Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 421:

  Your network contains an Active Directory domain. All domain controllers run Windows Server 2008 R2.

  You need to collect all of the Directory Services events from all of the domain controllers and store the events in a single central computer.

  What should you do?

  A. Run the ntdsutil.exe command.
  B. Run the repodmin.exe command.
  C. Run the Get-ADForest cmdlet.
  D. Run the dsamain.exe command.
  E. Create custom views from Event Viewer.
  F. Run the dsquery.exe command.
  G. Configure the Active Directory Diagnostics Data Collector Set (DCS),
  H. Configure subscriptions from Event Viewer.
  I. Run the eventcreate.exe command.
  J. Create a Data Collector Set (DCS).
  H. Configure subscriptions from Event Viewer.

  ---

  Reference: http://technet.microsoft.com/en-us/library/cc749183.aspx

  Event Subscriptions Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers. Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events. Using the event collecting feature requires that you configure both the forwarding and the collecting computers. The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting process. To learn about the steps required to configure event collecting and forwarding computers, see Configure Computers to Forward and Collect Events (http://technet.microsoft.com/en-us/library/cc748890.aspx).

• Question 422:

  Your company has a branch office that is configured as a separate Active Directory site and has an Active Directory domain controller.

  The Active Directory site requires a local Global Catalog server to support a new application. You need to configure the domain controller as a Global Catalog server.

  Which tool should you use?

  A. The Server Manager console
  B. The Active Directory Sites and Services console
  C. The Dcpromo.exe utility
  D. The Computer Management console
  E. The Active Directory Domains and Trusts console
  B. The Active Directory Sites and Services console

  ---

  Answer: The Active Directory Sites and Services console http://technet.microsoft.com/en-us/library/cc781329%28v=ws.10%29.aspx Configure a domain controller as a global catalog server To configure a domain controller as a global catalog server

  1. Open Active Directory Sites and Services.

  ...

  Further information:

  http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx What Is the Global Catalog?

  The global catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain in a multidomain Active Directory Domain Services (AD DS) forest. The global catalog is stored on domain

  controllers that have been designated as global catalog servers and is distributed through multimaster replication. Searches that are directed to the global catalog are faster because they do not involve referrals to different domain controllers.

  In addition to configuration and schema directory partition replicas, every domain controller in a forest stores a full, writable replica of a single domain directory partition. Therefore, a domain controller can locate only the objects in its domain.

  Locating an object in a different domain would require the user or application to provide the domain of the requested object. The global catalog provides the ability to locate objects from any domain without having to know the domain name. A

  global catalog server is a domain controller that, in addition to its full, writable domain directory partition replica, also stores a partial, read-only

  replica of all other domain directory partitions in the forest. The additional domain directory partitions are partial because only a limited set of attributes is included for each object. By including only the attributes that are most used for

  searching, every object in every domain in even the largest forest can be represented in the database of a single global catalog server.

  Note: A global catalog server can also store a full, writable replica of an application directory partition, but objects in application directory partitions are not replicated to the global catalog as partial, read- only directory partitions.

  The global catalog is built and updated automatically by the AD DS replication system. The attributes that are replicated to the global catalog are identified in the schema as the partial attribute set (PAS) and are defined by default by Microsoft. However, to optimize searching, you can edit the schema by adding or removing attributes that are stored in the global catalog. In Windows 2000 Server environments, any change to the PAS results in full synchronization (update of all attributes) of the global catalog. Later versions of Windows Server reduce the impact of updating the global catalog by replicating only the attributes that change.

  In a single-domain forest, a global catalog server stores a full, writable replica of the domain and does not store any partial replica. A global catalog server in a single-domain forest functions in the same manner as a nonglobal-catalog server except for the processing of forest-wide searches.

• Question 423:

  You have a server named Server1 that has the following Active Directory Certificate Services (AD CS) role services installed

  

  Enterprise root certification authority (CA)

  

  Certificate Enrollment Web Service

  

  Certificate Enrollment Policy Web Service

  You create a new certificate template.

  External users report that the new template is unavailable when they request a new certificate.

  You verify that all other templates are available to the external users.

  You need to ensure that the external users can request certificates by using the new template.

  What should you do on Server1?

  A. Run iisreset.exe /restart.
  B. Run gpupdate.exe /force.
  C. Run certutil.exe dspublish.
  D. Restart the Active Directory Certificate Services service.
  A. Run iisreset.exe /restart.

  ---

  http://social.technet.microsoft.com/wiki/contents/articles/7734.certificate-enrollment-web-services-in- activedirectory-certificate-services.aspx

  Certificate Enrollment Web Services in Active Directory Certificate Services Troubleshooting Managing Certificate Enrollment Policy Web Service Polling for Certificate Templates Certificate Templates are stored in AD DS, and the Certificate Enrollment Policy Web Service polls the AD DS periodically for template changes. Changes made to templates are not reflected in real time on the Certificate Enrollment Policy Web Service. When administrators duplicate or modify templates, there can be a lag between the time at which the change is made and when the new templates are available. By default, the Certificate Enrollment Policy Web Service polls the directory every 30 minutes for changes. The Certificate Enrollment Policy Web Service can be manually forced to refresh its template cache by recycling IIS using the command iisreset.

• Question 424:

  Your company has an Active Directory domain. You install an Enterprise Root certification authority (CA) on a member server named Server1.

  You need to ensure that only the Security Manager is authorized to revoke certificates that are supplied by Server1.

  What should you do?

  A. Remove the Request Certificates permission from the Domain Users group.
  B. Remove the Request Certificated permission from the Authenticated Users group.
  C. Assign the Allow - Manage CA permission to only the Security Manager user Account.
  D. Assign the Allow - Issue and Manage Certificates permission to only the Security Manger user account
  D. Assign the Allow - Issue and Manage Certificates permission to only the Security Manger user account

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/cc732590.aspx Implement Role-Based Administration

  You can use role-based administration to organize certification authority (CA) administrators into separate, predefined CA roles, each with its own set of tasks.

  Roles are assigned by using each user's security settings.

  You assign a role to a user by assigning that user the specific security settings that are associated with the role. A user that has one type of permission, such as Manage CA permission, can perform specific CA tasks that a user with another

  type of permission, such as Issue and Manage Certificates permission, cannot perform.

  The following table describes the roles, users, and groups that can be used to implement role-based administration.

  Roles and groups

  Certificate manager

  Security permission

  Issue and Manage Certificates

  Description

  Approve certificate enrollment and revocation requests. This is a CA role. This role is sometimes referred to as CA officer. These permissions are assigned by using the Certification Authority snap-in.

• Question 425:

  You have Active Directory Certificate Services (AD CS) deployed.

  You have a Version 1 certificate template.

  You need to ensure that all of the computers in the domain automatically enroll for a certificate based on the certificate template.

  What should you do?

  A. On the certificate template, assign the Read, Enroll, and Autoenroll permission to the Domain Users group.
  B. In a Group Policy object (GPO), configure the Automatic Certificate Request Settings.
  C. On the certificate template, assign the Read and Autoenroll permission to the Authenticated Users group.
  D. In a Group Policy object (GPO), configure the autoenrollment settings.
  B. In a Group Policy object (GPO), configure the Automatic Certificate Request Settings.

• Question 426:

  Your network contains an Active Directory domain named contoso.com. The domain contains three domain controllers named DC1, DC2 and DC3.

  You need to create a zone named adatum.com that replicates between DC1 and DC2 only. The zone data for adatum.com must be writable on both DC1 and DC2.

  Which three actions should you perform in sequence? (To answer, move the appropriate three actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Note:

  * dnscmd /createdirectorypartition

  Creates a DNS application directory partition.

  * dnscmd /EnlistDirectoryPartition

  Adds a DNS server to the replication set of a DNS application directory partition.

• Question 427:

  Your company has a main office and a branch office.

  The network contains an Active Directory domain named contoso.com. The DNS zone for contoso.com is configured as an Active Directory-integrated zone and is replicated to all domain controllers in the domain.

  The main office contains a writable domain controller named DC1. The branch office contains a read- only domain controller (RODC) named RODC1. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers.

  You uninstall the DNS server role from RODC1.

  You need to prevent DNS records from replicating to RODC1.

  What should you do?

  A. Modify the replication scope for the contoso.com zone.
  B. Flush the DNS cache and enable cache locking on RODC1.
  C. Configure conditional forwarding for the contoso.com zone.
  D. Modify the zone transfer settings for the contoso.com zone.
  A. Modify the replication scope for the contoso.com zone.

  ---

  http://technet.microsoft.com/en-us/library/cc754916.aspx Change the Zone Replication Scope

  You can use the following procedure to change the replication scope for a zone. Only Active Directory Domain Services (AD DS)integrated primary and stub forward lookup zones can change their replication scope.

  Secondary forward lookup zones cannot change their replication scope. http://technet.microsoft.com/en-us/library/cc772101.aspx Understanding DNS Zone Replication in Active Directory Domain Services You can store Domain Name System (DNS) zones in the domain or application directory partitions of Active Directory Domain Services (AD DS). A partition is a data structure in AD DS that distinguishes data for different replication purposes. The following table describes the available zone replication scopes for AD DS-integrated DNS zone data.

  

  When you decide which replication scope to choose, consider that the broader the replication scope, the greater the network traffic caused by replication. For example, if you decide to have AD DSintegrated DNS zone data replicated to all DNS servers in the forest, this will produce greater network traffic than replicating the DNS zone data to all DNS servers in a single AD DS domain in that forest.

  AD DS-integrated DNS zone data that is stored in an application directory partition is not replicated to the global catalog for the forest. The domain controller that contains the global catalog can also host application directory partitions, but it will not replicate this data to its global catalog. AD DS-integrated DNS zone data that is stored in a domain partition is replicated to all domain controllers in its AD DS domain, and a portion of this data is stored in the global catalog. This setting is used to support Windows 2000. If an application directory partition's replication scope replicates across AD DS sites, replication will occur with the same intersite replication schedule as is used for domain partition data. By default, the Net Logon service registers domain controller locator (Locator) DNS resource records for the application directory partitions that are hosted on a domain controller in the same manner as it registers domain controller locator (Locator) DNS resource records for the domain partition that is hosted on a domain controller.

• Question 428:

  What is the maximum number of domains that a Windows Server 2008 R2 computer, configured as a domain controller, may participate in at one time?

  A. Zero
  B. One
  C. Two
  D. Any number of domains
  B. One

  ---

  Personal comment:

  A computer, be it a workstation or a server, can be a member of only one domain at a time.

  

  

• Question 429:

  Your network contains an Active Directory domain. The domain contains two Active Directory sites named Site1 and Site2. Site1 contains two domain controllers named DC1 and DC2. Site2 contains two domain controller named DC3 and DC4. The functional level of the domain is Windows Server 2008 R2. The functional level of the forest is Windows Server 2003. Active Directory replication between Site1 and Site2 occurs from 20:00 to 01:00 every day.

  At 07:00, an administrator deletes a user account while he is logged on to DC1. You need to restore the deleted user account. You want to achieve this goal by using the minimum amount of administrative effort.

  What should you do?

  A. On DC1, run the Restore-ADObject cmdlet.
  B. On DC3, run the Restore-ADObject cmdlet.
  C. On DC1, stop Active Directory Domain Services, restore the System State, and then start Active Directory Domain Services.
  D. On DC3, stop Active Directory Domain Services, perform an authoritative restore, and then start Active Directory Domain Services.
  D. On DC3, stop Active Directory Domain Services, perform an authoritative restore, and then start Active Directory Domain Services.

  ---

  We cannot use Restore-ADObject, because Restore-ADObject is a part of the Recycle Bin feature, and you can only use Recycle Bin when the forest functional level is set to Windows Server 2008 R2. In the question text it says "The functional level of the forest is Windows Server 2003." See http://technet.microsoft.com/nl-nl/library/dd379481.aspx Performing an authoritative restore on DC3 updates the Update Sequence Number (USN) on that DC, which causes it to replicate the restored user account to other DC's.

  Reference 1:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 692 An authoritative restore restores data that was lost and updates the Update Sequence Number (USN) for the data to make it authoritative and ensure that it

  is replicated to all other servers.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc755296.aspx

  Authoritative restore of AD DS has the following requirements:

  You must stop the Active Directory Domain Services service before you run the ntdsutil authoritative restore command and restart the service after the command is complete.

• Question 430:

  You have a client computer named Computer1 that runs Windows 7. On Computer1, you configure a source-initiated subscription.

  You configure the subscription to retrieve all events from the Windows logs of a domain controller named DC1.

  The subscription is configured to use the HTTP protocol.

  You discover that events from the Security log of DC1 are not collected on Computer1. Events from the Application log of DC1 and the System log of DC1 are collected on Computer1.

  You need to ensure that events from the Security log of DC1 are collected on Computer1.

  What should you do?

  A. Add the computer account of Computer1 to the Event Log Readers group on the domain controller.
  B. Add the Network Service security principal to the Event Log Readers group on the domain.
  C. Configure the subscription to use custom Event Delivery Optimization settings.
  D. Configure the subscription to use the HTTPS protocol.
  B. Add the Network Service security principal to the Event Log Readers group on the domain.

  ---

  Reference 1:

  http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and- you.aspx

  Preparing Windows Server 2008 and Windows Server 2008 R2

  You have to prepare your Windows Server 2008/2008 R2 machines for collection of security events. To do this, simply add the Network Service account to the Built-in Event Log Readers group.

  Reference 2:

  http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/8434ffb3-1621-4bc5-8311- 66d88b215886/How to collect security logs using event forwarding?

  For Windows Vista, Windows Server 2008 and later version of clients, please follow the steps below to configure it.

  1.

  Click start->run, type CompMgmt.msc to open Computer Management Console.

  2.

  Under Local Users and Groups, click Groups->Event Log Readers to open Event Log Readers Properties.

  3.

  Click Add, then click Location button, select your computer and click OK.

  4.

  Click Object Types button, check the checkbox of Build-in security principals and click OK.

  5.

  Add "Network Service"build-in account to Event Log Readers group.

  6.

  Reboot the client computer.

  After these steps have been taken, you will see the security event logs in the Forwarded Events on your event collector.