Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 431:

  You deploy an Active Directory Federation Services (AD FS) Federation Service Proxy on a server namedServer1. You need to configure the Windows Firewall on Server1 to allow external users to authenticate by using AD FS. Which protocol should you allow on Server1?

  A. Kerberos
  B. SSL
  C. SMB
  D. RPC
  B. SSL

  ---

  Reference:

  MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) page 903 AD FS relies on secure HTTP communications by using SSL authentication certificates to verify the identity of both the server and the client during

  communications. Because of this, all communications occur through port 443 over HTTPS.

• Question 432:

  Your network contains an Active Directory domain named contoso.com. The domain contains a domain controller named Server1. Server1 has an IP address of 192.168.200.100.

  You need to view the Pointer (PTR) record for Server1.

  Which zone should you open in the DNS snap-in to view the record? To answer, select the appropriate zone in the answer area.

  Hot Area:

  

  

  ---

  Reference 1:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 57

  Reverse lookup: This occurs when a client computer knows the IP address of another computer and requires its hostname, which can be found in the DNS server's PTR (pointer) resource record.

  Reference 2:

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 45/730

  You are configuring a reverse lookup zone for your network, which uses the Class C network address range of 192.168.5.0/24. Which of the following addresses should you use for the reverse lookup zone?

  a. 5.168.192.in-addr.arpa

  b. 0.5.168.192.in-addr.arpa

  c. 192.168.5.in-addr.arpa

  d. 192.168.5.0.in-addr.arpa

  The reverse lookup zone contains octets of the network portion of the IP address in reverse sequence and uses a special domain name ending in in-addr.arpa. Thus the correct address is 5.168.192.in-addr.arpa. You do not use the host portion of the IP address, so 0.5.168.192.inaddr.

  arpa is incorrect. The octets must be specified in reverse sequence, so the other two choices are both incorrect.

• Question 433:

  You configure and deploy a Group Policy object (GPO) that contains AppLocker settings.

  You need to identify whether a specific application file is allowed to run on a computer.

  Which Windows PowerShell cmdlet should you use?

  A. Get-AppLockerFileInformation
  B. Get-GPOReport
  C. Get-GPPermissions
  D. Test-AppLockerPolicy
  D. Test-AppLockerPolicy

  ---

  Reference:

  http://technet.microsoft.com/en-us/library/ee460960.aspx

  Test-AppLockerPolicy

  Tests whether the input files are allowed to run for a given user based on the specified AppLocker policy.

• Question 434:

  Your network contains an Active Directory domain named contoso.com. You need to create a Group Policy object (GPO) that contains all of the settings included in the Windows Server 2008 R2 Security Baseline. The solution must minimize administrative effort.

  Which three actions should you perform in sequence? (To answer, move the appropriate three actions from the list of actions to the answer area and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  Box 1: Install Microsoft Security Compliance Manager (SCW) 3.0.

  Box 2: Export a baseline.

  Box 3: Create a new GPO by using a starter GPO.

  Note:

  Step 1: Install the SCW tool.

  Step 2:From SCW export the appropriate baseline.

  Step 3: A new GPO can be based on the exported baseline by using a starter GPO.

  * The Security Compliance Manager provides centralized security baseline management features, a baseline portfolio, customization capabilities, and security baseline export flexibility to accelerate your organization's ability to efficiently manage the security and compliance process for the most widely used Microsoft technologies.

  * When creating new GPOs you can choose to use a Starter GPO as the Source Starter GPO (read: template) - which makes it easy to create multiple GPOs with the same baseline configuration, see Figure below.

  

• Question 435:

  A corporate network includes a single Active Directory Domain Services (AD D5) domain. All regular user accounts reside in an organizational unit (OU) named Employees. All administrator accounts reside in an OU named Admins.

  You need to ensure that any time an administrator modifies an employee's name in AD DS, the change is audited.

  What should you do first?

  A. Use the Auditpol.exe command-line tool to enable the directory services access auditing subcategory.
  B. Enable the Audit directory service access setting in the Default Domain Controllers Policy Group Policy Object.
  C. Create a Group Policy Object with the Audit directory service access setting enabled and link it to the Employees OU.
  D. Enable the Audit directory service access setting in the Default Domain Policy Group Policy Object.
  A. Use the Auditpol.exe command-line tool to enable the directory services access auditing subcategory.

  ---

  Before we can use the Directory Service Changes audit policy subcategory, we have to enable it first.

  We can do that by using auditpol.exe.

  Reference:

  http://technet.microsoft.com/en-us/library/cc731607.aspx

  Auditing changes to objects in AD DS

  In Windows 2000 Server and Windows Server 2003, there was one audit policy, Audit directory service access, that controlled whether auditing for directory service events was enabled or disabled. In Windows Server 2008, this policy is

  divided into four subcategories:

  

  Directory Service Access

  

  Directory Service Changes

  

  Directory Service Replication

  

  Detailed Directory Service Replication

  The ability to audit changes to objects in AD DS is enabled with the new audit policy subcategory Directory Service Changes. This guide provides instructions for implementing this audit policy subcategory.

  The types of changes that you can audit include a user (or any security principal) creating, modifying, moving, or undeleting an object. The new audit policy subcategory adds the following capabilities to auditing in AD DS:

  When a successful modify operation is performed on an attribute, AD DS logs the previous and current values of the attribute. If the attribute has more than one value, only the values that change as a result of the modify operation are logged.

  (...)

  Steps to set up auditing

  This section includes procedures for each of the primary steps for enabling change auditing:

  Step 1: Enable audit policy.

  Step 2: Set up auditing in object SACLs by using Active Directory Users and Computers.

  Step 1: Enable audit policy.

  This step includes procedures to enable change auditing with either the Windows interface or a command line:

  (...)

  By using the Auditpol command-line tool, you can enable individual subcategories.

  To enable the change auditing policy using a command line

  1.

  Click Start, right-click Command Prompt, and then click Run as administrator.

  2.

  Type the following command, and then press ENTER:

  auditpol /set /subcategory:"directory service changes" /success:enable

• Question 436:

  Your company has an Active Directory Rights Management Services (AD RMS) server. Users have Windows Vista computers. An Active Directory domain is configured at the Windows Server 2003 functional level.

  You need to configure AD RMS so that users are able to protect their documents.

  What should you do?

  A. Install the AD RMS client 2.0 on each client computer.
  B. Add the RMS service account to the local administrators group on the AD RMS server.
  C. Establish an e-mail account in Active Directory Domain Services (AD DS) for each RMS user.
  D. Upgrade the Active Directory domain to the functional level of Windows Server 2008.
  C. Establish an e-mail account in Active Directory Domain Services (AD DS) for each RMS user.

  ---

  http://technet.microsoft.com/en-us/library/cc753531%28v=ws.10%29.aspx AD RMS Step-by-Step Guide

  For each user account and group that you configure with AD RMS, you need to add an e-mail address and then assign the users to groups.

• Question 437:

  Your company has a main office and 50 branch offices. Each office contains multiple subnets. You need to automate the creation of Active Directory subnet objects.

  What should you use?

  A. the Dsadd tool
  B. the Netsh tool
  C. the New-ADObject cmdlet
  D. the New-Object cmdlet
  C. the New-ADObject cmdlet

  ---

  http://technet.microsoft.com/en-us/library/ee617260.aspx New-ADObject Creates an Active Directory object.

  Syntax:

  New-ADObject [-Name] [-Type] [-AuthType { | }] [-Credential ] [-Description ] [-DisplayName] [-Instance ] [- OtherAttributes ] [-PassThru ]

  [-Path ] [- ProtectedFromAccidentalDeletion ] [-Server ] [-Confirm] [-WhatIf] []

  Detailed Description

  The New-ADObject cmdlet creates a new Active Directory object such as a new organizational unit or new user account. You can use this cmdlet to create any type of Active Directory object. Many object properties are defined by setting

  cmdlet parameters. Properties that are not set by cmdlet parameters can be set by using the OtherAttributes parameter.

  You must set the Name and Type parameters to create a new Active Directory object. The Name specifies the name of the new object. The Type parameter specifies the LDAP display name of the Active Directory Schema Class that

  represents the type of object you want to create. Examples of Type values include computer, group, organizational unit, and user.

  The Path parameter specifies the container where the object will be created.. When you do not specify the Path parameter, the cmdlet creates an object in the default naming context container for Active Directory objects in the domain.

• Question 438:

  Your company has an Active Directory forest that contains multiple domain controllers. The domain controllers run Windows Server 2008.

  You need to perform an authoritative restore of a deleted organizational unit and its child objects.

  Which four actions should you perform in sequence? (To answer, move the appropriate four actions from the list of actions to the answer area, and arrange them in the correct order.)

  Select and Place:

  

  

  ---

  References: Performing Authoritative Restore of Active Directory Objects http://technet.microsoft.com/en-us/library/cc816878.aspx Restart the Domain Controller in Directory Services Restore Mode Locally http://technet.microsoft.com/en-us/library/cc816897.aspx Restore AD DS from Backup (Nonauthoritative Restore) http://technet.microsoft.com/en-us/library/cc794755.aspx

  Mark an Object or Objects as Authoritative http://technet.microsoft.com/en-us/library/cc816813.aspx Restart the Domain Controller in Directory Services Restore Mode Locally If you have physical access to a domain controller, you can restart the domain controller in Directory Services Restore Mode (DSRM) locally. Restarting in DSRM takes the domain controller offline. In this mode, the server is functioning as a member server, not as a domain controller. During installation of Active Directory Domain Services (AD DS), you set the Administrator password for logging on to the server in DSRM. When you start Windows Server 2008 in DSRM, you must log on by using this DSRM password for the local Administrator account. Restore AD DS from Backup (Nonauthoritative Restore) Nonauthoritative restore from backup restores Active Directory Domain Services (AD DS) from its current state to the previous state of a backup. Use this procedure before you perform an authoritative restore procedure to recover objects that were deleted after the time of the backup. To restore AD DS from backup, use a system state or critical-volumes backup. Mark an Object or Objects as Authoritative In this procedure, you use the ntdsutil command to select objects that are to be marked authoritative when they replicate to other domain controllers. Restart the domain controller [Don't restart the domain controller in Safe Mode, you would have a 'crippled' server without AD DS.]

• Question 439:

  Contoso, Ltd. has an Active Directory domain named ad.contoso.com. Fabrikam, Inc. has an Active Directory domain named intranet.fabrikam.com. Fabrikam's security policy prohibits the transfer of internal DNS zone data outside the Fabrikam network.

  You need to ensure that the Contoso users are able to resolve names from the intranet.fabrikam.com domain.

  What should you do?

  A. Create a new stub zone for the intranet.fabrikam.com domain.
  B. Configure conditional forwarding for the intranet.fabrikam.com domain.
  C. Create a standard secondary zone for the intranet.fabrikam.com domain.
  D. Create an Active DirectoryCintegrated zone for the intranet.fabrikam.com domain.
  B. Configure conditional forwarding for the intranet.fabrikam.com domain.

  ---

  Answer: Configure conditional forwarding for the intranet.fabrikam.com domain.

  http://technet.microsoft.com/en-us/library/cc730756.aspx Understanding Forwarders

  A forwarder is a Domain Name System (DNS) server on a network that forwards DNS queries for external DNS names to DNS servers outside that network. You can also forward queries according to specific domain names using conditional

  forwarders.

  You designate a DNS server on a network as a forwarder by configuring the other DNS servers in the network to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution

  for names outside your network, such as names on the Internet, and improve the efficiency of name resolution for the computers in your network. The following figure illustrates how external name queries are directed with forwarders.

  

  Conditional forwarders

  A conditional forwarder is a DNS server on a network that forwards DNS queries according to the DNS domain name in the query. For example, you can configure a DNS server to forward all the queries that it receives for names ending with

  corp.contoso.com to the IP address of a specific DNS server or to the IP addresses of multiple DNS servers.

  Further information:

  http://technet.microsoft.com/en-us/library/cc794735%28v=ws.10%29.aspx Assign a Conditional Forwarder for a Domain Name

  http://technet.microsoft.com/en-us/library/cc754941.aspx Configure a DNS Server to Use Forwarders

• Question 440:

  You need to force a domain controller to register all service location (SRV) resource records in DNS.

  Which command should you run?

  A. ipconfig.exe /registerdns
  B. net.exe stop dnscache and net.exe start dnscache
  C. net.exe stop netlogon and net.exe start netlogon
  D. regsvr32.exe dnsrslvr.dll
  C. net.exe stop netlogon and net.exe start netlogon

  ---

  MCTS 70-640 Cert Guide: Windows Server 2008 Active Directory, Configuring (Pearson IT Certification, 2010) page 62 The SRV resource records for a domain controller are important in enabling clients to locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a domain controller is restarted. You can also re-register a domain controller's SRV resource records by restarting this service from the Services branch of Server Manager or by typing net start netlogon. An exam question might ask you how to troubleshoot the nonregistration of SRV resource records.