID) that uniquely identifies the security principal within the domain. The RID is a monotonically increasing number at the end of the SID. Each domain controller is assigned a pool of RIDs from the global RID pool by the domain controller that holds the RID master role (also known as flexible single master operations or FSMO) in each Active Directory domain. The RID master (also known as the RID pool manager, RID manager, or RID operations master) is responsible for issuing a unique RID pool to each domain controller in its domain. By default, RID pools are obtained in increments of 500. (...) Newly promoted domain controllers must acquire a RID pool before they can advertise their availability to Active Directory clients or share the SYSVOL. Existing domain controllers require additional RID allocations in order to continue creating security principals when their current RID pool becomes depleted.

  Event Details Message The request for a new account-identifier pool failed. The operation will be retried until the request succeeds. The error is " %1 " Resolve Check connectivity to the RID master, and check its replication status A relative ID (RID) pool was not allocated to the local domain controller. Ensure that the local domain controller can communicate with the domain controller that is identified as the RID operations master. Ensure that the RID master is online and replicating to other domain controllers.

• Question 415:

  Your company has a main office and a branch office. The main office contains two domain controllers. You create an Active Directory site named BranchOfficeSite. You deploy a domain controller in the branch office, and then add the domain controller to the BranchOfficeSite site.

  You discover that users in the branch office are randomly authenticated by either the domain controller in the branch office or the domain controllers in the main office.

  You need to ensure that the users in the branch office always attempt to authenticate to the domain controller in the branch office first.

  What should you do?

  A. Create organizational units (OUs).
  B. Create Active Directory subnet objects.
  C. Modify the slow link detection threshold.
  D. Modify the Location attribute of the computer objects.
  B. Create Active Directory subnet objects.

  ---

  http://technet.microsoft.com/en-us/library/cc754697.aspx Understanding Sites, Subnets, and Site Links Sites overview Sites in AD DS represent the physical structure, or topology, of your network. AD DS uses network topology information, which is stored in the directory as site, subnet, and site link objects, to build the most efficient replication topology. The replication topology itself consists of the set of connection objects that enable inbound replication from a source domain controller to the destination domain controller that stores the connection object. The Knowledge Consistency Checker (KCC) creates these connection objects automatically on each domain controller. .. Associating sites and subnets A subnet object in AD DS groups neighboring computers in much the same way that postal codes group neighboring postal addresses. By associating a site with one or more subnets, you assign a set of IP addresses to the site.

  Note The term "subnet" in AD DS does not have the strict networking definition of the set of all addresses behind a single router. The only requirement for an AD DS subnet is that the address prefix conforms to the IP version 4 (IPv4) or IP version 6 (IPv6) format. When you add the Active Directory Domain Services server role to create the first domain controller in a forest, a default site (Default-First-Site-Name) is created in AD DS. As long as this site is the only site in the directory, all domain controllers that you add to the forest are assigned to this site. However, if your forest will have multiple sites, you must create subnets that assign IP addresses to Default-First- Site-Name as well as to all additional sites. .. Locating domain controllers by site Domain controllers register service (SRV) resource records in Domain Name System (DNS) that identify their site names. Domain controllers also register host (A) resource records in DNS that identify their IP addresses. When a client requests a domain controller, it provides its site name to DNS. DNS uses the site name to locate a domain controller in that site (or in the next closest site to the client). DNS then provides the IP address of the domain controller to the client for the purpose of connecting to the domain controller. For this reason, it is important to ensure that the IP address that you assign to a domain controller maps to a subnet that is associated with the site of the respective server object. Otherwise, when a client requests a domain controller, the IP address that is returned might be the IP address of a domain controller in a distant site. When a client connects to a distant site, the result can be slow performance and unnecessary traffic on expensive WAN links.

• Question 416:

  Your network contains an Active Directory forest. The forest contains a single domain. You want to provide users from a domain that is located in another forest access to resources in your domain.

  You need to configure a trust between the domain in your forest and the domain in the other forest.

  What should you create?

  A. an incoming realm trust
  B. an incoming external trust
  C. an outgoing external trust
  D. an outgoing realm trust
  C. an outgoing external trust

• Question 417:

  Your company has an Active Directory domain. The company has two domain controllers named DC1 and DC2. DC1 holds the Schema Master role.

  DC1 fails. You log on to Active Directory by using the administrator account. You are not able to transfer the Schema Master operations role.

  You need to ensure that DC2 holds the Schema Master role.

  What should you do?

  A. Configure DC2 as a bridgehead server.
  B. On DC2, seize the Schema Master role.
  C. Log off and log on again to Active Directory by using an account that is a member of the Schema Administrators group. Start the Active Directory Schema snap-in.
  D. Register the Schmmgmt.dll. Start the Active Directory Schema snap-in.
  B. On DC2, seize the Schema Master role.

  ---

  Answer: On DC2, seize the Schema Master role.

  http://technet.microsoft.com/en-us/library/cc816645%28v=ws.10%29.aspx Transfer the Schema Master

  You can use this procedure to transfer the schema operations master role if the domain controller that currently hosts the role is inadequate, has failed, or is being decommissioned. The schema master is a forest-wide operations master (also

  known as flexible single master operations or FSMO) role.

  ..

  Note: You perform this procedure by using a Microsoft Management Console (MMC) snap-in, although you can also transfer this role by using Ntdsutil.exe.

  Membership in Schema Admins, or equivalent, is the minimum required to complete this procedure. http://technet.microsoft.com/en-us/library/cc794853% 28v=ws.10%29.aspx Seize the AD LDS Schema Master Role

  The schema master is responsible for performing updates to the Active Directory Lightweight Directory Services (AD LDS) schema. Each configuration set has only one schema master. All write operations to the AD

  LDS schema can be performed only when connected to the AD LDS instance that holds the schema master role within its configuration set. Those schema updates are replicated from the schema master to all other instances in the

  configuration set.

  Membership in the AD LDS Administrators group, or equivalent, is the minimum required to complete this procedure.

  Caution: Do not seize the schema master role if you can transfer it instead. Seizing the schema master role is a drastic step that should be considered only if the current operations master will never be available again.

• Question 418:

  Your network contains a single Active Directory domain. All servers run Windows Server 2008 R2.

  You deploy a new server that runs Windows Server 2008 R2. The server is not connected to the internal network.

  You need to ensure that the new server is already joined to the domain when it first connects to the internal network.

  What should you do?

  A. From a domain controller, run sysprep.exe and specify the /oobe parameter. From the new server, run sysprep.exe and specify the /generalize parameter.
  B. From a domain controller, run sysprep.exe and specify the /generalize parameter. From the new server, run sysprep.exe and specify the /oobe parameter.
  C. From a domain-joined computer, run djoin.exe and specify the /provision parameter. From the new server, run djoin.exe and specify the /requestodj parameter.
  D. From a domain-joined computer, run djoin.exe and specify the /requestodj parameter. From the new server, run djoin.exe and specify the /provision parameter.
  C. From a domain-joined computer, run djoin.exe and specify the /provision parameter. From the new server, run djoin.exe and specify the /requestodj parameter.

  ---

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 217, 218 Offline Domain Join

  Offline domain join is also useful when a computer is deployed in a lab or other disconnected environment.

  When the computer is connected to the domain network and started for the first time, it will already be a member of the domain. This also helps to ensure that Group Policy settings are applied at the first startup. Four major steps are required

  to join a computer to the domain by using offline domain join:

  1.

  Log on to a computer in the domain that is running Windows Server 2008 R2 or Windows 7 with an account that has permissions to join computers to the domain.

  2.

  Use the DJoin command to provision a computer for offline domain join. This step prepopulates Active

  Directory with the information that Active Directory needs to join the computer to the domain, and exports the information called a blob to a text file.

  3.

  At the offline computer that you want to join the domain use DJoin to import the blob into the Windows directory.

  4.

  When you start or restart the computer, it will be a member of the domain.

  Reference 2:

  http://technet.microsoft.com/nl-nl/library/offline-domain-join-djoin-step-by-step.aspx Steps for performing an offline domain join

  The offline domain join process includes the following steps:

  1.

  Run the djoin.exe /provision command to create computer account metadata for the destination computer (the computer that you want to join to the domain). As part of this command, you must specify the name of the domain that you want the computer to join.

  2.

  Run the djoin.exe /requestODJ command to insert the computer account metadata into the Windows directory of the destination computer.

  3.

  When you start the destination computer, either as a virtual machine or after a complete operating system installation, the computer will be joined to the domain that you specify.

• Question 419:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named DC1. DC1 has the DNS Server server role installed and hosts an Active Directory- integrated zone for contoso.com. The no-refresh interval is set to three days and the refresh interval is set to 10 days.

  The Advanced DNS settings of DC1 are shown in the Advanced DNS Settings exhibit. (Click the Exhibit button.)

  

  You open the properties of a static record named Server1 as shown in the Server1 Record exhibit. (Click the Exhibit button.)

  

  You discover that the scavenging process ran today, but the record for Server1 was not deleted. You run dnscmd.exe and specify the ageallrecords parameter.

  You need to identify when the record for Server1 will be deleted from the zone.

  In how many days will the record be deleted?

  A. 7
  B. 10
  C. 17
  D. 20
  C. 17

• Question 420:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain and two AD DS sites. The AD DS sites are named Toronto and Montreal.

  Each site has multiple domain controllers.

  You need to determine which domain controller holds the Inter-Site Topology Generator role for the Toronto site.

  What should you do?

  A. Use the Ntdsutil tool with the roles parameter.
  B. Use the Ntdsutil tool with the local roles parameter.
  C. Use the LDP tool to view the NTDS Site Settings for the Toronto site.
  D. Use the LDP tool to view the properties of each domain controller in the Toronto site
  D. Use the LDP tool to view the properties of each domain controller in the Toronto site